Operating Systems: i5/OS
Personalize the table of contents and search results
Configure Tivoli Access Manager groups
Use these steps to configure the WebSphere Application Server administrative
console to add objects of the accessGroup class to the list of object classes
that represent user registry groups.
Overview
You can use the WebSphere Application Server administrative console
to specify security policies for applications that run in the WebSphere Application
Server environment. You can also use the WebSphere Application Server administrative
console to specify security policies for other Web resources, based on the
entities that are stored in the user registry.
Tivoli Access Manager adds
the accessGroup object class to the registry. Tivoli Access Manager administrators
can use the pdadmin utility, which is available only on the policy server
host in the PD.RTE fileset, to create new groups. These new groups are added
to the registry as the accessGroup object class.
The WebSphere Application
Server administrative console is not configured by default to recognize objects
of the accessGroup class as user registry groups. You can configure the WebSphere
Application Server administrative console to add this object class to the
list of object classes that represent user registry groups. To do this configuration,
complete the following instructions:
Procedure
- From the WebSphere Application Server administrative
console, access the advanced settings for configuring security by clicking Security
> Secure administration, applications, and infrastructure.
- Under User account repository, click the Available
realm definitions drop-down list, select Standalone LDAP registry,
and click Configure.
- Under Additional properties, click Advanced Lightweight Directory
Access Protocol (LDAP) user registry settings.
- Modify the Group Filter field. Add the following entry: (objectclass=accessGroup)
The Group Filter field looks like the following example:
(&(cn=%w)(|(objectclass=groupOfNames)
(objectclass=groupOfUniqueNames)
(objectclass=accessGroup)))
- Modify the Group Member ID Map field. Add the following
entry: accessGroup:member. The
Group Member ID Map field looks like the following example:
groupOfNames:member;groupOfUniqueNames:uniqueMember;
accessGroup:member
- Stop and restart WebSphere Application Server.
}
Related concepts
Role-based security with embedded Tivoli Access Manager
Related tasks
Enabling an external JACC provider
|