Use this topic to enable IBM WebSphere Application Server security.
You must enable administrative security for all
other security settings to function.
WebSphere Application Server uses cryptography to protect sensitive
data and to ensure confidentiality and integrity of communications between
WebSphere Application Server and other components in the network. Cryptography
is also used by Web services security when certain security constraints are
configured for the Web Services application.
- Enable administrative
security in WebSphere Application Server.
For more information,
see Enabling security.
It is important to click Security > Secure administration, applications,
and infrastructure. Select an available realm definition from the list,
and then click Set as current. Save the configuration to the repository.
Verify that the validation that occurs after you click OK on the Security
> Secure administration, applications, and infrastructure panel is successful
before continuing. If the validation is not successful and you continue with
these steps, you risk the server not starting. Re-configure the security settings
until validation is successful.
- Send a copy of the new configuration
to all of the running node agents using the administrative console.
If a node agent fails to get the security-enabled configuration, communication
with the deployment manager fails, due to a lack of access. The node agent
is not security-enabled. To force synchronize a specific node, complete the
following steps from the administrative console:
- Click System administration > Nodes and select the option
next to all the nodes. You do not need to select the deployment manager node.
- Click Full resynchronize to verify that the file synchronization
has occurred. The message might indicate that the nodes already
are synchronized. This message is OK. When synchronization is initiated, verify
that the Synchronized status displays for all nodes.
- Stop the deployment manager. Manually
restart the deployment manager from the command line or service. To
stop the deployment manager, click System administration > Deployment manager and
click Stop. This action logs you out of the administrative console
and stops the deployment manager process.
- Restart the deployment manager
process.
- Restart the
deployment manager process. To restart the deployment manager process,
open the Qshell environment and locate the app_server_root/bin directory.
The app_server_root variable refers to the app_server_root/bin/ default
directory. On the Qshell command line, type startManager.
After
the deployment manager initialization is complete, go back into the administrative
console to complete this task. Remember that security now is enabled in only
the deployment manager. If you enabled single sign-on (SSO), specify the fully
qualified domain name of your Web address, for example, http://myhost.domain:port_number/ibm/console.
When you are prompted for a user ID and password, type the one that you defined
as the administrator ID in the configured user registry.
- If the deployment manager does
not start after enabling security, disable security using a script and restart.
Disable security by issuing the following command from the DeploymentManager/bin directory:
./wsadmin.sh -conntype NONE
At the prompt, enter securityoff.
- Restart all node agents to make
them security enabled. You must have restarted the deployment manager
in a previous step before completing this step. If the node agent is security-enabled
before the deployment manager is security-enabled, the deployment manager
cannot query the node agent for status or give the node agent commands. To
stop all node agents, complete the following steps:
- Go to System administration > Node agents and select
the option beside all node agents. Click Restart. A message similar
to the following example is displayed at the top of the panel: The node
agent on node NODE NAME was restarted successfully.
- Alternatively, if you previously did not stop your application
servers, restart all of the servers within any given node by clicking System
administration > Node agents and by clicking the node agents where you
want to restart all the servers. Click Restart all Servers on Node.
This action restarts the node agent and any started application servers.
- If any node agent fails to restart,
perform a manual resynchronization of the configuration. This
step consists of going to the physical node and running the client syncNode command.
This client logs into the deployment manager and copies all of the configuration
files to the node agent. This action ensures that the configuration is security-enabled.
If the node agent is started, but is not communicating with the deployment
manager, stop the node agent by issuing the stopServer command.