WAS v8.5 > Reference > Custom properties

Security custom properties

Use this page to understand the psecurity.allowCustomHTTPMethodsredefined custom properties related to security.

To view this dmgr console page, click...

Click New to add a new custom property and its associated value.

The custom properties in this topic are set in the dmgr console through the previously listed path unless otherwise stated in the description.

We can use the custom properties page to define the following security custom properties:


com.ibm.audit.report.granularity

Specify how much auditing data is recorded for each event type. If we only need to record basic information about an event, such as who did what action to what resource, and when, setting this property to high, might improve the application server performance.

We can specify values of high, medium, or low for this property. Default is low.

Type of data that is recorded for each event type based on the setting for com.ibm.audit.report.granularity. The following table indicates the type of data that is recorded for each event type based on the setting for this property.

Event type high setting medium setting low setting
SessionContext sessionId sessionId, remoteHost sessionId, remoteHost, remoteAddr, remotePort
PropagationContext (is only reported if SAP is enabled) firstCaller (as part of the who) firstCaller, and if verbose mode is enabled, the callerList firstCaller, and if verbose mode is enabled, the callerList
RegistryContext nothing is recorded registry type registry type
ProcessContext nothing is recorded realm realm, and domain if verbose is enabled
EventContext creationTime creationTime, globalInstanceId creationTime, globalInstanceId, eventTrailId, and lastTrailId if verbose mode is enabled
DelegationContext identityName delegationType, and identityName delegationType, roleName, and identityName
AuthnContext nothing is recorded authn type authn type
ProviderContext nothing is recorded provider provider, and providerStatus
AuthnMappingContext mappedUserName mappedUserName, and mappedSecurityRealm mappedUserName, mappedSecurityRealm, and mappedSecurityDomain
AuthnTermContext terminateReason terminateReason terminateReason
AccessContext progName, action, appUserName, and resourceName progName, action, appUserName, resourceName, registryUserName, and accessDecision progName, action, appUserName, resourceName, registryUserName, accessDecision, resourceType, permissionsChecked, permissionsGranted, rolesChecked, and rolesGranted
PolicyContext nothing is recorded policyName policyName, and policyType
KeyContext keyLabel keyLabel, and keyLocation keyLabel, keyLocation, and certificateLifetime
MgmtContext nothing is recorded mgmtType, and mgmtCommand mgmtType, mgmtCommand, and targetInfoAttributes


com.ibm.CSI.disablePropagationCallerList

This property disables the caller list and does not allow the caller list to change. This property prevents the creation of multiple sessions.

This property completely disables adding a caller or host list in the propagation token. Setting this property can be a benefit when the caller or host list in the propagation token is not needed in the environment.

If the com.ibm.CSI.propagateFirstCallerOnly custom property is set to true, that setting takes precedence over the setting for this property.
Information Value
Default false


com.ibm.CSI.propagateFirstCallerOnly

This property limits the caller list to the first caller only, which means the caller list cannot change. Setting this property to true eliminates the potential for the creation of multiple session entries.

This property logs the first caller in the propagation token that stays on the thread when security attribute propagation is enabled. Without setting this property, all caller switches get logged, which affects performance.

Typically, only the first caller is of interest.

If the com.ibm.CSI.disablePropagationCallerList custom property is set to true, that setting takes precedence over the setting for this property.

Information Value
Default true

The default value of the com.ibm.CSI.propagateFirstCallerOnly security custom property is set to true. When true, the first caller in the propagation token that stays on the thread is logged when security attribute propagation is enabled. When false, all of the caller switches are logged, which can affect performance.


com.ibm.CSI.rmiInboundLoginConfig

The JAAS login configuration used for Remote Method Invocation (RMI) requests that are received inbound.

By knowing the login configuration, we can plug in a custom login module that can handle specific cases for RMI logins.

Information Value
Default system.RMI_INBOUND


com.ibm.CSI.rmiInboundMappingConfig

This property defines the system JAAS login configuration used to perform application specific principal mapping.

Information Value
Default None


com.ibm.CSI.rmiInboundMappingEnabled

This property, when set to true, enables the application specific principal mapping capability.

Information Value
Default false


com.ibm.CSI.rmiOutboundLoginConfig

The JAAS login configuration used for RMI requests sent outbound.

Primarily, this property prepares the propagated attributes in the Subject to be sent to the target server. However, we can plug in a custom login module to perform outbound mapping.

Information Value
Default system.RMI_OUTBOUND


com.ibm.CSI.rmiOutboundMappingEnabled

This property, when set to true, enables the original caller subject embedded in the WSSubjectWrapper object to be restored.

