Stage with an external security manager

 

+
Search Tips   |   Advanced Search

 

External security managers can be used to externalize authentication and authorization decisions from the portal.

For staging to production the same external security manager is used to manage authentication to the portal for both stage and production.

Entities that are managed by a centralized security manager should only be manageable within that security manager. Managing those entities elsewhere violates the principles of centralized security control. For staging-to-production, this principle leads to the inability to modify security definitions of a resource that is externalized.

The XML configuration interface is used for configuration management in the staging-to-production support. The XML configuration interface covers configurations that are managed by the portal. The XML configuration interface configuration files contain a list of all role mappings for all internally managed resources. Using ESMs allows management of entitlements for selected resources outside of the portal.

For IBM WebSphere Portal, the XML configuration interface covers security definitions of externalized resources. This functionality for the XML configuration interface allows you to provide a request parameter within an export request; this parameter will cause the XML configuration interface to include role mappings of all resources within the XML configuration interface output file. The exported file contains role mappings for internally managed resources as well as externally managed resources. This allows for the staging of role mapping of all resources that are not already externalized in the target system.

The following support matrix illustrates staging support of entitlements in scenarios that involve ESMs. The source system refers to the system from which the configuration is exported (typically the integration system), and the target system is the system into which the configuration is going to be imported (e.g., staging or production system).

no-ESM Target ESM Target
no-ESM Source All role mappings can be fully synchronized.

Resources on the target system are initially managed internally after release staging.

Resources can be externalized on the target system. Role mappings of externally managed resources in the target system will be re-internalized.

ESM Source

Role mappings of internalized resources can be synchronized.

Synchronization of role mappings of externalized resources results in errors during import. (Manual configuration file updates ("change external to internal state") are required to prevent errors.)

Role mappings of internalized resources are fully synchronized.

Role mappings of externalized resources can be synchronized only on time of externalization.

Role mappings for resources that are externalized on the target system cannot be synchronized.

Role mappings can be synchronized as long as the resource is managed internally by the WebSphere Portal server. Once the resource is externalized, role mappings are owned by the ESM system and can not be synchronized. It is not possible to modify role mappings for existing externalized resources and synchronize their updated role mappings to a target system.

 

Staging from system without ESM to a system with ESM

This combination is used where the integration system is reduced as much as possible and is configured like a development environment rather than a production environment.

All entitlements for all resources that are staged in this scenario are fully synchronized. All resources in the target system are managed internally. The ESM is not used for managing authorization decisions.

It is possible to manually externalize resources. We can also manually edit XML configuration interface configuration files. In this step, all role mappings that were defined within the portal before are moved to the ESM. Managing these resources externally might include updating the role mappings of these resources outside the portal.

During staging of subsequent releases, resources with updated entitlements will appear in the XML configuration interface file as internally managed resources. These resources will be internalized at when this file is imported to the target system. Our can manually update the configurations for externally managed resources to prevent this. however, there is no build in support for managing these kinds of configurations. Special care must be taken to manually replicate all changes of role mappings of externalized resources on the target system.

 

Staging from system with ESM to system without ESM

It is unlikely that this scenario will be used by most customers.

In this scenario, entitlements for internalized resources can be staged without any limitations. These configurations appear as if the source system was not configured to use an ESM.

If entitlements for resources that are externalized on the source system are staged, errors will occur on the target system. During import of this configuration, the target system will be asked to externalize a resource, but the system is not configured to support resource externalization. This results in an error condition.

These errors can be resolved by manually updating the configuration file to have all resources managed internally. If role mappings for externalized resources are contained in the configuration file, entitlements will be synchronized between the two systems.

 

Parent topic:

Staging to production

 

Related concepts

About ReleaseBuilder

 

Related tasks


Building a Release