IBM Tivoli Monitoring > Version 6.3 Fix Pack 2 > Installation Guides > Installation Guide > Install IBM Tivoli Monitoring

IBM Tivoli Monitoring, Version 6.3 Fix Pack 2

Install the Tivoli Authorization Policy Server and tivcmd Command-Line Interface for Authorization Policy

Authorization policies provide you with role-based access control capabilities for monitoring dashboards in IBM Dashboard Application Services Hub. You can restrict the access that dashboard users have to managed system groups and to individual agent managed systems. The Tivoli Authorization Policy Server and tivcmd Command-Line Interface (CLI) for Authorization Policy are required framework components for the IBM Tivoli Monitoring authorization policy feature.

For more information and advantages of using authorization policies over Tivoli Enterprise Portal user permissions to control dashboard user access to managed system groups and managed systems, see Authorization and authentication.

The Authorization Policy Server is installed with IBM Dashboard Application Services Hub.

The IBM Dashboard Application Services Hub must be restarted after the Authorization Policy Server is configured.

If you plan to use authorization policies, normally you install the Authorization Policy Server with each IBM Dashboard Application Services Hub where you also install the dashboard applications such as IBM Infrastructure Management Dashboards for Servers or IBM Infrastructure Management Dashboards for VMware, or where you plan to create custom monitoring dashboards that use the IBM Tivoli Monitoring dashboard data provider. However, the following exceptions apply:

  1. If you set up multiple Dashboard Application Services Hub Servers for load balancing with an IBM HTTP Server, you cannot install the Authorization Policy Server on each dashboard server since the policy server does not support load balancing with this release. Therefore, if you setup multiple Dashboard Application Services Hub servers for load balancing, you can only install the Authorization Policy Server with one of the Dashboard Application Services Hub servers. See Configuring for IBM Dashboard Application Services Hub high availability and disaster recovery in the IBM Tivoli Monitoring High Availability Guide for Distributed Systems.

  2. If you have multiple IBM Tivoli Monitoring environments (also called domains), and you can share a set of common authorization policies between the monitoring domains, you should not install the Authorization Policy Server with each IBM Dashboard Application Services Hub.

The Tivoli Authorization Policy Server package has two features that you can select during installation and updates, Installation and Configuration. When you choose the Installation feature, the Authorization Policy Server files are copied from the installation media or repository to the file system. When you choose the Configuration feature, the Authorization Policy Server application is deployed into IBM Dashboard Application Services Hub using the scripts that were installed by the Installation feature. Normally you should select both features during installation. However, if you want to view the deployment scripts before they are executed, you can choose the Installation feature alone during installation. After reviewing the deployment scripts, you then use the Modify operation of IBM Installation Manager to select the Configuration feature and deploy the Authorization Policy Server application into IBM Dashboard Application Services Hub.

Although you could use the WebSphere Application Server wsadmin command-line interface to execute the Authorization Policy Server deployment scripts, this method is not supported. IBM Installation Manager must be used to track which features are installed and configured.

The tivcmd CLI should be installed on the computers where administrators create and work with authorization policies. The tivcmd CLI connects to an IBM Dashboard Application Services Hub where the Tivoli Authorization Policy Server package is installed by using HTTP or HTTPS. Therefore, it can either be installed on the same computer as Authorization Policy Server or on other computers that administrators use.

Authorization policy checking is disabled by default at the Tivoli Enterprise Portal Server. The installation of the Tivoli Authorization Policy Server and tivcmd CLI have no effect on IBM Tivoli Monitoring runtime behavior unless you enable authorization policy checking during configuration or reconfiguration of the Tivoli Enterprise Portal Server.

After successful installation or update of the Tivoli Authorization Policy Server and tivcmd Command Line Interface for Authorization Policy packages, you can execute various tivcmd CLI commands as required to create roles, grant permissions, exclude permissions, and so on. The IBM Tivoli Monitoring Administrator's Guide also provides examples of creating authorization policies for common scenarios in the Using role-based authorization policies chapter. The Preparing your dashboard environment chapter contains steps for configuring a dashboard environment to use authorization policies. For a complete list of tivcmd CLI commands, see the Command Reference.

For a complete list of prerequisite criteria, see Requirements for a dashboard environment.

See the following table for information about the tasks that you perform to install, update, and configure the Authorization Policy Server and tivcmd CLI:


Installation, update, and configuration topics

Task Where to find detailed information
Install and configure using the IBM Tivoli Monitoring installation launchpad or the IBM Installation Manager graphical user interface.

  1. The Tivoli Monitoring installation launchpad is the recommended approach if you are not familiar with IBM Installation Manager and you have a supported browser on the computer system where you are installing.

  2. You can install one or more of the IBM Tivoli Monitoring packages for a dashboard environment at the same time.

If you are using IBM Installation Manager to perform the installation and configuration, first install IBM Installation Manager and set up a repository. See Use IBM Installation Manager to install or update components from a local repository and Use IBM Installation Manager to install or update components from a network repository.

If you are using the Tivoli Monitoring installation launchpad, see Supported browser versions.

To install the Authorization Policy Server or tivcmd CLI, see Install the Tivoli Authorization Policy Server using the graphical user interface and Install the tivcmd Command Line Interface for Authorization Policy using the graphical user interface.

If you plan to install the infrastructure management dashboards, also see Install the IBM Infrastructure Management Dashboards for Servers

Install, update, and configure by using IBM Installation Manager console mode.

You can install or update the Tivoli Authorization Policy Server and IBM Infrastructure Management Dashboards for Servers at the same time but the tivcmd CLI package must be installed or updated separately.

Set up a repository using the instructions in one of the following sections: Use IBM Installation Manager to install or update components from a local repository or Use IBM Installation Manager to install or update components from a network repository.

To install or update the Authorization Policy Server, see Install or update the Tivoli Authorization Policy Server using console mode.

To install or update the tivcmd command line interface, see Install or update the tivcmd Command Line Interface for Authorization Policy using console mode.

Install, update, and configure by using IBM Installation Manager silent installation mode. Perform a silent installation of software packages using IBM Installation Manager
Configure the Tivoli Authorization Policy Server feature after installation or update. Configure the Tivoli Authorization Policy Server feature after installation
Verify the Tivoli Authorization Policy Server installation. Verify the Tivoli Authorization Policy Server installation
Create authorization policies and complete the set up and configuration of the dashboard environment to use authorization policies.

The user credentials that are specified during the installation and configuration of the Authorization Policy Server are assigned to the PolicyAdministrator role. You must use these credentials with the tivcmd Command Line Interface to log in to the Authorization Policy Server and assign other administrators permission to create and work with authorization policies.

Use role-based authorization policies and Preparing your dashboard environment in the IBM Tivoli Monitoring Administrator's Guide.
Use IBM Installation Manager to save the Authorization Policy Server package information that is needed to perform a rollback in the future. Saving package information for rollback
Update the Tivoli Authorization Policy Server. Update the Tivoli Authorization Policy Server using the graphical user interface
Rollback the Tivoli Authorization Policy Server to a previously installed version. Rollback of the Tivoli Authorization Policy Server
Update the tivcmd Command Line Interface for Authorization Policy. Update the tivcmd Command Line Interface for Authorization Policy using the graphical user interface
Rollback the tivcmd Command Line Interface for Authorization Policy to a previously installed version. Rollback of the tivcmd Command Line Interface for Authorization Policy
Uninstall procedures. Uninstall IBM Tivoli Monitoring components for a dashboard environment


Parent topic:

Install IBM Tivoli Monitoring

+

Search Tips   |   Advanced Search