Information Value
Default false


com.ibm.CSI.supportedTargetRealms

Enable credentials that are authenticated in the current realm to be sent to any realm specified in the Trusted target realms field. The Trusted target realms field is available on the CSIv2 outbound authentication panel. Enable those realms to perform inbound mapping of the data from the current realm.

You should not send authentication information to an unknown realm. Thus, this property provides a way to specify the alternate realms are trusted. To access the CSIv2 outbound authentication panel...

  1. Click Security > Global security.

  2. Under RMI/IIOP security, click CSIv2 outbound authentication.


com.ibm.security.multiDomain.setNamingReadUnprotected

This property can be set to true if you want the CosNamingRead role to protect all naming read operations. Setting this property to true is the equivalent of assigning the CosNamingRead role the Everyone special subject. When this property is set, any assignments made to the CosNamingRead role are ignored.
Information Value
Default none


com.ibm.security.useFIPS

Specifies that Federal Information Processing Standard (FIPS) algorithms are used. The application server uses the IBMJCEFIPS cryptographic provider instead of the IBMJCE cryptographic provider.

Information Value
Default false


com.ibm.websphere.crypto.config.certexp.notify.fromAddress

This security property is used to customize the "from address" of certificate expiration notification email.

The value you assign to this property should be an internet address, such as "Notification@abc-company.com". If this property is not set, the application server uses the email fromAddress: WebSphereNotification@ibm.com.

Information Value
Default None


com.ibm.websphere.crypto.config.certexp.notify.textEncoding

This security property is used to customize the text encoding character set for certificate expiration notification email.

WAS sends notification email for certificate expiration in either US-English or the machine default character set (if non-English locale is specified). If we want a different text encoding character set for the certificate expiration notification email, we can use this property to customize the text encoding character set.

Information Value
Default None


com.ibm.websphere.lookupRegistryOnProcess

This property can be set when realm registry lookups are performed via an MBean on a remote server, and the realm is local OS security.

By default, the user registry tasks listRegistryUsers and listRegistryGroups perform lookups from the current process. In the case of Network Deployment (ND), that is the deployment manager.

When dealing with a local OS user registry, lookup should occur on the actual server where the registry resides. In an ND environment, the server could be a remote machine. To perform a lookup on the server process where the registry resides, set the com.ibm.websphere.lookupRegistryOnProcess custom property to true.

If com.ibm.websphere.lookupRegistryOnProcess is not set, or set to false, then the lookup is performed on the current process. The custom property can be set using the setAdminActiveSecuritySettings task for global security or the setAppActiveSecuritySettings task for a security domain.

com.ibm.websphere.security.allow.committed.response

This custom property specifies whether committed HTTP responses are allowed.

When the application server detects a committed HTTP response, it displays a generic 403 error message. Set to true to allow committed HTTP responses and suppress 403 error messages. In configurations that use custom login modules, the module can commit an HTTP response to display a custom error message.

Default is false.


com.ibm.websphere.security.allowAnyLogoutExitPageHost

When using application form login and logout we can provide a URL for a custom logout page. By default, the URL must point to the host to which the request is made or to its domain. If this is not done, then a generic logout page is displayed rather than a the custom logout page. To be able to point to any host, then you need to set this property in the security.xml file to a value of true. Setting this property to true might open the systems to URL redirect attacks.
Information Value
Default false


com.ibm.websphere.security.alwaysRestoreOriginalURL

Use this property to indicate whether a cookie with the value WASReqURL is honored when the custom form login processor is used.

When true, the value of WASReqURL takes precedence over the current URL, and the WASReqURL cookie is removed from subsequent requests.

When false, the value of the current URL takes precedence, and the WASReqURL cookie is not removed from subsequent requests.
Information Value
Default false


com.ibm.websphere.security.config.inherit.trustedRealms

This property is used to inherit the global trusted realm settings from the global security configuration in the domain.

Security configuration trusted inbound and outbound realms are not inherited by default. However, there are some cases where the configuration might want to use (inherit) the settings from the global security configuration in the domain.

The value of this property can be either true or false.


com.ibm.websphere.security.console.noSSLTreePortEndpoints

This property is used to improve the response time for large topology configurations.

When true the status of the of the SSL port endpoints does not display on the Manage endpoint security configurations page in the dmgr console. Displaying the status of the SSL port endpoints sometimes makes the dmgr console seem like it is no longer functioning because of a longer than expected response time.

Information Value
Default false


com.ibm.websphere.security.customLTPACookieName

This property is used to customize the name of the cookies used for LTPA tokens.

WAS v8 and later enables you to customize the name of the cookies used for LTPA and LTPA2 tokens. Custom cookie names allow you to logically separate authentication between Single Sign-On (SSO) domains and to enable customized authentication to a particular environment.

