Administrative console and naming service authorization
Overview
WebSphere Application Server extends the J2EE security role-based access control to protect the product administrative and naming subsystems.
Administrative console
Four administrative roles are defined to provide degrees of authority needed to perform certain WAS administrative functions from either the administrative console or the system management scripting interface. The authorization policy is only enforced when global security is enabled. The four administrative security roles are defined in the following table:
Role Description monitor Least privileged where a user can view the WAS configuration and current state. configurator Monitor privilege plus the ability to change the WAS configuration. operator Monitor privilege plus the ability to change the run-time state, such as starting or stopping services. administrator Operator plus configuration privilege and the permission required to access sensitive data including the server password, LTPA password, LTPA keys, and so on. When WAS global security is enabled, the administrative subsystem role-based access control is enforced. The administrative subsystem includes security server, user registry, and all the JMX MBeans. When security is enabled, both the administrative console and the administrative scripting tool require users to provide the required authentication data. Moreover, the administrative console is designed so the control functions that display on the pages are adjusted according to the security roles that a user has. For example, a user who has only the monitor role can see only the non-sensitive configuration data. A user with the operator role can change the system state.
The server identity specified when enabling global security is automatically mapped to the administrative role.
You can add or remove users and groups to or from the administrative roles from the WAS administrative console. However, a server restart is required for the changes to take effect. A best practice is to map a group, rather than specific users, to administrative roles because it is more flexible and easier to administer. By mapping a group to an administrative role, adding or removing users to or from the group occurs outside of WAS and does not require a server restart for the change to take effect.
In addition to mapping users or groups, you can map a special-subject to the administrative roles. A special-subject is a generalization of a particular class of users. The AllAuthenticated special subject means that the access check of the administrative role ensures that the user making the request has at least been authenticated. The Everyone special subject means that anyone, authenticated or not, can perform the action, as if security is not enabled.
When global security is enabled, WAS runs under the server identity that is defined under the active user registry configuration. Although it is not shown on the administrative console and in other tools, a special Server subject is mapped to the administrator role. The WAS run-time code, which runs under the server identity, requires authorization to runtime operations. If no other user is assigned administrative roles, you can log into the administrative console or to the wsadmin scripting tool using the server identity to perform administrative operations and to assign other users or groups to administrative roles. Because the server identity is assigned to the administrative role by default, the administrative security policy requires the administrative role to perform the following operations:
- Change server ID and server password
- Enable or disable WAS global security
- Enforce or disable Java 2 Security
- Change the LTPA password or generate keys
- Assign users and groups to administrative roles
When enabling security, you can assign one or more users and groups to administrative roles. However, before assigning users to naming roles, configure the active user registry. User and group validation depends on the active user registry.
Naming service authorization
CosNaming security offers granular security control over the cell-wide name space, and can be implemented using either JNDI interfaces or CORBA clients.
There are four security roles available. The roles have authority levels from low to high:
- CosNamingRead
- Users can query of the WAS name space, using, for example, the JNDI lookup method. The special-subject Everyone is the default policy for this role.
- CosNamingWrite
- Users can perform write operations such as JNDI bind, rebind, or unbind, and CosNamingRead operations. The special-subject AllAuthenticated is the default policy for this role.
- CosNamingCreate
- Users can create new objects in the name space through such operations as JNDI createSubcontext and CosNamingWrite operations. The special subject AllAuthenticated is the default policy for this role.
- CosNamingDelete
- Users can destroy objects in the name space, for example using the JNDI destroySubcontext method and CosNamingCreate operations. The special-subject AllAuthenticated is the default policy for this role.
A Server special-subject is assigned to all the four CosNaming roles by default. The Server special-subject provides a WAS server process, which runs under the server identity, access to all the CosNaming operations. Note that the Server special-subject does not display and cannot be modified through the administrative console or other administrative tools.
Users, groups, or the special subjects AllAuthenticated and Everyone can be added or removed to or from the naming roles from the WAS administrative console at any time. However, a server restart is required for the changes to take effect. A best practice is to map groups or one of the special-subjects, rather than specific users, to naming roles because it is more flexible and easier to administer in the long run. By mapping a group to a naming role, adding or removing users to or from the group occurs outside of WAS and does not require a server restart for the change to take effect.
The CosNaming authorization policy is only enforced when global security is enabled. When global security is enabled, attempts to do CosNaming operations without the proper role assignment result in the exception...
org.omg.CORBA.NO_PERMISSION...from the CosNaming Server.
Typically, J2EE applications access the name space and the identity they use is that of the user that authenticated to WAS when they access the J2EE application. Unless the J2EE application provider clearly communicates the expected Naming roles, use caution when changing the default naming authorization policy.