This guided activity leads you through a simple set of steps for enabling basic administrative security. After you have completed the cheat sheet, you will need a User ID and Password to login to the Administrative Console. See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_plan.html">Planning to secure your environment</a> in the Information Center for more information about security. To continue, click Start. The user registry stores user and group names for authentication and authorization purposes. Application servers will connect to the user registry to collect user-related information when creating credentials, which are then used to represent the user during authorization (for example, when logging into an application to check passwords). See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/csec_registries.html ">User registries</a> in the Information Center for more information. Select the type of user registry that you plan to use and click Click to perform to learn how to configure it. When you have completed configuring the user registry, you will return here to continue with further steps: <dl> <li> Local OS <A HREF="javascript:showHideList('localos')"> <IMG SRC="/ibm/console/images/arrow_collapsed.gif" ALT="" ID="localosImg" ALIGN="left" BORDER="0" style="margin-left:-0.25em"/> </A> Read more about Local OS user registries <TABLE id="localosList" style="font-size:100%;margin-left:1em;display:none"> <TR> <TD> Local OS user registries are the user registries that are part of the underlying operating system that application servers are running on. Local OS user registries are always available, and are typically the simplest way to configure users because you have already set them up in order to log into your machine. You can use your local operating system's user registry for basic single machine, single application server configurations. See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_localos.html">Configuring local operating system user registries</a> in the Information Center for more information. </TD> </TR> </TABLE> <A TARGET="detail" HREF="../guidedactivity/csframe.jsp?cheatSheetURI=com.ibm.ws.console.security/guidedactivity/cheatsheets/nl/lang/cheatsheet_localos.xml&cheatSheetPackage=com.ibm.ws.console.security/guidedactivity/cheatsheets&fromStep=1">Click to perform</A> </li> </dl> <dl> <li> LDAP <A HREF="javascript:showHideList('ldap')"> <IMG SRC="/ibm/console/images/arrow_collapsed.gif" ALT="" ID="ldapImg" ALIGN="left" BORDER="0" style="margin-left:-0.25em"/> </A> Read more about LDAP user registries <TABLE id="ldapList" style="font-size:100%;margin-left:1em;display:none"> <TR> <TD> Another commonly used type of user registry is a directory server accessible via LDAP (Lightweight Directory Access Protocol). When working with multiple servers, such as clustering and high availability, and with multiple machines, you will probably run into limitations using a single machine's local operating system user registry, and need to move up to a directory server using LDAP for storing user and group information. See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_ldap.html">Configuring Lightweight Directory Access Protocol user registries</a> in the Information Center for more information. </TD> </TR> </TABLE> <A TARGET="detail" HREF="../guidedactivity/csframe.jsp?cheatSheetURI=com.ibm.ws.console.security/guidedactivity/cheatsheets/nl/lang/cheatsheet_ldap.xml&cheatSheetPackage=com.ibm.ws.console.security/guidedactivity/cheatsheets&fromStep=1"> Click to perform</A> </li> </dl> <dl> <li> Custom registry <A HREF="javascript:showHideList('custom')"> <IMG SRC="/ibm/console/images/arrow_collapsed.gif" ALT="" ID="customImg" ALIGN="left" BORDER="0" style="margin-left:-0.25em"/> </A> Read more about Custom user registries <TABLE id="customList" style="font-size:100%;margin-left:1em;display:none"> <TR> <TD> A third option for user registries is a user registry that is not one of the operating system user registries supported by WebSphere and is not an LDAP-compliant user registry. Connecting to these types of user registries is an advanced but supported option, and requires a software development effort to complete. See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/usec_tdaman.html">Configuring custom user registries</a> in the Information Center for more information. </TD> </TR> </TABLE> <A TARGET="detail" HREF="../guidedactivity/csframe.jsp?cheatSheetURI=com.ibm.ws.console.security/guidedactivity/cheatsheets/nl/lang/cheatsheet_custom.xml&cheatSheetPackage=com.ibm.ws.console.security/guidedactivity/cheatsheets&fromStep=1">Click to perform</A> </li> </dl> To continue, click Next step. Authentication is the process of establishing whether a client is valid in a particular context. A client can be either an end user, a machine, or an application. Multiple types of authentication mechanisms are supported in WebSphere v6.0; however, this step will only outline the use of the most common authentication mechanism, <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/usec_rltpa.html">Lightweight Third Party Authentication (LTPA)</a>. You may use <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/rsec_swam.html">Simple WebSphere Authentication Mechanism (SWAM)</a> if within a single-server environment. No setup is needed for SWAM, so you may continue to the next step. <A HREF="javascript:showHideList('ltpa')"> <IMG SRC="/ibm/console/images/arrow_collapsed.gif" ALT="" ID="ltpaImg" ALIGN="left" BORDER="0" style="margin-left:-0.25em"/> </A>Read more about LTPA <TABLE id="ltpaList" style="font-size:100%;margin-left:0em;display:none"> <TR> <TD> LTPA is intended for distributed, multiple application server and machine environments. It is offered for the Network Deployment product but is encouraged for all environments. See <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_authentication.html">Configuring authentication mechanisms</a> in the Information Center for more information. </TD> </TR> </TABLE> </li> </dl> To configure LTPA by setting key generation passwords and to generate the LTPA keys: <ol> <li>Click Click to perform to load the LTPA configuration panel</li> <li>Enter a password and confirm it in the password fields. This password is used to encrypt and decrypt the LTPA keys during export and import of the keys. Important: Remember this password because you need to enter it again any time keys from this cell are exported to another cell.