To take advantage of this functionality, a custom property must be set. For LTPA tokens, the custom property com.ibm.websphere.security.customLTPACookieName can be set to any valid string (special characters and spaces are not permitted) for the LTPA token cookie, and com.ibm.websphere.security.customSSOCookieName for the LTPA2 (SSO) token cookie. Each property is case-sensitive.

The value for this property is a valid string.

Before setting this custom property, consider the following:

To activate this property, a restart of WAS is necessary.


com.ibm.websphere.security.customSSOCookieName

This property is used to customize the name of the cookies used for LTPA v2 (LTPA2) tokens.

WAS v8 and later enables you to customize the name of the cookies used for LTPA and LTPA2 tokens. Custom cookie names allow you to logically separate authentication between Single Sign-On (SSO) domains and to enable customized authentication to a particular environment.

To take advantage of this functionality, a custom property must be set. For LTPA tokens, the custom property com.ibm.websphere.security.customLTPACookieName can be set to any valid string (special characters and spaces are not permitted) for the LTPA token cookie, and com.ibm.websphere.security.customSSOCookieName for the LTPA2 (SSO) token cookie. Each property is case-sensitive.

The value for this property is a valid string.

Before setting this custom property, consider the following:

To activate this property, a restart of WAS is necessary.


com.ibm.websphere.security.displayRealm

This property specifies whether the HTTP basic authentication login window displays the realm name not defined in the application web.xml file.

If the realm name is defined in the application web.xml file, this property is ignored.

If the realm name is not defined in web.xml, one of the following occurs:

If true, and the user registry's realm name contains sensitive information, it is displayed to the user. For example, if standalone LDAP configuration is used, the LDAP server hostname and port are displayed. For LocalOS, the hostname is displayed.

Information Value
Default false
Type string


com.ibm.websphere.security.disableGetTokenFromMBean

Disable the outbound SOAP call to retrieve the subject from the originating server when Single Sign-On is enabled.

Typically, when Single Sign-On is enabled, and an inbound request needs to be authenticated, the receiving server attempts to retrieve the authentication from the originating server. The connection between the sending and receiving servers never times out during this callback process.

When true, the receiving server does not attempt to authenticate the inbound request.
Information Value
Default false


com.ibm.websphere.security.enableAuditForIsCallerInRole

Use this property to enable audit for the isCallerInRole method call.

If we set this property to false, it disables auditing for the invocation of isCallerInRole. In z/OS , SMF records are not issued for the invocation.

Information Value
Default true


com.ibm.websphere.security.goToLoginPageWhenTAIUserNotFound

Use this property when the user provided by a TAI is not found in the user registry so that a login page is displayed instead of an error page.

When the user provided by a TAI is not found in the user registry, WAS displays an error page. To adjust this behavior, set this property to true. Then the login page is displayed. Default is false.and the normal behavior for WAS is to display an error page.

When true, the login page is displayed.
Information Value
Default false


com.ibm.websphere.security.InvokeTAIbeforeSSO

Default invocation order of Trust Association Interceptors (TAIs) in relation to Single Sign On (SSO) user authentication can be changed using this property. The default order is to invoke Trust Association Interceptors after SSO. This property is used to change the default order of TAI invocation with SSO. The property value is a comma (,) separated list of TAI class names to be invoked before SSO.

Information Value
Default com.ibm.ws.security.spnego.TrustAssociationInterceptorImpl
Type string


com.ibm.websphere.security.JAASAuthData.addNodeNameSecDomain

By default, when JAAS authentication data entries are created at the domain security level, the alias name for the entry will be in the format aliasName. We can enable the addition of the node name to the alias name to create the alias name, in the format nodeName/aliasName, for the entry, by setting the following property at the domain security level.

We can set com.ibm.websphere.security.JAASAuthData.addNodeNameSecDomain=true at the global security level, to enable the addition of the node name to the alias name of JAAS authentication data entries for all security domains.
Information Value
Default false


com.ibm.websphere.security.JAASAuthData.removeNodeNameGlobal

By default, when JAAS authentication data entries are created at the global security level, the alias name for the entry is in the format nodeName/aliasName. We can disable the addition of the node name to the alias name for the entry, by setting a value of true for this property at the global security level.
Information Value
Default false


com.ibm.websphere.security.krb.canonical_host

This custom property specifies whether the application server uses the canonical form of the URL/HTTP host name in authenticating a client. This property can be used for both SPNEGO TAI and SPNEGO Web.

If we set this custom property to false, a Kerberos ticket can contain a host name that differs from the HTTP host name header, and the application server might issue the following message:

If you set this custom property to true, we can avoid this error message and allow the application server to authenticate using the canonical form of the URL/HTTP host name.

Information Value
Default true


com.ibm.websphere.security.ldap.logicRealm

This custom property enables you to change the name of the realm placed in the token.

