Propagating security policy of installed applications to a JACC provider using wsadmin scripting


It is possible that we have applications installed prior to enabling the Java Authorization Contract for Containers (JACC)-based authorization. We can start with default authorization and then move to an external provider-based authorization using JACC later.

Best practice: Use wsadmin to propagate information to the JACC provider independent of the application installation process, avoiding the need to reinstall applications. Also, during application installation or modification we might have had problems propagating the security policy information to the JACC provider. For example, network problems might occur, the JACC provider might not be available, and so on. For these cases, the security policy of the previously installed applications does not exist in the JACC provider to make the access decisions. One choice is to reinstall the applications involved. However, we can avoid reinstalling by using the wsadmin scripting tool. Use this tool to propagate information to the JACC provider independent of the application installation process. The tool eliminates the need for reinstalling the applications

The tool uses the SecurityAdmin MBean to propagate the policy information in the deployment descriptor of any installed application to the JACC provider. We can invoke this tool using wsadmin at the base appserver for base and deployment manager level for ND. Note that the SecurityAdmin MBean is available only when the server is running.

Use propagatePolicyToJACCProvider{-appNames appNames} to propagate the policy information in the deployment descriptor or annotations of the EAR files to the JACC provider. If the RoleConfigurationFactory and the RoleConfiguration interfaces are implemented by the JACC provider, the authorization table information in the binding file of the EAR files is also propagated to the provider. See Interfaces that support JACC for more information about these interfaces.

The appNames String contains the list of application names, delimited by a colon (:), whose policy information must be stored in the provider. If appNames is not present, the policy information of all the deployed applications is propagated to the provider. Also, be aware of the following items:

 

  1. Set the JACC provider in WAS.

    See Authorizing access to J2EE resources using TAM for more information.

  2. Restart the server.

  3. Enter the following commands:

    wsadmin>$AdminTask propagatePolicyToJACCProvider {-appNames appNames}
    


JACCUtilityCommands

 

Related concepts


Authorization providers
TAM integration as the JACC provider
JACC providers
JACC support in WAS

 

Related tasks


Authorizing access to J2EE resources using TAM
Enable an external JACC provider

 

Related


Interfaces that support JACC
Security authorization provider troubleshooting tips