Administrative roles

Administrative roles

The Java EE role-based authorization concept is extended to protect the WebSphere Application Server administrative subsystem.

A number of administrative roles are defined to provide degrees of authority needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when administrative security is enabled.

Administrative roles

Role Description
Monitor Least amount of privilege.

View the WAS configuration.
View the current state of the Application Server.

Configurator Monitor privilege plus the ability to change the WAS configuration.

Create a resource.
Map an application server.
Install and uninstall an application.
Deploy an application.
Assign users and groups-to-role mapping for applications.
Set up Java 2 security permissions for applications.

Operator Monitor privileges plus ability to change the runtime state. For example...

Stop and start the server.
Monitor the server status in the administrative console.

Administrator Operator and configurator privileges, plus additional privileges granted solely to the administrator role.

Modify the server user ID and password.
Configure authentication and authorization mechanisms.
Enable or disable administrative security.
Enable or disable Java 2 security.
Change the LTPA password and generate keys.
Create, update, or delete users in the federated repositories configuration.
Create, update, or delete groups in the federated repositories configuration.
Customize the CSIv2, SAS, and SSL configurations.

An administrator cannot map users and groups to the administrator roles without also having the Admin Security Manager role.
iscadmins This role is only available for administrative console users, not for wsadmin users. Users granted this role have administrator privileges for managing users and groups in the federated repositories.

Create, update, or delete users in the federated repositories configuration.
Create, update, or delete groups in the federated repositories configuration.

Deployer Complete configuration and runtime operations on applications.
Admin Security Manager Assign users and groups to administrative user and group roles. An administrator cannot assign users and groups to administrative user and group roles, including the Admin Security Manager role.
For information on how to assign federated repository management rights to users who are not assigned the WAS Administrator role, see the topic, Mapping users and groups to roles for assigning federated repository management rights in the topic, Providing security.

Auditor

Enable and disable the security auditing subsystem.
Select the event factory implementation to be used with the event factory plug-in point.
Select and configure the service provider, or emitter, or both to be used with the service provider plug-in point.
Set the audit policy that describes the behavior of the application server in the event of an error with the security auditing subsystem.
Define which security events are to be audited.
The auditor role includes the monitor role. This allows the auditor to view but not change the rest of the security configuration.

The server ID specified and the administrative ID, if specified, when enabling administrative security is automatically mapped to the administrator role.

Users and groups can be added or removed from administrative roles using the WAS administrative console by a user given the appropriate authority. The Primary administrative user name must be used to log on to the administrative console to change the administrative user and group roles other than the auditor role. Only a user with the auditor role can change the auditor user and group roles. When security auditing is initially enabled, the Primary administrative user is also given the auditor role, and can manage all of the administrative user and group roles including the those in the auditor role. A best practice is to map a group or groups, rather than specific users, to administrative roles because it is more flexible and easier to administer.

In addition to mapping user or groups, a special-subject can also be mapped to the administrative roles. A special-subject subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the administrative role ensures that the user making the request is at least authenticated. The Everyone special subject means anyone, authenticated or not, can perform the action, as if security was not enabled.

Deployer role

Complete all of the configuration and runtime operations on an application. A deployer role can be subsets of both configurator and operator roles. However, a user granted a deployer role cannot configure or operate any other resources, such as a server, node.

When fine-grained administrative security is used, only a user granted a deployer role to an application can configure and operate that application.

Cell-level configurators can configure applications. Cell-level operators can also operate (start and stop) applications. However, a user granted a deployer role at cell level can also complete configuration and operation on all applications.

Deployer role capabilities

Operation Required Roles ( Any one)
Install application Cell-configurator, target-deployer
Uninstall application Cell-configurator, application-deployer, target-deployer
List application Cell-monitor, application-monitor
Edit, update and redeploy application Cell-configurator, application-deployer
Export application Cell-monitor, application-monitor
Start or stop application Cell-operator, application-deployer

Where:

Cell-configurator

Configurator role at cell level.

Application-deployer

Deployer role for the application being used managed.

Target-deployer

Deployer role for all servers or clusters for which an application is targeted. If we have a target-deployer role, we can install a new application on the target. However, to edit or update the installed application, we must be included in the authorization group of the installed application-deployer.
The target-deployer cannot explicitly start or stop a new application. However, when a target-deployer starts a server on a target, all of the applications that have their auto-start attribute set to yes are started when the server starts.

IBM recommends that the application-deployer set this attribute to true if the application-deployer does not want the application to be started by the target-deployer.

