+

Search Tips   |   Advanced Search

Add realm support on Linux in a clustered environment


A realm is a group of users from one or more user registries that form a coherent group within IBM WebSphere Portal. A realm must be mapped to a Virtual Portal to allow the defined users to log in to the Virtual Portal. When configuring realm support, complete these steps for each base entry that exists in the LDAP and/or database user registry to create multiple realm support.

Before configuring realm support, add all LDAP user registries and/or database user registries that you will use to create a single realm or multiple realms, to the federated repository. If we are going to create multiple realms, create all required base entries within the LDAP user registries and/or database user registries. All base entry names must be unique within the federated repository.

In a clustered environment, start the dmgr and nodeagent and verify they are able to synchronize.

Add realm support to the user registry model:

  1. Run backupConfig.sh

  2. Edit wkplc.properties

  3. Create a new realm with default base entry.

    Set the following required parameters under the VMM realm configuration heading:

  4. Save changes to wkplc.properties.

  5. Add your new realm to the Virtual Member Manager configuration...

      ./ConfigEngine.sh wp-create-realm -DWasPassword=foo

    To create multiple realms, ensure that the federated repository contains the required unique base entries. Stop and restart the appropriate servers for the installation environment, and then update wkplc.properties with the base entry information and rerun the wp-create-realm task. Repeat these steps until all realms are created.

  6. Stop and restart servers, dmgrs, and node agents.

  7. Set the parent person, parent group, and parent organization values for your new realm...

  8. Update the default parents per entity type and realm...

      ./ConfigEngine.sh wp-modify-realm-defaultparents -DWasPassword=foo

    If you have to re-run this task to add additional entity types and realms, first stop and restart the appropriate appservers

  9. Stop and restart servers, dmgrs, and node agents.

  10. Add any additional base entries to the realm configuration.

    For example, if you have two additional base entries (base entry 1 and base entry2) to add to the realm you just created, update wkplc.properties with the information from base entry 1 and then run this task. Then update the properties file with the information for base entry 2 and then run this task:

    1. Edit wkplc.properties

    2. Set value for new base entry under VMM realm configuration heading:

    3. Save changes to wkplc.properties.

    4. Add your LDAP base entry to the realm configuration...

        WP_PROFILE/ConfigEngine,
        ./ConfigEngine.sh wp-add-realm-baseentry -DWasPassword=foo

    5. Stop and restart all necessary servers to propagate the changes.

  11. Optional: Set the realm you created as the default realm:

    Only users defined in base entries that exist in the default realm are able to log into WebSphere Portal. If you find that a user cannot log in to WebSphere Portal, check to see if the base entry containing the user exists in the default realm. To see what base entries are part of the default realm...

      wp-query-realm-baseentry

    If the default realm is missing the base entry, run the wp-add-realm-baseentry task to add the base entry to the default realm.

    1. Edit wkplc.properties

    2. For defaultRealmName, type the realmName property value to use as the default realm.

    3. Save changes to wkplc.properties.

    4. Set this realm as the default realm...

        ./ConfigEngine.sh wp-default-realm -DWasPassword=foo

    5. Stop and restart all necessary servers to propagate the changes.

  12. Query realm for a list of its base entries:

    1. Edit wkplc.properties

    2. For realmName, set the name of the realm to query.

    3. Save changes to wkplc.properties.

    4. List the base entries for a specific realm...

        ./ConfigEngine.sh wp-query-realm-baseentry

  13. If you change the default realm, replace the WAS and WebSphere Portal administrator user ID to reflect the new realm:

    1. Create a new user in the Manage Users and Groups portlet to replace the current WAS administrative user.

    2. Create a new user in the Manage Users and Groups portlet to replace the current WebSphere Portal administrative user.

    3. Create a new group in the Manage Users and Groups portlet to replace the current group.

    4. Replace the old WAS admin user ID and group ID with the new user and group...

        ./ConfigEngine.sh wp-change-was-admin-user -DWasUser=adminid -DWasPassword=foo -DnewAdminId=newadminid -DnewAdminPw=newpassword -DnewAdminGroupId=newadmingroupid

      Provide the full DN for the newAdminId and newAdminGroupId parameters.

      To verify the user against a running server instance, run add...

        -Dskip.ldap.validation=true

    5. Verify the task completed successfully. Stop and restart all required servers.

    6. Replace the old WebSphere Portal admin user ID and group ID with the new user and group...

        ./ConfigEngine.sh wp-change-portal-admin-user -DWasPassword=foo -DnewAdminId=newadminid -DnewAdminPw=newpassword -DnewAdminGroupId=newadmingroupid

      Provide the full DN for the newAdminId and newAdminGroupId parameters.

      This task verifies the user against a running server instance. If the server is stopped, to skip the validation...

        -Dskip.ldap.validation=true

    7. Verify the task completed successfully. Stop and restart all required servers.

    To enable the full distinguished name login if the short names are not unique for the realm:

    Run this task if the administrator name is in conflict with another user name in the attached repository. This command allows the Administrator to log in using the fully distinguished name instead of the short name.

    1. Edit wkplc.properties

    2. Enter a value for realmName or leave blank to update the default realm.

    3. Save changes to wkplc.properties.

    4. To enable the distinguished name login...

        ./ConfigEngine.sh wp-modify-realm-enable-dn-login -DWasPassword=foo

      To disable this feature...

        ./ConfigEngine.sh wp-modify-realm-disable-dn-login -DWasPassword=foo

    5. Stop and restart all necessary servers to propagate the changes.

If you created a cluster, including additional nodes, and then completed the steps in this task, run update-jcr-admin on the secondary nodes.


Parent: Configure the default federated repository on Linux in a clustered environment
Related:
Start and stop servers, dmgrs, and node agents
Enable LDAP security after cluster creation