This custom property enables you to configure each cell to have its own LDAP host for interoperability and backward compatibility. Also, it provides flexibility for adding or removing the LDAP host dynamically. If we are migrating a previous installation, this modified realm name does not take effect until administrative security is re-enabled. To be compatible with a previous release that does not support the logic realm, the name must be the same name used by the previous installation. You must use the LDAP host name, including a trailing colon and port number.
Information Value
Type String

This property must be set as the custom property of a stand-alone LDAP registry. To set this custom property, in the dmgr console:

  1. Click Security > Global security.

  2. Under User account repository, expand the Available realm definitions list, and select Standalone LDAP registry, and then click Configure.

  3. Under Custom properties, click New , and then enter com.ibm.websphere.security.ldap.logicRealm in the Name field, and the new name of the realm placed in the token in the Value field.

  4. Select this custom property and then click Apply or OK.


com.ibm.websphere.security.ldapSSLConnectionTimeout

Use this property, when SSL is enabled on the LDAP server, to specify, in milliseconds, the maximum amount of time the Java Virtual Machine (JVM) waits for a socket connection before issuing a timeout.

If one or more standalone LDAP servers are offline when a server process starts, and LDAP-SSL is enabled, there might be a delay of up to three minutes in the startup procedure, even if we specify a value for the com.sun.jndi.ldap.connect.timeout custom property. When LDAP-SSL is enabled, any value specified for the com.sun.jndi.ldap.connect.timeout property is ignored.

When a value is specified for this property, the JVM tries to use this connection timeout value when attempting to complete a socket connection, instead of trying to establish a directory context. When no value is specified for this property, the JVM tries to establish a directory context.

There is no default value for this property.


com.ibm.websphere.security.logoutExitPageDomainList

When using application form login and logout, we can provide a URL for a custom logout page. By default, the URL must point to the host to which the request is made or to its domain. If this is not done, then a generic logout page is displayed rather than a the custom logout page. If we need to point to a different host, then we can populate this property in the security.xml file with a pipe (|) separated list of URLs allowed for the logout page.
Information Value
Default none


com.ibm.websphere.security.performTAIForUnprotectedURI

Specify TAI invocation behavior when Use available authentication data when an unprotected URI is accessed is selected in the dmgr console.
Information Value
Default false

In previous versions of WAS, the default value of this custom property was true. For WAS v8.0.0.1, the default value is now false.


com.ibm.websphere.security.recoverContextWithNewKeys

This property affects behavior when deserializing a security context that was previously saved as part of asynchronous security processing for Web Services or Asynch Beans.

When true, the security context can be de-serialized even when the LTPA keys have changed since the context was serialized out. This property should be set to true if the security context deserialization fails with a WSSecurityException containing this message: Validation of LTPA token failed due to invalid keys or token type.

Information Value
Default false


com.ibm.websphere.security.rsaCertificateAliasCache

This property is used to control the size of the alias cache.

Default is 5000 and can be increased for larger deployments. We do not need to add this property unless your Job Manager topology exceeds 5000 registered nodes.

The value must be entered into the range of 1 - N, where N is a valid positive integer that is greater than or equal to the number of nodes registered with the Job Manager.

Information Value
Default 5000

com.ibm.websphere.security.setContextRootForFormLogin

Set a unique path name whenever a WASReqURL cookie is generated.

A browser can hold multiple WASReqURL cookies as long as each cookie has a unique path name. When true, a unique path name is set whenever a WASReqURL cookie is generated. Therefore, if we have more than one application that is using Form Login as a login method installed on the same application server. you should specify this property as one of your security settings for that application server, and set the property to true.

Information Value
Default false


com.ibm.websphere.security.spnego.useBuiltInMappingToSAF

This property is used to ensure that a mapping from a Kerberos principal to a RACF ID is performed for SPNEGO web authentication.

If we do not add this property to your security settings, and set it to true, a mapping from a Kerberos principal to a RACF ID is not performed for SPNEGO web authentication.

If Kerberos authentication is used in combination with SPNEGO Web authentication, configuring a built-in mapping for either Kerberos or SPNEGO results in a mapping being done for both.
Information Value
Default false


com.ibm.websphere.security.strictCredentialExpirationCheck

Whether credential expiration check occurs for a local EJB call.

Typically, when an EJB invokes another EJB located in a local machine, a direct method invocation occurs even if the credentials of the original invoker expire before the local EJB call occurs.

If true, a credential expiration check occurs on a local EJB call before the EJB is invoked on the local machine. If the credentials have expired, the EJB call is rejected.

If false, a credential expiration check does not occur for a local EJB call.
Information Value
Default false


com.ibm.websphere.security.tokenFromMBeanSoapTimeout

Specify the amount of time the receiving server waits for an outbound SOAP call to retrieve the proper authentication from the originating server when Single Sign-On is enabled.

