Secure an existing bus using multiple security domains
We can configure an existing bus to use a cell-level or custom security domain. Using non-global security domains provides the scope to use multiple security domains. The bus can inherit security settings from the cell, or have a unique security configuration.
- Review the information in Service integration security planning and Messaging security and multiple security domains.
- The bus we want to secure must exist in the administrative console. To create a new bus, see Add a secured bus.
- Ensure that all the bus members are at WebSphere Application Server v7.0 or later; use of non-global security domains is not supported for earlier versions of WAS. If the bus has a WAS v6 bus member, see Secure an existing bus using the global security domain. For more information about using security domains, see Service integration security planning and Messaging security and multiple security domains.
- Ensure that there are no indoubt transactions on the messaging engine because incomplete transactions cannot be recovered after the bus is secured. See Resolving indoubt transactions.
- Stop all servers on which the SIB Service enabled. This ensures that the bus security configuration is applied consistently when the servers are restarted. See Stopping an application server.
This task uses the administrative console Bus Security Configuration wizard to secure an existing bus. If the wizard detects that administrative security for the cell is disabled, it prompts you to enable it. Type of user repository, the administrative security username and password. By default, connecting clients are required to use SSL protected transports to ensure data confidentiality and integrity. We can choose not to use this option. We can specify that the bus uses the cell-level or a custom security domain. If we choose a custom security domain, we must also specify a user realm.
Tasks
- In the navigation pane, click Service integration -> Buses -> security_value. The general properties for the selected bus are displayed.
- Click Configure Bus Security to start the Bus Security Configuration wizard.
- Read the Introduction panel, and click Next.
- If administrative security is disabled, follow the instructions to configure the appropriate user repository, and click Next.
- Review the summary of our choices:
- Optional: To make changes, click Previous to return to an earlier panel, and make the changes you require.
- Click Finish when we are ready to confirm our choices.
Administrative security for the cell is now enabled.
- If we do not want clients to use SSL protected transports, clear the check box Require clients use SSL protected transports .
- Select the cell-level or custom security domain for the bus.
- Optional: To create a new custom security domain:
- Use the name suggested for the security domain, or type a new one.
- Optional: Provide a description of the security domain.
- Select a user realm for the domain. Use the user realm configured in the global security domain, or follow the steps to configure a new user realm.
- Click Next.
- Review the summary of our choices:
- Optional: To make changes, click Previous to return to an earlier panel, and make the changes you require.
- Click Finish to confirm our choices.
- Save changes to the master configuration.
We have specified that the selected bus uses a cell-level or custom security domain. The security settings configured for the bus are displayed in the updated Bus Security Settings panel. The bus is secured after you restart all the servers that are members of the bus, or (for a bus that has bootstrap members) servers for which the SIB service is enabled.
What to do next
We must propagate the bus security configuration to all the affected nodes, and restart the servers. For more information, see Synchronize nodes and Starting an application server.
Related:
Messaging security and multiple security domains Configure bus security using an administrative console panel Configure the bus to access secured mediations Configure a bus to run mediations in a multiple security domain environment Select a registry or repository Add a secured bus Secure an existing bus using the global security domain Migrate an existing secure bus to multiple domain security