+

Search Tips   |   Advanced Search

WizardCommands

Use the Jython or Jacl scripting languages to configure security with the wsadmin tool. The commands in the WizardCommands group can be used to configure security using similar actions to the security wizard panels in the administrative console.

The WizardCommands commands include:

  1. addToAdminAuthz
  2. applyWizardSettings
  3. getCurrentWizardSettings
  4. isAdminLockedOut
  5. isAppSecurityEnabled
  6. isGlobalSecurityEnabled
  7. setGlobalSecurity
  8. setUseRegistryServerId
  9. validateAdminName
  10. validateLDAPConnection
  11. WIMCheckPassword


addToAdminAuthz

The addToAdminAuthz command adds a new administrative user to the configuration.

Required parameters:

adminUser

Name of the administrative user to add to the configuration.

Examples

Batch mode example usage:

Interactive mode example usage:


applyWizardSettings

The applyWizardSettings command applies the current security wizard settings from the workspace.

Required parameters:

adminName

Name of the user with administrative privileges defined in the registry.

secureApps

Specifies whether to set application-level security. This type of security provides application isolation and requirements for authenticating application users.

We can specify a true or false value.

The value that we set for this parameter might be overridden by a value at the server level.

secureLocalResources

Specifies whether to set Java 2 security. If we enable Java 2 security and an application requires more Java 2 security permissions than are granted in the default policy, then the application might fail to run properly. By default, access to local resources is not restricted. We can choose to disable Java 2 security, even when application security is enabled.

We can specify a true or false value.

userRegistryType

Specifies a valid user registry type. The following type values are valid:

  • LDAPUserRegistry

    This registry type uses the LDAP user registry settings when users and groups exist in an external LDAP directory.

  • CustomUserRegistry

    This type specifies a custom registry that implements the UserRegistry interface in the com.ibm.websphere.security package. If we specify this user registry type, use the customRegistryClass parameter to specify the class name for the user registry.

  • WIMUserRegistry

    This value has the same effect as the Federated repositories option in the Security Configuration Wizard on the administrative console. A registry type manages identities in a single, virtual realm stored in multiple repositories.

  • LocalOSUserRegistry

    This value specifies the registry for the local operating system of the application server.

Optional parameters:

adminPassword

Password for the user with administrative privileges defined in the registry.

adminPassword is supported only when WIMUserRegistry is selected and adminUser belongs to default FileRegistry of Federated Repository.

customProps

Custom property.

customRegistryClass

Dot-separated class name that implements the UserRegistry interface in the com.ibm.websphere.security package. Include this parameter if we specify CustomUserRegistry for the userRegistryType parameter.

ignoreCase

Indicates that when an authorization check is performed, the check is not case-sensitive.

We can specify a true or false value.

ldapServerType

Specifies a valid LDAP server type. The following type values are valid:

  • IBM_DIRECTORY_SERVER

    This value refers to a supported IBM Security Directory Server version.

  • IPLANET

    This value refers to a supported Sun Java System Directory Server version.

  • NDS

    This value refers to a supported Novell eDirectory version.

  • DOMINO502

    This value refers to a supported IBM Lotus Domino server version.

  • SECUREWAY

    This value refers to an IBM SecureWay Directory Server version.

  • ACTIVE_DIRECTORY

    This value refers to a supported Microsoft Active Directory version.

  • CUSTOM

    This value refers to a custom registry implementation.

For more information about the supported LDAP server versions, see the WebSphere Application Server detailed system requirements documentation.

ldapBaseDN

Base distinguished name of the directory service, which indicates the starting point for LDAP searches in the directory service. For example, ou=Rochester, o=IBM, c=us.

ldapBindDN

Distinguished name for the application server, which is used to bind to the directory service.

ldapBindPassword

Password for the application server, which is used to bind to the directory service.

ldapHostName

The (LDAP server host name. This host name is either an IP address or a domain name service (DNS) name.

ldapPort

Specifies a valid LDAP server port number.

Examples

Batch mode example usage:

Interactive mode example usage:


getCurrentWizardSettings

The getCurrentWizardSettings command retrieves the current security wizard settings from the workspace.

Parameters None

Examples

Batch mode example usage:

Interactive mode example usage:


isAdminLockedOut

The isAdminLockedOut command verifies that at least one administrative user exists in the input user registry.

Required parameters:

registryType

Specifies a valid user registry type. The following type values are valid:

  • LDAPUserRegistry

    This registry type uses the LDAP user registry settings when users and groups exist in an external LDAP directory.

  • CustomUserRegistry

    This type specifies a custom registry.

  • WIMUserRegistry

    This value has the same effect as the Federated repositories option in the Security Configuration Wizard on the administrative console. This registry type manages identities in a single, virtual realm stored in multiple repositories.

  • LocalOSUserRegistry

    This value specifies the registry for the local operating system of the application server.

Examples

Batch mode example usage:

Interactive mode example usage:


isAppSecurityEnabled

The isAppSecurityEnabled command returns a true or false value that indicates whether application security is enabled.

