IBM WebSphere V5.0 Security - CGISecurity

From a security point of view, each application server process may be configured
to have a local or a remote Security Server. This notion of local or remote is
relative to the application server process. Deployment Managers and Node
Agent processes always have a Security Server and are used to perform
authentication for the Deployment Manager, Node Agent, and for those
application servers that were configured to use a remote Security Server.
On some operating systems, like Unix for example, running the security server
will require the highest user priority. This is because access to the operating
system functions to perform authentication based on local operating system user
registry requires root privilege.
Many customers will not want to run application server processes with the root
privilege because this implies that all application components (like servlets) will
have this privilege. In such cases, you have to consider how to configure security
and when to place the security server before deploying an application.
9.1.3 Java Management Extension Architecture (JMX)
Java Management Extension is a set of new interfaces and Java Beans that
allows you to perform configuration and management of WebSphere Application
Server components from custom applications without using the Administrative
Console or the wsadmin program.
JMX uses Tivoli implementation scheme and provides client interface and
scripting facility that allows the use of MBeans to manage WebSphere
Application Server. It is used for overall WebSphere system management tasks.
Distributed administrative processes that run on each node have separate
administrative repository. The deployment manager that controls a group of
nodes provides the scope of visibility of the administrative processes in the cell.
This is done through node managers as described in the section above. Next is a
conceptual diagram of how JMX MBeans are used to perform different
administrative tasks.
220 IBM WebSphere V5.0 Security Handbook