![[Note]](images.admon/note.gif) | |
|
Administrative roles
The Java Platform, Enterprise Edition (Java EE) role-based authorization concept is extended to protect the WebSphere Application Server administrative subsystem.
A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when administrative security is enabled. The following list describes the administrative roles:
Monitor
An individual or group that uses the monitor role has the least amount of privileges. A monitor can complete the following tasks:
View the WebSphere Application Server configuration.
View the current state of the Application Server.
Configurator
An individual or group that uses the configurator role has the monitor privilege plus the ability to change the WebSphere Application Server configuration. The configurator can perform all the daily configuration tasks. For example, a configurator can complete the following tasks:
Create a resource.
Map an application server.
Install and uninstall an application.
Deploy an application.
Assign users and groups-to-role mapping for applications.
Set up Java 2 security permissions for applications.
Customize the Common Secure Interoperability Version 2 (CSIv2), Security Authentication Service (SAS), and Secure Sockets Layer (SSL) configurations.
Operator
An individual or group that uses the operator role has monitor privileges plus ability to change the runtime state. For example, an operator can complete the following tasks:
Stop and start the server.
Monitor the server status in the administrative console.
Administrator
An individual or group that uses the administrator role has the operator and configurator privileges, plus additional privileges that are granted solely to the administrator role. For example, an administrator can complete the following tasks:
Modify the server user ID and password.
Configure authentication and authorization mechanisms.
Enable or disable administrative security.
Enable or disable Java 2 security.
Change the Lightweight Third Party Authentication (LTPA) password and generate keys.
Create, update, or delete users in the federated repositories configuration.
Create, update, or delete groups in the federated repositories configuration.
NOTE: An administrator CANNOT map users and groups to the administrator roles without also having the
adminsecuritymanagerrole.ISC Admins
This role is only available for administrative console users, not for
wsadminusers. Users who are granted this role have administrator privileges for managing users and groups in the federated repositories. For example, a user of theiscadminsrole can complete the following tasks:Create, update, or delete users in the federated repositories configuration.
Create, update, or delete groups in the federated repositories configuration.
Deployer
Users granted this role can complete both configuration actions and runtime operations on applications.
Admin Security Manager
You can assign users and groups to the Admin Security Manager role on the cell level through
wsadminscripts and the administrative console. Using the Admin Security Manager role, you can assign users and groups to the administrative user roles and administrative group roles. However, an administrator cannot assign users and groups to the administrative user roles and administrative group roles including the Admin Security Manager role.Auditor
Users granted this role can view and modify the configuration settings for the security auditing subsystem. For example, a user with the auditor role can complete the following tasks:
Enable and disable the security auditing subsystem.
Select the event factory implementation to be used with the event factory plug-in point.
Select and configure the service provide, or emitter. or both to be used with the service provider plug-in point.
Set the audit policy that describes the behavior of the application server in the event of an error with the security auditing subsystem.
Define which security events are to be audited.
The auditor role includes the monitor role. This allows the auditor to view but not change the rest of the security configuration.
