IBM WebSphere V5.0 Security - CGISecurity

– Port: specify 636 which corresponds to the TCP/IP port listening for SSL
enabled LDAP queries on the remote SecureWay LDAP Directory.
– SSL Enabled: select this check box to enable SSL.
– SSL Configuration: in the drop-down list, you should see the LDAP SSL
entry we created previously; select it.
3. Click Apply.
4. Save the configuration.
5. Re-start WebSphere so that changes can be included next time.
Testing the connection
When the server starts, go to the Administrative Console; it should ask you for
the user name and password for authentication. This is because Global Security
is enabled. Give the user name and password as wasadmin (or
cn=wasadmin,o=ibm,c=us) and password as password. If you are able to log in
successfully, it means your configuration is working properly.
Disabling SecureWay anonymous LDAP searches
In a production environment, you may wish to prevent anonymous LDAP
searches of the WebSphere user space, although such searches typically only
reveal non-sensitive information about a user. The very fact that any user
information can be retrieved at all may pose a security risk.
The Netscape Address Book or Microsoft Outlook Address Book can be used to
demonstrate this argument. With a little knowledge about the remote LDAP
server, it is possible to retrieve the WebSphere authentication user registry.
10.14 JMX MBean security
Managed resources in WebSphere are represented by JMX MBeans. All these
management interfaces in WebSphere are protected by security role-based
access control. All the MBean information is defined in the MBean XML
descriptor file. This XML file is used to register these MBeans with WebSphere
MBean Server. At runtime, MBean descriptor information is processed and saved
into the ModelMBeanInfo instance.
The WebSphere administrative subsystem supports four security roles: Monitor
role, Operator role, Configurator role and Administrator role.
336 IBM WebSphere V5.0 Security Handbook