Admin Security Manager role

The Admin Security Manager role separates administrative security administration from other application administration.

By default, serverId and adminID, if specified, are assigned to this role in the cell level authorization table. This role implies a monitor role. However, an administrator role does not imply the Admin Security Manager role.

When fine-grained admin security is used, only a user granted this role at cell level can manage administrative authorization groups. However, a user granted this role for each administrative authorization group can map users to administrative roles for those groups. The following list summarizes the capabilities of the Admin Security Manager role at different levels, such as the cell and administrative authorization group levels.
For information on how to assign federated repository management rights to users who are not assigned the WAS Administrator role, see the topic, Mapping users and groups to roles for assigning federated repository management rights in the topic, Providing security.

Admin Security Manager role capabilities

Action Role
Map users to administrative roles for cell level Only the Admin Security Manager of the cell
Map users to administrative roles for an authorization group Only the Admin Security Manager of that authorization group or the Admin Security Manager of the cell
Manage authorization groups, create, delete, add resource to an authorization group, or remove resource from an authorization group or list Only the Admin Security Manager of the cell

Auditor role

The auditor role separates security auditing administration from administrative security and other application administration.

The auditor role was added to allow distinct separation of the authority of an auditor from the authority of the administrator. The auditor role can be granted to administrators to combine their authority. When security is first enabled, the auditor role is assigned to the primary administrator. If in your situation the separation of authority is required, administrators can remove the auditor role from themselves and assign the auditor role to other users.

A fine grained security for the auditor role is not implemented, which results in the auditor role requiring the monitor role. This process allows the auditor to read but not modify the panels managed by the administrator. The auditor has full authority to read and modify the panels associated with the security auditing subsystem. The administrator will have the monitor role for those panels, however, the administrator cannot modify those panels.

Related:
Administrative roles and naming service authorization
Assign users and groups to roles
Assign users to naming roles
Authorization technology

Role	Description
Monitor	Least amount of privilege. View the WAS configuration. View the current state of the Application Server.
Configurator	Monitor privilege plus the ability to change the WAS configuration. Create a resource. Map an application server. Install and uninstall an application. Deploy an application. Assign users and groups-to-role mapping for applications. Set up Java 2 security permissions for applications.
Operator	Monitor privileges plus ability to change the runtime state. For example... Stop and start the server. Monitor the server status in the administrative console.
Administrator	Operator and configurator privileges, plus additional privileges granted solely to the administrator role. Modify the server user ID and password. Configure authentication and authorization mechanisms. Enable or disable administrative security. Enable or disable Java 2 security. Change the LTPA password and generate keys. Create, update, or delete users in the federated repositories configuration. Create, update, or delete groups in the federated repositories configuration. Customize the CSIv2, SAS, and SSL configurations. An administrator cannot map users and groups to the administrator roles without also having the Admin Security Manager role.
iscadmins	This role is only available for administrative console users, not for wsadmin users. Users granted this role have administrator privileges for managing users and groups in the federated repositories. Create, update, or delete users in the federated repositories configuration. Create, update, or delete groups in the federated repositories configuration.
Deployer	Complete configuration and runtime operations on applications.
Admin Security Manager	Assign users and groups to administrative user and group roles. An administrator cannot assign users and groups to administrative user and group roles, including the Admin Security Manager role. For information on how to assign federated repository management rights to users who are not assigned the WAS Administrator role, see the topic, Mapping users and groups to roles for assigning federated repository management rights in the topic, Providing security.
Auditor	Enable and disable the security auditing subsystem. Select the event factory implementation to be used with the event factory plug-in point. Select and configure the service provider, or emitter, or both to be used with the service provider plug-in point. Set the audit policy that describes the behavior of the application server in the event of an error with the security auditing subsystem. Define which security events are to be audited. The auditor role includes the monitor role. This allows the auditor to view but not change the rest of the security configuration.

Operation	Required Roles ( Any one)
Install application	Cell-configurator, target-deployer
Uninstall application	Cell-configurator, application-deployer, target-deployer
List application	Cell-monitor, application-monitor
Edit, update and redeploy application	Cell-configurator, application-deployer
Export application	Cell-monitor, application-monitor
Start or stop application	Cell-operator, application-deployer

Action	Role
Map users to administrative roles for cell level	Only the Admin Security Manager of the cell
Map users to administrative roles for an authorization group	Only the Admin Security Manager of that authorization group or the Admin Security Manager of the cell
Manage authorization groups, create, delete, add resource to an authorization group, or remove resource from an authorization group or list	Only the Admin Security Manager of the cell