There is no default value for this property. If no value is specified, the global SOAP timeout value is used as the timeout value for the SOAP connection.


com.ibm.websphere.security.useLoggedSecurityName

This is a custom property of user registries. This propertyalters the behavior of creating WSCredential.

A setting of false indicates the security name returned by a user registry is always used to construct WSCredential.

A setting of true indicates that either a security name supplied by login module is used or a display name that was supplied by a user registry is used. This setting is compatible with WAS v6.1 and earlier.

Information Value
Default false


com.ibm.websphere.security.util.csiv2SessionCacheIdleTime

Time in milliseconds that a CSIv2 session can remain idle before being deleted. The session is deleted if the com.ibm.websphere.security.util.csiv2SessionCacheLimitEnabled custom property is set to true, and the maximum size of the CSIv2 session cache is exceeded.

This custom property only applies if you enable stateful sessions, set the com.ibm.websphere.security.util.csiv2SessionCacheLimitEnabled custom property to true, and set a value for the com.ibm.websphere.security.util.csiv2SessionCacheMaxSize custom property. Consider decreasing the value for this custom property if the environment uses Kerberos authentication and has a short clock skew for the configured key distribution center (KDC). In this scenario, a short clock skew is defined as less than 20 minutes.

Do not set a value for this function through the custom property panel because the value is not validated against the expected range of values. Instead, set the value on the CSIv2 outbound communications panel, which is available in the dmgr console by completing the following steps:

  1. Expand the Security section and click Global security.

  2. Expand the RMI/IIOP security section and click CSIv2 outbound communications

We can set the value in the Idle session timeout field. However, when we specify this value on the CSIv2 outbound communications panel, the dmgr console value is expected in seconds and not milliseconds.

The range of values for this custom property is 60,000 to 86,400,000 milliseconds. By default, the value is not set.


com.ibm.websphere.security.util.csiv2SessionCacheLimitEnabled

This custom property specifies whether to limit the size of the CSIv2 session cache.

When you set this custom property value to true, set values for the com.ibm.websphere.security.util.csiv2SessionCacheIdleTime and com.ibm.websphere.security.util.csiv2SessionCacheMaxSize custom properties. When you set this custom property to false, the CSIv2 session cache is not limited. The default is false.

Consider setting this custom property to true if the environment uses Kerberos authentication and has a small clock skew for the configured key distribution center (KDC). In this scenario, a small clock skew is defined as less than 20 minutes. A small clock skew can result in a larger number of rejected CSIv2 sessions. However, with a smaller value for the com.ibm.websphere.security.util.csiv2SessionCacheIdleTime custom property, the application server can clean out these rejected sessions more frequently and potentially reduce the resource shortages.

This custom property only applies if you enable the stateful sessions.

Although we can enable the CSIv2 session cache limit option as a custom property, it is advisable that you enable the option on the CSIv2 outbound communications panel, which is available in the dmgr console by completing the following steps:

  1. Expand the Security section and click Global security.

  2. Expand the RMI/IIOP security section and click CSIv2 outbound communications

We can enable the Enable CSIv2 session cache limit option. Default is false.


com.ibm.websphere.security.util.csiv2SessionCacheMaxSize

The maximum size of the session cache after which expired sessions are deleted from the cache.

Expired sessions are defined as sessions that are idle longer than the time specified by the com.ibm.websphere.security.util.csiv2SessionCacheIdleTime custom property. When we use the com.ibm.websphere.security.util.csiv2SessionCacheMaxSize custom property, consider setting its value between 100 and 1000 entries.

Consider specifying a value for this custom property if the environment uses Kerberos authentication and has a small clock skew for the configured key distribution center (KDC). In this scenario, a small clock skew is defined as less than 20 minutes. Consider increasing the value of this custom property if the small cache size causes the garbage collection to run so frequently that it impacts the performance of the application server.

This custom property only applies if you enable stateful sessions, set the com.ibm.websphere.security.util.csiv2SessionCacheLimitEnabled custom property to true, and set a value for the com.ibm.websphere.security.util.csiv2SessionCacheIdleTime custom property.

Do not set a value for this function through the custom property panel because the value is not validated against the expected range of values. Instead, set the value on the CSIv2 outbound communications panel, which is available in the dmgr console by completing the following steps:

  1. Expand the Security section and click Global security.

  2. Expand the RMI/IIOP security section and click CSIv2 outbound communications

We can set the value in the Maximum cache size field.

The range of values for this custom property is 100 to 1000 entries. By default, the value is not set.


com.ibm.websphere.security.util.postParamMaxCookieSize

Set a size limit for WASPostParam cookies being generated by the security code.