Parameters None

Examples

Batch mode example usage:

Interactive mode example usage:


isGlobalSecurityEnabled

The isGlobalSecurityEnabled command returns a true or false value that indicates whether administrative security is enabled.

Parameters None

Examples

Batch mode example usage:

Interactive mode example usage:


setGlobalSecurity

The setGlobalSecurity command changes whether administrative security is enabled.

Required parameters:

enabled

Enable administrative security. This enabled parameter is equivalent to the Enable application security option on the administrative console.

Specify either a true or false value.

Examples

Batch mode example usage:

Interactive mode example usage:


setUseRegistryServerId

The setUseRegistryServerId command updates the useRegistryServerId field in the user registry object within the security.xml file with a true or flase value. If we set the field value to true, the application server uses a user-specified server ID for interprocess communications.

Required parameters:

useRegistryServerId

True or false value for the useRegistryServerId setting.

useRegistryType

Specifies a valid user registry type. The following type values are valid:

  • LDAPUserRegistry

    This registry type uses the LDAP user registry settings when users and groups exist in an external LDAP directory.

  • CustomUserRegistry

    This type specifies a custom registry.

  • WIMUserRegistry

    This value has the same effect as the Federated repositories option in the Security Configuration Wizard on the administrative console. A registry type manages identities in a single, virtual realm stored in multiple repositories.

  • LocalOSUserRegistry

    This value specifies the registry for the local operating system of the application server.

Examples

Batch mode example usage:

Interactive mode example usage:


validateAdminName

The validateAdminName command verifies whether an administrator name exists in the input user registry.

Required parameters:

adminUser

Specifies an administrative user name.

registryType

Specifies a valid user registry type. The following type values are valid:

  • LDAPUserRegistry

    This registry type uses the LDAP user registry settings when users and groups exist in an external LDAP directory.

  • CustomUserRegistry

    This type specifies a custom registry.

  • WIMUserRegistry

    This value has the same effect as the Federated repositories option in the Security Configuration Wizard on the administrative console. A registry type manages identities in a single, virtual realm stored in multiple repositories.

  • LocalOSUserRegistry

    This value specifies the registry for the local operating system of the application server.

Optional parameters:

ldapServerType

Specifies a valid LDAP server type. The following type values are valid:

  • IBM_DIRECTORY_SERVER

    This value refers to a supported IBM Security Directory Server version.

  • IPLANET

    This value refers to a supported Sun Java System Directory Server version.

  • NDS

    This value refers to a supported Novell eDirectory version.

  • DOMINO502

    This value refers to a supported IBM Lotus Domino server version.

  • SECUREWAY

    This value refers to an IBM SecureWay Directory Server version.

  • ACTIVE_DIRECTORY

    This value refers to a supported Microsoft Active Directory version.

  • CUSTOM

    This value refers to a custom registry implementation.

For more information about the supported LDAP server versions, see the WAS detailed system requirements documentation.

Examples

Batch mode example usage:

Interactive mode example usage:


validateLDAPConnection

The validateLDAPConnection command validates the connection to a specified LDAP server.

Required parameters:

hostname

LDAP server host name. This host name is either an IP address or a domain name service (DNS) name.

sslEnabled

Specifies whether secure socket communications is enabled with the LDAP server. When this option is selected, LDAP SSL settings are used, if specified.

type

Specifies a valid LDAP registry type. The following type values are valid:

  • IBM_DIRECTORY_SERVER

    This value refers to a supported IBM Security Directory Server version.

  • IPLANET

    This value refers to a supported Sun Java System Directory Server version.

  • NDS

    This value refers to a supported Novell eDirectory version.

  • DOMINO502

    This value refers to a supported IBM Lotus Domino server version.

  • SECUREWAY

    This value refers to an IBM SecureWay Directory Server version.

  • ACTIVE_DIRECTORY

    This value refers to a supported Microsoft Active Directory version.

  • CUSTOM

    This value refers to a custom registry implementation.

For more information about the supported LDAP server versions, see the WAS detailed system requirements documentation.

Optional parameters:

baseDN

Base distinguished name of the directory service, which indicates the starting point for LDAP searches in the directory service. For example, ou=Rochester, o=IBM, c=us

bindDN

Distinguished name for the application server, which is used to bind to the directory service.

bindPassword

Password for the application server, which is used to bind to the directory service.

port

LDAP server port number.

securityDomainName

Name used to uniquely identify the security domain.

sslAlias

Specifies which SSL configuration to use for LDAP.

Examples

Batch mode example usage:

Interactive mode example usage:


WIMCheckPassword

The WIMCheckPassword command validates the user name and password in the federated repository.

Required parameters:

username

Name of the user.

password

Password for the user.

Examples

Batch mode example usage:

Interactive mode example usage:

  • wsadmin AdminTask
  • Commands for the AdminTask object
  • WAS detailed system requirements