Configure security with scripting

The user Id and password needed for wsadmin to connect to a secured server can be supplied as command line options and in properties files. If used together, command line options take precedence over what is in the properties files. The properties files are located at Profile_root/properties .

Tasks

• The nature of the properties file updates required for running in secure mode depend on whether you connect with a Remote Method Invocation (RMI) connector, a JSR160RMI connector, an Inter-Process Communications (IPC) or a SOAP connector:

  • If we use a RMI connector or a JSR160RMI connector, set the following properties in the sas.client.props file with the appropriate values:

    com.ibm.CORBA.loginUserid=
    com.ibm.CORBA.loginPassword=
    

    Also, set the following property:

    com.ibm.CORBA.loginSource=properties
    

    The default value for this property is prompt in the sas.client.props file. If we leave the default value, then a dialog box is displayed with a password prompt. If the script is running unattended, then the system stops.

  • If we use a SOAP connector, set the following properties in the soap.client.props file with the appropriate values:

    com.ibm.SOAP.securityEnabled=true
    com.ibm.SOAP.loginUserid=
    com.ibm.SOAP.loginPassword=
    

    Optionally, set the following property:

    com.ibm.SOAP.loginSource=none
    

    The default value for this property is prompt in the soap.client.props file. If we leave the default value, a dialog box is displayed with a password prompt. If the script is running unattended, then the system stops.

  • If we use an IPC connector, set the following properties in the ipc.client.props file with the appropriate values:

    com.ibm.IPC.loginUserid=
    com.ibm.IPC.loginPassword=
    

    Optionally, remove prompt from the following line:

    com.ibm.IPC.loginSource=prompt 

    The default value for this property is prompt in the ipc.client.props file. If we leave the default value, a dialog box appears with a password prompt. If the script is running unattended, it appears to hang.

• Specify user and password information. Choose one of the following methods:

  • Specify user name and password on a command line, using the -user and -password commands, as the following examples demonstrate:

    wsadmin -conntype JSR160RMI -port 2809 -user u1 -password secret1
    

    (ZOS)

    wsadmin.sh -conntype JSR160RMI -port 2809 -user u1 -password secret1
    

  • Specify a user name and password in the properties file for the type of connector we are using.

  If we specify user and password information on a command line and in the sas.client.props file or the soap.client.props file, the command line information overrides the information in the props file.

  (UNIX) The use of -password option may result in security exposure as the password information becomes visible to the system status program such as ps command which can be invoked by other user to display all the running processes. Do not use this option if security exposure is a concern. Instead, specify user and password information in the soap.client.props file for the SOAP connector, the sas.client.props file for the JSR160RMI connector or the Remote Method Invocation (RMI) connector, or the ipc.client.props file for the IPC connector. The soap.client.props, sas.client.props, and ipc.client.props files are located in the properties directory of our profile.

Subtopics

• Enable and disable security
• Enable and disable Java 2 security
• WizardCommands
  
• Configure multiple security domains
• Configure the JACC provider for ISAM
• Secure communications
• Enable authentication in the file transfer service
• Propagate security policy of installed applications to a JACC provider
  
• Configure custom adapters for federated repositories
• Configure a federated repository or stand-alone LDAP registry
• Disable embedded ISAM client
• Configure security auditing
• SSLMigrationCommands
  
• IdMgrConfig
  
• IdMgrRepositoryConfig
  
• IdMgrRealmConfig
  
• IdMgrDataModel
  
• IdMgrDBSetup
  
• JaspiManagement
  
• LTPACommandGroup
  
• WIMManagementCommands
  
• DescriptivePropCommands
  
• ManagementScopeCommands
  
• AuthorizationGroupCommands
  
• ChannelFrameworkManagement
  
• FIPSCommands
  
• SpnegoTAICommands group for the AdminTask object (deprecated)
  
• The Kerberos configuration file
  
• SPNEGO web authentication configuration commands
  
• SPNEGO web authentication filter commands
  
• Kerberos authentication commands
  
• LTPA_LDAPSecurityOn and LTPA_LDAPSecurityOff command usage
  

Use wsadmin scripting

Get started with wsadmin scripting

Start the wsadmin scripting client

SPNEGO TAI JVM configuration custom properties (deprecated)