When the Use available authentication data when an unprotected URI is accessed option is enabled and Form-based authentication is being used this, a WASPOSTParam is generated during the authentication procedure of the HTTP POST request even if the target URL is unprotected. A WASPOSTParam cookie is a temporary cookie used to store HTTP POST parameters. This results in the Web client being sent the unnecessary cookie with an HTTP response. This might cause unexpected behavior when the size of the cookie is larger than the browser limit. To avoid this behavior, com.ibm.websphere.security.util.postParamMaxCookieSize can be set to cause the security code to stop generating the cookie if the maximum size specified by this property is reached. The value of this property must be a positive integer and represents the maximum size of the cookie in bytes.
Information Value
Default none


com.ibm.websphere.security.web.removeCacheOnFormLogout

Specify whether a cached object is removed from the authentication cache and the dynamic cache when a form logout occurs. A form logout is a mechanism that enables a user to log out of an application without having to close all Web-browser sessions.

When false, corresponding cached entries are not removed from the authentication cache and the dynamic cache when a form logout occurs. As a result, if the same user logs back in after a form logout, the cached object is reused.

Because the original cached object was created during a previous login session, the expiration time for the object might be shorter than the configured timeout value. gotcha

When true, the cached entries are removed from the authentication cache and the dynamic cache when a form logout occurs.

Default is true.

com.ibm.websphere.security.web.setLTPATokenCookieToUnprotectedURI

Cookie generation behavior for LTPA tokens for inbound web resource requests.

When this property is true, the application server generates and sets an LTPAToken cookie for all successfully authenticated resource requests, regardless of whether the request is for protected or unprotected web resources. This behavior is different from the behavior in WAS v6.1 and can cause some applications developed for v6.1 not to work on later versions.

Set to false to generate an LTPAToken cookie only for protected web resources. This behavior is compatible with WAS v6.1.

Default is true.


com.ibm.websphere.security.webAlwaysLogin

This property specifies whether the login() method will throw an exception if an identity had already been authenticated. We can overwrite this behavior by setting this property to true.

Information Value
Default false
Type string

The login() method always uses the user ID and password to authenticate to the WebSphere application server irrespective of the presence of the SSO information in the HttpServletRequest.


com.ibm.ws.security.addHttpOnlyAttributeToCookies

This custom property enables you to set the HTTPOnly attribute for SSO cookies.

We can use the com.ibm.ws.security.addHttpOnlyAttributeToCookies custom property to protect cookies containing sensitive values. When you set this custom property value to true, the application server sets the HTTPOnly attribute for SSO cookies whose values are set by the server. The HTTPOnly attribute enables the protection of sensitive values in cookies.

Also, a true value enables the application server to properly recognize, accept, and process inbound cookies with HTTPOnly attributes and inhibit any cross-site scripting from accessing sensitive cookie information.

A common security problem, which impacts web servers, is cross-site scripting. Cross-site scripting is a server-side vulnerability that is often created when user input is rendered as HTML. Cross-site scripting attacks can expose sensitive information about the users of the website. Most modern web browsers honor the HTTPOnly attribute to prevent this attack. A cookie with this attribute is called an HTTPOnly cookie. Information that exists in an HTTPOnly cookie is less likely to be disclosed to a hacker or a malicious website. For more information about the HTTPOnly attribute, see the Open Web Application Security Project (OWASP) website.

When we use this custom property, HTTPOnly attribute is not added to every cookie that passes through the application server. Also, the attribute is not added to other non-secure cookies created by the application server. A list of non-HTTPOnly cookies includes:

We can set or remove this custom property from the Single sign-on panel in the dmgr console by doing the following:

  1. Click Security > Global security.

  2. Under Authentication, click Web and SIP security > Single sign-on (SSO).

Information Value
Default true
Type Boolean


com.ibm.ws.security.allowNonAdminToSecurityXML

This property specifies whether the non-admin security roles are allowed to modify the security.xml file. Setting this property to true gives non-admin security roles the ability to modify the security.xml file. In v6.1 and later, by default, non-admin security roles have the ability to modify the security.xml file.

Information Value
Default false
Type Boolean


com.ibm.websphere.security.auth.setDRSBootstrap

Whether the data replication service (DRS) enables the DRSbootstrap function.

In high volume environments, dynamic cache data replication might increase the amount of time that it takes a server to start. If we experience slow server startups because of data replication, add this property to your server security settings and set it to false. When is property is set to false, the data replication service disables the DRSbootstrap function.

True is the default setting for this property.


com.ibm.ws.security.config.SupportORBConfig

Whether to check or not check the object request broker (ORB) for properties. This property needs to be set as a system property. You set this property to true or yes so that the ORB is checked for properties. For any other setting, the ORB is completely ignored.

