Create a fine-grained admin authorization group using the admin console


We can create a fine-grained admin authorization group by selecting admin resources to be part of the authorization group. We can assign users or groups to this new admin authorization group and also give them access to the admin resources contained within. You must be logged into the admin console with cell-level Admin Security Manager authority, or the primary admin ID can make these changes as well.

 

  1. Navigate to Security > Administrative Authorization Groups > New.

  2. Type a name for the admin authorization group into the Name field.

    This is a required field. The name must be unique within the cell structure. If the name is not unique then the new admin authorization group is not created at the end of this procedure.

  3. Select the resources from the Resource section to which you want the new admin authorization group to control access.

    Resources that are displayed in black text are available for selection.

    Resources that are displayed in grey are already members of a different administrative authorization group. Therefore, these resources are not available for inclusion in the new admin authorization group. When a resource is a member of a different authorization group, the name of the group displays next to the resource name. For example: server_1 (group_1)

    Your filtering options include the following:

    • Nodes. (All of the resources associated with the nodes.)

    • Servers. (All of the resources associated with the servers.)
    • Web servers. (All of the resources associated with the Web servers.)
    • Clusters. (All of the resources associated with the clusters.)

    • Applications. (All of the resources associated with the applications.)
    • Node groups. (All of the resources associated with the Node Groups.)

    • All scopes. (The default view that displays the authorization group tree.)

    • Assigned scopes. (Displays all of the scopes explicitly assigned to the current authorization group.)

  4. Click OK or Apply.

  5. To associate a user role to this new administrative authorization group, do the following:

    1. Click Administrative user roles located under the Additional Properties section. The available user roles are the following:

      Administrator

      An individual or group that uses the administrator role has the operator and configurator privileges plus additional privileges that are granted solely to the administrator role. For example, an administrator can complete the following tasks:

      • Modify the server user ID and password.

      • Set authentication and authorization mechanisms.

      • Enable or disable admin security.

      • Enable or disable Java2 security.

      • Change the LTPA password and generate keys.

      • Create, update, or delete users in the federated repositories configuration.

      • Create, update, or delete groups in the federated repositories configuration.

      An administrator cannot map users and groups to the administrator roles. .

      Configurator

      An individual or group that uses the configurator role has the monitor privilege plus the ability to change the WAS configuration. The configurator can perform all the day-to-day configuration tasks. For example, a configurator can complete the following tasks:

      • Create a resource.

      • Map an appserver.

      • Install and uninstall an application.

      • Deploy an application.

      • Assign users and groups-to-role mapping for applications.

      • Set up Java 2 security permissions for applications.

      • Customize the CSIv2, Secure Authentication Service (SAS), and SSL configurations.

        SAS is supported only between V6.0.x and previous version servers that have been federated in a V6.1 cell.

      Deployer

      Users granted this role can perform both configuration actions and runtime operations on applications..

      Operator

      An individual or group that uses the operator role has monitor privileges plus ability to change the runtime state. For example, an operator can complete the following tasks:

      • Stop and start the server.

      • Monitor the server status in the admin console.

      Monitor

      An individual or group that uses the monitor role has the least amount of privileges. A monitor can complete the following tasks:

      • View the WAS configuration.

      • View the current state of the appserver.

      Admin Security Manager

      Use the Admin Security Manager role, we can assign users and groups to the admin user roles and admin group roles. However, an administrator cannot assign users and groups to the admin user roles and admin group roles including the Admin Security Manager roles.

    2. Click Add.... The New User page is displayed.

    3. Select the appropriate role(s) from the Role(s) list box.

    4. Select a user or users by entering text in the Search string field, and then click Search.. Click the arrow to add the available user or users to the Mapped to role field. We can select multiple users and roles by clicking Select All.

    5. Click OK. we are returned to the Administrative User Roles page. The new users are displayed in the Administrative User Roles table along with their appropriate roles.

    6. Repeat steps B through E for each new user to whom you want to map a role.

  6. To associate a group to this new user role, do the following:

    1. Click Administrative group roles located under the Additional Properties section.

    2. Click Add.... The New Group page is displayed.

    3. Select the appropriate role or roles from the Role(s) list box.

    4. Select a user or users by entering text in the Search string field, and then click Search.. Click the arrow to add the available user or users to the Mapped to role field. We can select multiple users and roles by clicking Select All.

    5. Select either the Select from special subjects or Map Groups As Specified Below option.

      If we select the Select from special subjects option, we can select the EVERYONE, ALL AUTHENTICATED, or ALL AUTHENTICATED IN TRUSTED REALMS values.

      A list of user groups and roles are displayed in the Available and Mapped to role fields. Select the user groups from the Available field and then select the roles from the Mapped to role field to which you want the group or groups associated. We can select multiple groups and roles.

    6. Click OK. we are returned to the Administrative Group Roles page. The new group is displayed in the Administrative Group Roles table along with the role of the new group.

    7. Repeat steps B through E for each new group to whom you want to map a role.

  7. To create another admin authorization group, click Apply. The current admin authorization group is created. Repeat steps 2 through 6 to create another administrative authorization group.

  8. If we do not want to create another admin authorization group, click OK.

 

Related concepts


Role-based authorization
Administrative roles and naming service authorization

 

Related tasks


Edit a fine-grained admin authorization group
Authorizing access to resources