Stand-alone custom registry settings
Configure the stand-alone custom registry.
To view this administrative console page:
- Click Security > Global security.
- Under User account repository, click the Available realm definitions drop-down list, select Stand-alone custom registry, and click Configure.
After the properties are set in this panel, click Apply. Under Additional Properties, click Custom properties to include additional properties that the custom user registry requires.
Custom properties might include information such as specifying lists of users or groups.
When security is enabled and any of these custom user registry settings change, go to the Global security panel and click Apply to validate the changes.
WebSphere Application Server v7.0 distinguishes between the user identities for administrators who manage the environment and server identities for authenticating server to server communications. In most cases, server identities are automatically generated and are not stored in a repository.
(Dist) However, if we are adding a previous version node to the latest version cell and the previous version node used a server identity and password, ensure that the server identity and password for the previous version are defined in the repository for this cell. Enter the server user identity and password on this panel.
Any settings related to the System Authorization Facility (SAF) might not be visible on this panel. To modify these settings:
- Go to the panel for SAF by clicking Security > Global security > External authorization providers.
- Select System Authorization Facility (SAF) from the drop-down list under the Authorization provider option.
- Click Configure.
(ZOS) Custom properties
Under the Custom properties link, we can add a value for one or more of the custom properties.
- force.credential.creation.for.validation
- Setting this property forces the creation of an access control environment elements (ACEE) or find the ACEE of the user from the cache during ID assertion login to prevent obtaining information for users that have been revoked.
Forcing the creation of credentials all the time will cause a decrease in performance.
Primary administrative user name
Name of a user with administrative privileges defined in our custom user registry.
The user name is used to log onto the administrative console when administrative security is enabled. v6.1 requires an administrative user that is distinct from the server user identity so that administrative actions can be audited.
In WAS, v6.0.x, a single user identity is required for both administrative access and internal process communication. When migrating to v6.1 and later, this identity is used as the server user identity. We need to specify another user for the administrative user identity.
Automatically generated server identity
Enables the application server to generate the server identity, which is recommended for environments that contain only v6.1 or later nodes. Automatically generated server identities are not stored in a user repository.
Information Value Default: Enabled
Server identity stored in the repository
User identity in the repository used for internal process communication. Cells that contain v6.1 or later nodes require a server user identity defined in the active user repository.
Information Value Default: Enabled
(ZOS) User identity for the z/OS started task
User identity associated with the z/OS system started task. Each controller and server can have its own identity.
(Dist)
Server user ID or administrative user on a v6.0.x node
User ID used to run the application server for security purposes.
(Dist)
Password
Password that corresponds to the server ID.
Custom registry class name
Dot-separated class name that implements the com.ibm.websphere.security.UserRegistry interface.
Put the custom registry class name in the class path. A suggested location is the following directory.
- (Dist) %install_root%/lib/ext
- (iSeries) profile_root/classes
Information Value Data type: String Default: com.ibm.websphere.security.FileRegistrySample
Ignore case for authorization
Indicates that a case-insensitive authorization check is performed when using the default authorization.
Information Value Default: Disabled Range: Enabled or Disabled
Configure stand-alone custom registries (iSeries) Create a classes subdirectory in your profile for custom classes Servlet security methods Stand-alone custom registry wizard settings