</li> <li>Enter a positive integer value in the Timeout field. This timeout value refers to how long an LTPA token is valid in minutes. The token contains this expiration time so that any server that receives the token can verify that the token is valid before proceeding further. When the token expires, the user is prompted to log in. An optimal value for this field depends on your configuration. </li> <li>Click Apply or OK. The LTPA configuration is now set. Do not generate the LTPA keys in this step because they are automatically generated later. </li> </ol> To continue, click Next step. To validate the security settings <ol> <li>Click Click to perform to load the Global Security panel</li> <li>Select the boxes next to Enable global security and Enforce Java 2 security if these boxes are not selected.</li> <li>Specify the user registry that you configured in Active user registry list.</li> <li>Specify the authentication mechanism that you configured in Active authentication mechanism list.</li> <li>Click Apply on the Global Security panel to validate the configuration changes made so far. Correct any problems mentioned in the validation messages. See <A target="help" HREF="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/rtrb_secconfigprobs.html"> Errors when trying to configure or enable security </A> for more information on troubleshooting security problems. </li> </ol> To continue, click Next step. Click Save in the message at the top of the console panel to update the configuration in the master repository. To continue, click Next step. After security is enabled, you need to authorize user access to the console. This is done by either mapping individual users to adminsitrative roles, or by mapping groups of users to administrative roles. On WebSphere for z/OS, you can either map users to administrative roles through WebSphere or through the platform security product. Read InfoCenter article <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.zseries.doc/info/zseries/ae/tsec_tasroles.html">Assigning users and groups to roles</a> for information on mapping users to roles on z/OS. In this step, you can assign users to one of four different predefined roles, depending on the level of access that you want each user to have. If you already have groups of users defined in your user registry, click Next step to assign role mappings to administrative groups, rather than individual users. It is strongly recommended that at least one user ID should be mapped to the administrator role and a best practice not to use the Server ID for daily administrative purposes. <ol> <li>Click Click to perfom to load the Console users panel.</li> <li>Click Add and enter the user ID, password.</li> <li>Select one or more an administrative roles for the new user.</li> <li>Click Apply to save the new user to your workspace.</li> </ol> To continue, click Next step. Additionally, you can assign groups of users to one of four different predefined administrative roles, depending on the level of access that you want each user to have. <ol> <li>Click Click to perfom to load the console groups panel.</li> <li>Click Add and enter the name of a group that is already defined in the user registry.</li> <li>Select one or more an administrative roles for the new group.</li> <li>Click Apply to save the new group to your workspace.</li> </ol> To continue, click Next step. Click Save in the message at the top of the console panel to update the configuration in the master repository. To continue, click Next step. For security to take effect in a single-server environment, you must take the following actions: <ol> <li>Stop the application server and restart it.</li> <li>Then you can open the administrative console in a browser by typing it's url, <TT>http://{host}:{administrative port}/ibm/console</TT>.</li> <li>When the console starts, you are prompted for both a user ID and a password.</li> <li>Use one of the passwords that you specified as the administrator in the step, Define users to roles.</li> </ol> If you are in an environment with multiple nodes, you must take the following actions: <ol> <li>Click System Administration > Nodes to display the Nodes collection panel.</li> <li>Click Full Resynchronize to send the new configuration to the node agents.</li> <li>Stop the deployment manager by clicking System Administration > Deployment manager > Stop.</li> <li>Restart the deployment manager using the <TT>startManager</TT> command.</li> <li>Log in with your user ID and password. Use one of the passwords that you specified as the administrator in the step, Map users to administrative roles.</li> <li>Restart all of the node agents and application servers by clicking System administration > Node agents > Restart all servers on node.</li> </ol> If there were problems with enabling security, refer to <a target="help" href="http://publib.boulder.ibm.com/infocenter/ws60help/index.jsp?topic=/com.ibm.websphere.base.doc/info/aes/ae/tsec_trouble.html">Troubleshooting security configurations</a> in the Information Center for more information.