Manager JACC provider settings

To configure the Java Authorization Contract for Container (JACC) provider for TAM.

When a third-party authorization such as TAM or SAF for z/OS is used, the information in the admin console panel might not represent the data in the provider. Also, any changes to the panel might not be reflected in the provider automatically. Follow the provider's instructions to propagate any changes made to the provider.

To view the JACC provider settings for TAM...

  1. Click...

      Security | Global security

  2. Under Authentication, click External authorization providers.

  3. Under Authorization provider, click External JACC provider.

  4. Click Configure to configure the properties for Tivoli Access Manager.

Enable embedded TAM

Enables or disables the embedded TAM client configuration.

Default: Disabled
Range: Enabled or Disabled

To disable TAM as the JACC provider, clear this option and also select Default authorization.

Ignore errors during embedded TAM disablement

When selected, errors are ignored during disablement of the embedded TAM client.

This option is applicable only when re-configuring an embedded TAM client or disabling an embedded TAM.

Default: Disabled
Range: Enabled or Disabled

Client listening port set

Enter the ports that are used as listening ports by TAM clients.

The appserver needs to listen on a TCP/IP port for authorization database updates from the policy server. More than one process can run on a particular node and machine, so a list of ports is required for use by the processes. If we specify a range of ports, separate the lower and higher values by a colon (:). Single ports and port ranges are specified on separate lines. An example list might look like the following example:

7999
8900:8999

Each of the servants might need to open up a listener port.

Policy server

Enter the name, fully-qualified domain name, or IP address of the TAM policy server and the connection port.

Use the form policy_server:port. The policy server communication port was set at the time of the TAM configuration. The default is 7135.

Authorization servers

Enter the name, fully-qualified domain name, or IP address of the TAM authorization server. Use the form, auth_server:port:priority.

The authorization server communication port is set at the time of TAM configuration. The default is 7136. We can specify more than one authorization server by entering each server on a new line. Set more than one authorization server provides for failover. The priority value is the order of authorization server use. For example:

auth_server1.mycompany.com:7136:1 auth_server2.mycompany.com:7137:2
A priority of 1 is still required when configuring a single authorization server.

Administrator user name

Enter the TAM administration user ID, as created at the time of TAM configuration. This ID is usually, sec_master.

Administrator user password

Enter the TAM administration password for the user ID that is entered in the Administrator user name field.

User registry distinguished name suffix

Enter the distinguished name suffix for the user registry to share between TAM and the appserver. For example: o=organization,c=country

Security domain

Enter the name of the TAM security domain used to store appserver users and groups.

Specification of the TAM domain is required because more than one security domain can be created in TAM with its own administrative user. Users, groups, and other objects are created within a specific domain and are not permitted to access resources in another domain. If a security domain is not established at the time of TAM configuration, leave the value as Default.

Default: Default

Administrator user distinguished name

Enter the fully distinguished name of the security administrator ID for the appserver. For example, cn=wasadmin,o=organization,c=country





 

Related tasks


Set the JACC provider for TAM