The property is to be used when a pluggable application client connects to the WAS. Specifically, this property is used whenever a hashmap containing security properties is passed in a hashmap on a new InitialContext(env) call.


com.ibm.ws.security.createTokenSubjectForAsynchLogin

In this release, the actual LTPA token data is not available from a WSCredential.getCredentialToken() call when called from an asynchronous bean. For an existing configuration, we can add the com.ibm.ws.security.createTokenSubjectForAsynchLogin custom property and a true value to allow the LTPAToken to be forwarded to asynchronous beans. Allow portlets to successfully perform LTPA token forwarding. This custom property is case sensitive. Restart the application server after you add this custom property.

This custom property applies only to system conditions where Server A makes EJB calls from asynchronous beans to Server B. This property does not apply for JAAS login situations.

Information Value
Default not applicable


com.ibm.ws.security.defaultLoginConfig

This property is the JAAS login configuration used for logins that do not fall under the WEB_INBOUND, RMI_OUTBOUND, or RMI_INBOUND login configuration categories.

Internal authentication and protocols that do not have specific JAAS plug points call the system login configuration referenced by com.ibm.ws.security.defaultLoginConfig configuration.

Information Value
Default system.DEFAULT


com.ibm.ws.security.failSSODuringCushion

Use the com.ibm.ws.security.failSSODuringCushion custom property to update custom JAAS Subject data for the LTPA token.

When we do not set this custom property to true, new JAAS Subjects might not contain the custom JAAS Subject data.

Default is true.


com.ibm.ws.security.ltpa.forceSoftwareJCEProviderForLTPA

Use the com.ibm.ws.security.ltpa.forceSoftwareJCEProviderForLTPA custom property to correct an "invalid library name" error when we attempt to use a PKCS11 type keystore with a Java client.

The ssl.client.props file points to a configuration file, which in turn, points to the library name for the cryptographic device. The code for the Java client looks for a keystore type for the correct provider name. Without this custom property, the keystore type constant for PKCS11 is not specified correctly as it references the IBMPKCS11Impl provider instead. Also, the LTPA code uses the provider list to determine the Java Cryptography Extension (JCE) provider. This approach causes a problem when SSL acceleration is attempted because the IBMPKCS11Impl provider needs to be listed before the IBMJCE provider within the java.security file.

This custom property corrects both issues so that SSL and other cryptographic mechanisms can use hardware acceleration.

LTPA cannot use hardware acceleration because the software keys for LTPA do not implement the java.security.interfaces.RSAPrivateCrtKey interface, which is required by many accelerator cards.

Set true when we want to use a PKCS11 type keystore with a Java client.

Information Value
Default false


com.ibm.ws.security.ltpa.useCRT

Use this property to improve the CPU utilization during the sign() operation that occurs when a new LTPA2 (SSO) token is created. When true, the product implements the Chinese Remainder Theorem (CRT) algorithm when signing the new token. This property has no effect on the old style LTPA token.
Information Value
Default false


com.ibm.ws.security.ssoInteropModeEnabled

This property determines whether to send LtpaToken2 and LtpaToken cookies in the response to a web request (interoperable).

When this property value is false, the application server just sends the new LtpaToken2 cookie which is stronger, but not interoperable with some other products and WAS releases prior to v5.1.1. In most cases, the old LtpaToken cookie is not needed and we can set this property to false.

Information Value
Default true


com.ibm.ws.security.unprotectedUserRegistryMethods

Method names on the UserRegistry interface, such as getRealm, getUsers, and isValidUser, that we do not want protected from remote access. If we specify multiple method names, separate the names with either a space, a comma, a semi-colon, and a separator bar. See your implementation of the UserRegistry interface file for a complete list of valid method names.

If we specify an * as the value for this property, all methods are unprotected from remote access. If a value is not specified for this property, all methods are protected from remote access.

If an attempt is made to remotely access a protected UserRegistry interface method, the remote process receives a CORBA NO_PERMISSION exception with minor code 49421098.

There is no default value for this property.


com.ibm.ws.security.webChallengeIfCustomSubjectNotFound

This property determines the behavior of a single sign-on LtpaToken2 login.

If the token contains a custom cache key and the custom Subject cannot be found, then the token is used to log in directly as the custom information needs to be regathered if this property value is set to true. A challenge also occurs so the user is required to login again. When this property value is set to false and the custom Subject is not found, the LtpaToken2 is used to login and gather all of the registry attributes. However, the token might not obtain any of the special attributes that downstream applications might expect.

Information Value
Default true


com.ibm.ws.security.webInboundLoginConfig

This property is the JAAS login configuration used for web requests that are received inbound.

By knowing the login configuration, we can plug in a custom login module that can handle specific cases for web logins.

