Clusters and external security managers

Complete any configuration for an external security manager after you have completed all other setup, including ensuring that the cluster is functional.

Review system requirements before implementing.

Perform the security configuration on each node in the cluster

If you make changes to the external security manager configuration after initial setup, first make the changes in wkplc_comp.properties on the primary node of the cluster. If additional nodes exist in the cluster, propagate changes to wkplc_comp.properties on other nodes in the cluster.

Tivoli Access Manager

Run validate-pdadmin-connection on each node in the cluster. It the task fails, verify each node in the cluster has a unique value for...

wp.acc.impl.PDServerName

...in wkplc.properties, then execute run-svrssl-config.

For external web servers, edit wkplc_comp.properties on each node and set...

wp.ac.impl.JunctionHost = backend_server_host
wp.ac.impl.JunctionPort = backend_server_port

Ensure that the WebSEAL TAI parameters, found in wkplc_comp.properties, are the same on each node in the cluster.

If you run a configuration task that overwrites the WebSEAL junction, the WAS TAI properties are not automatically updated. Manually ensure that all nodes are using the same parameters. From the dmgr console go to...

Security | Global security | Web and SIP Security | Trust Association | Interceptors | com.ibm.sec.authn.tai.TAMETai | Custom properties

If we are still using the deprecated TAIs implementation, go to...

Security | Global security | Web and SIP Security | Trust Association | Interceptors | com.ibm.ws.security.web.TAMTrustAssociationInterceptorPlus | Custom properties

To indicate the location of the AMJRTE properties file, set the file location using...

wp.ac.impl.PDPermPath

...in wkplc_comp.properties. The value for wp.ac.impl.PDPermpath can be set globally for all cluster members by setting...

com.ibm.websphere.security.webseal.configURL

...in the dmgr WAS...

Security | Global security | Web and SIP Security | Trust Association | Interceptors | com.ibm.ws.security.web.TAMTrustAssociationInterceptorPlus | Custom properties

Because the dmgr security configuration is not sensitive to each node's filesystem type, the value for the configURL property must be resolved on each node.

To ensure that the location of the PdPerm.properties file is properly specified...

• If the nodes are all on UNIX platforms, use the UNIX link command (ln) to ensure the value for...
  com.ibm.websphere.security.webseal.configURL

  ...resolves on each node.

• If the PdPerm.properties file location differs on each node, and the cluster consists of different platforms, this property can accept a WAS variable to establish a location on each node's filesystem to correctly reference the file.

Parent: Cluster considerations