Administrative roles
The J2EE role-based authorization concept is extended to protect the WAS administrative subsystem.
A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based console or the system management scripting interface. The authorization policy is only enforced when administrative security is enabled. The following table describes the administrative roles:
Role Description Monitor An individual or group that uses the monitor role has the least amount of privileges. A monitor can complete the following tasks:
- View the WAS configuration.
- View the current state of the Application Server.
Configurator An individual or group that uses the configurator role has the monitor privilege plus the ability to change the WebSphere Application Server configuration. The configurator can perform all the day-to-day configuration tasks. For example, a configurator can complete the following tasks:
- Create a resource.
- Map an appserver.
- Install and uninstall an application.
- Deploy an application.
- Assign users and groups-to-role mapping for applications.
- Set up Java 2 security permissions for applications.
- Customize the CSIv2, SAS, and SSL configurations.
SAS is supported only between V6.0.x and previous version servers federated in a V6.1 cell.
Operator An individual or group that uses the operator role has monitor privileges plus ability to change the runtime state. For example, an operator can complete the following tasks:
- Stop and start the server.
- Monitor the server status in the console.
Administrator An individual or group that uses the administrator role has the operator and configurator privileges plus additional privileges that are granted solely to the administrator role. For example, an administrator can complete the following tasks:
- Modify the server user ID and password.
- Configure authentication and authorization mechanisms.
- Enable or disable administrative security.
- Enable or disable Java 2 security.
- Change the LTPA password and generate keys.
- Create, update, or delete users in the federated repositories configuration.
- Create, update, or delete groups in the federated repositories configuration.
An administrator cannot map users and groups to the administrator roles.
iscadmins This role is only available for console users, not for wsadmin users. Users who are granted this role have administrator privileges for managing users and groups in the federated repositories. For example, a user of the iscadmins role can complete the following tasks:
- Create, update, or delete users in the federated repositories configuration.
- Create, update, or delete groups in the federated repositories configuration.
Deployer Users granted this role can perform both configuration actions and runtime operations on applications. See the Deployer role section for more details. AdminSecurityManager Fine-grained administrative security is available using wsadmin only. However, you can assign users and groups to the AdminSecurityManager role on the cell level through wsadmin scripts and the console. Use the AdminSecurityManager role, you can assign users and groups to the administrative user roles and administrative group roles. However, an administrator cannot assign users and groups to the administrative user roles and administrative group roles including the AdminSecurityManager role. See the AdminSecurityManager role section for more details.
The server ID that is specified and the administrative ID, if specified, when enabling administrative security is automatically mapped to the administrator role.
Users and groups can be added or removed from the administrative roles from the WAS administrative console at any time. The Primary administrative user name must be used to log on to the console to change the administrative user and group roles. A best practice is to map a group or groups, rather than specific users, to administrative roles because it is more flexible and easier to administer.
In addition to mapping user or groups, a special-subject can also be mapped to the administrative roles. A special-subject subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the administrative role ensures that the user making the request is at least authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security was not enabled.
Deployer role
A user that is granted a deployer role can perform all of the configuration and runtime operations on an application. A deployer role can be subsets of both configurator and operator roles. However, a user granted a deployer role cannot configure or operate any other resources (server, node).
When fine-grained administrative security is used, only a user granted a deployer role to an application can configure and operate that application.
Cell level configurators can configure applications (install, edit, deploy, and uninstall). Cell level operators can also operate (start and stop) applications. However, a user granted a deployer role at cell level can also perform configuration and operation on all applications. The following table lists the capabilities of the deployer role when fine-grained administrative security is used:
Operation Required Roles ( Any one) Install application Cell-configurator, target-deployer Uninstall application Cell-configurator, application-deployer List application Cell-monitor, application-monitor Edit, update and redeploy application Cell-configurator, application-deployer Export application Cell-monitor, application-monitor Start-stop application Cell-operator, application-deployer Where:
- Cell-configurator
- is the configurator role at cell level.
- Application-deployer
- is the deployer role for the application that is being managed.
- Target-deployer
- is the deployer role for all servers or clusters for which an application is targeted. If you have a target-deployer role, you can install a new application on the target. However, to edit or update the installed application, be included in the authorization group of the installed application-deployer.
The target-deployer can not explicitly start or stop a new application. However, when a target-deployer starts a server on a target, all of the applications that have their auto-start attribute set to yes are started when the server starts.
IBM recommends that the application-deployer set this attribute to true if the application-deployer does not want the application to be started by the target-deployer.
AdminSecurityManager role
The AdminSecurityManager role separates administrative security administration from other application administration.
By default, serverId and adminID, if specified, are assigned to this role in the cell level authorization table. This role implies a monitor role. However, an administrator role does not imply the AdminSecurityManager role. When fine-grained admin security is used, only a user granted this role at cell level can manage administrative authorization groups. However, a user granted this role for each administrative authorization group can map users to administrative roles for those groups. The following lists the capabilities of the AdminSecurityManager role at different levels (cell and administrative authorization group):
Action Who can perform Map users to administrative roles for cell level Only the AdminSecurityManager of the cell Map users to administrative roles for an authorization group Only the AdminSecurityManager of that authorization group or the AdminSecurityManager of the cell Manage authorization groups (create, delete, add resource to an authorization group, or remove resource from an authorization group or list) Only the AdminSecurityManager of the cell
Related concepts
Authorization technology
Related tasks
Assigning users to naming roles
Reference topic