Information Value
Default system.WEB_INBOUND


com.ibm.ws.security.webInboundPropagationEnabled

This property determines whether a received LtpaToken2 cookie should search for the propagated attributes locally before searching the original login server specified in the token. After the propagated attributes are received, the Subject is regenerated and the custom attributes are preserved.

Information Value
Default true


com.ibm.wsspi.security.cred.refreshGroups

This property affects behavior when deserializing a security context that was previously saved as part of asynchronous security processing for Web Services or Asynch Beans.

When true, the user registry is accessed to get the groups associated with the user. If the user still exists in the registry, the groups from the user registry are used instead of the groups that were serialized in the security context. If the user is not found in the user registry, and the verifyUser property is set to false, the groups from the security context are used.

Information Value
Default false


com.ibm.wsspi.security.cred.verifyUser

This property affects behavior when deserializing a security context that was previously saved as part of asynchronous security processing for Web Services or Asynch Beans.

When true, the user registry is accessed to verify the user from the security context still exists. If it does not exist, a WSLoginFailedException is thrown.

Information Value
Default false


com.ibm.wsspi.security.ltpa.tokenFactory

The LTPA (LTPA) token factories that can be used to validate the LTPA tokens.

Validation occurs in the order in which the token factories are specified because LTPA tokens do not have object identifiers (OIDs) that specify the token type. The Application Server validates the tokens using each token factory until validation is successful. The order specified for this property is the most likely order of the received tokens. Specify multiple token factories by separating them with a pipe (|) without spaces before or following the pipe.

Information Value
Default com.ibm.ws.security.ltpa.LTPATokenFactory | com.ibm.ws.security.ltpa.LTPAToken2Factory | com.ibm.ws.security.ltpa.AuthzPropTokenFactory


com.ibm.wsspi.security.token.authenticationTokenFactory

Implementation used for an authentication token in the attribute propagation framework. The property provides an old LTPA token implementation for use as the authentication token.

Information Value
Default com.ibm.ws.security.ltpa.LTPATokenFactory


com.ibm.wsspi.security.token.authorizationTokenFactory

Implementation used for an authorization token. This token factory encodes the authorization information.

Information Value
Default com.ibm.ws.security.ltpa.AuthzPropTokenFactory


com.ibm.wsspi.security.token.propagationTokenFactory

Implementation used for a propagation token. This token factory encodes the propagation token information.

The propagation token is on the thread of execution and is not associated with any specific user Subjects. The token follows the invocation downstream flow wherever the process leads.

Information Value
Default com.ibm.ws.security.ltpa.AuthzPropTokenFactory


com.ibm.wsspi.security.token.singleSignonTokenFactory

Implementation used for a Single Sign-on (SSO) token. This implementation is the cookie set when propagation is enabled regardless of the state of the com.ibm.ws.security.ssoInteropModeEnabled property.

By default, this implementation is the LtpaToken2 cookie.

Information Value
Default com.ibm.ws.security.ltpa.LTPAToken2Factory


com.ibm.wsspi.wssecurity.kerberos.failAuthForExpiredKerberosToken

Specify how you want the system to handle authentication for a request after the Kerberos token for the request expires.

When true, if a Kerberos token cannot be refreshed after it expires, authentication for the request fails.

When false, authentication for the request does not fail even if the token has expired.

The default value for this property is false.


security.allowCustomHTTPMethods

Permit custom HTTP methods. The custom HTTP methods are other than the standard HTTP methods, which are: DELETE, GET, HEAD, OPTIONS, POST, PUT or TRACE.

When false, which is the default, if a combination of a URI pattern and a custom HTTP method are not listed in the security-constraint element, a search of the security constraint is performed using an URI pattern only. If there is a match, the value of the <auth-constraints> element is enforced. This behavior minimizes a potential security exposure.

When true, the custom HTTP methods are treated as the standard HTTP methods. An authorization decision is made by both the URI pattern and the HTTP method. To properly protect a target URI, verify the proper HTTP methods are listed in the <web-resource-collection> element.


security.enablePluggableAuthentication

This property is no longer used. Instead, use WEB_INBOUND login configuration.

To modify the WEB_INBOUND login configuration:

  1. Click Security > Global security.

  2. Under Java Authentication and Authorization Service, click System logins.

Information Value
Default true


security.useDefaultPolicyWhenJ2SDisabled

The NullDynamicPolicy.getPermissions method provides an option to delegate a default policy class to construct a Permissions object when this property is set to true. When false, an empty Permissions object is returned.

Information Value
Default false


Related

Enable security for the realm
Use an alias host name for SPNEGO TAI or SPENGO web authentication using the dmgr console (deprecated)
Common Secure Interoperability v2 outbound communications settings
System login configuration entry settings for Java Authentication and Authorization Service


+

Search Tips   |   Advanced Search