Java 2 security with WebSphere Portal

Java 2 security with WebSphere Portal

Java™ 2 (J2SE) security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions before allowing access to certain protected system resources. J2SE security allows you to set up individual policy files that control the privileges assigned to individual code sources. If the code does not have the required permissions and still tries to execute a protected operation, the Java Access Controller will throw a corresponding security exception.
Policy files assign individual permissions to individual code sources. The syntax and semantics of the policy files are defined in the Java Language Specification. WAS uses a specific set of policy files to set up Java 2 Security. The following table contains information on the policy files and their protection scope:

Default location and policy file Protection scope
WAS_HOME//java/jre/lib/security/java.policy This is the root policy file that contains permissions for all the processes launched by WAS.
WP_PROFILE/properties/server.policy This policy file grants default permissions to all product servers.
WP_PROFILE/properties/client.policy This policy file grants default permissions for all of the product client containers and applets on a node.
WP_PROFILE/config/cells/cell_name/nodes/node_name/spi.policy This template is for the Service Provider Interface (SPI) or the third party resources that are embedded in the product. The default permission is java.security.AllPermissions.
WP_PROFILE/config/cells/cell_name/nodes/node_name/library.policy This policy grants default permissions (empty) to code contained in the shared library (Java library classes) to use in multiple product applications.
WP_PROFILE/config/cells/cell_name/nodes/node_name/app.policy This policy grants default permissions to all enterprise applications running on this node in this cell.
WP_PROFILE/config/cells/cell_name/applications/ear_file_name/deployments/application_name/META-INF/was.policy This policy assigns permissions to a specific enterprise application, imbedded within EAR:/META-INF/was.policy.
rar_filename/META-INF/was.policy.RAR This file can have a permission specification that is defined in the ra.xml file. The ra.xml file is embedded in the RAR file.

All code artifacts, installed with the WebSphere Portal product, run with java.security.AllPermission specified either in the server.policy file for the portal shared libraries or in the individual was.policy files for the individual portlets.
Portlets that are installed on WebSphere Portal after installation can bring along their own was.policy files defining the allowed interactions of the portlet code with the system resources; see Portlet concepts for additional information. The application server searches for was.policy files in the enterprise application archive rather than the Web application archive comprising a portlet. Therefore, the portal server copies was.policy from the appname.war/META-INF directory to the generated appname.ear/META-INF directory during deployment of a portlet WAR file.

Parent
Securing

Portlet concepts
Java 2 Security
http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=/com.ibm.websphere.nd.multiplatform.doc/info/ae/ae/csec_rsecmgr2.html
Java 2 Platform Security
http://java.sun.com/j2se/1.5.0/docs/guide/security/index.html

+
Search Tips | Advanced Search

Default location and policy file	Protection scope
WAS_HOME//java/jre/lib/security/java.policy	This is the root policy file that contains permissions for all the processes launched by WAS.
WP_PROFILE/properties/server.policy	This policy file grants default permissions to all product servers.
WP_PROFILE/properties/client.policy	This policy file grants default permissions for all of the product client containers and applets on a node.
WP_PROFILE/config/cells/cell_name/nodes/node_name/spi.policy	This template is for the Service Provider Interface (SPI) or the third party resources that are embedded in the product. The default permission is java.security.AllPermissions.
WP_PROFILE/config/cells/cell_name/nodes/node_name/library.policy	This policy grants default permissions (empty) to code contained in the shared library (Java library classes) to use in multiple product applications.
WP_PROFILE/config/cells/cell_name/nodes/node_name/app.policy	This policy grants default permissions to all enterprise applications running on this node in this cell.
WP_PROFILE/config/cells/cell_name/applications/ear_file_name/deployments/application_name/META-INF/was.policy	This policy assigns permissions to a specific enterprise application, imbedded within EAR:/META-INF/was.policy.
rar_filename/META-INF/was.policy.RAR	This file can have a permission specification that is defined in the ra.xml file. The ra.xml file is embedded in the RAR file.