Friday, October 05, 2007

WAS 6.1/RSA 7.0 File-based Authentication

To enable file-based authentication,
  1. start up WAS 6.1 in RSA 7.0
  2. run administrative console
  3. security > secure administration, applications, and infrastructure
  4. check on "Enable administrative security"
  5. check on "Enable application security" (might be checked on automatically when check on "Enable administrative security")
  6. check off "Use Java 2 security to restrict ..." (if on, be ready to define web resource and beans and roles)
  7. select "Standalone custom registry" from the "Available realm definitions"
  8. click on "Set as current"
  9. click on "Configuration", the "Standalone custom registry" page will be shown
  10. click on "Custom properties"
  11. add two properties, usersFile ${USER_INSTALL_ROOT}/File-based_JACC/users.props, groupsFile $USER_INSTALL_ROOT}/File-based_JACC/groups.props
  12. in Windows explorer, go to folder \runtimes\base_v61\profiles\AppSrv01, e.g. C:\Program Files\IBM\SDP70\runtimes\base_v61\profiles\AppSrv01, and create a new folder "File-based_JACC"
  13. under the newly created folder, create two files, users.props and groups.props,
  14. in users.props, add entry "wsadmin:password:100:100:Administrator"
  15. in groups.props, add entry "admins:100:wsadmin:Administrative group"
  16. go back to "Standalone custom registry" page in the administrative console
  17. enter "wsadmin" into "Primary administrative user name"
  18. select "Automatically generated server identity"
  19. make sure the "Custom registry class name" is "com.ibm.websphere.security.FileRegistrySample" (shall be by default)
  20. click on "OK" and click on "Save" if asked
  21. click on "Apply" and click on "Save" if asked
  22. right click on the "WebSphere Application Server v6.1" in "Servers" view and select "Open"
  23. expand "Security" and check on "Security is enabled on this server"
  24. enter "wsadmin" in "User ID" and "password" in "Password"
  25. save changes made to the server
  26. restart the server, the server should be ready to use file-based authentication.

No comments: