IBM WebSphere V5.0 Security - CGISecurity

the two types of registry provided by default and LocalOS is selected initially.Refer to “User registry” on page 224 for a description of WebSphere’s userregistries. For information regarding the development of a custom registry,look at 8.3, “CustomRegistry SPI” on page 183. Additional configuration isrequired for the user registry, which is documented in 10.4, “Configuring auser registry” on page 244.Note: Global Security must be enabled in order for any of the securitymechanisms to operate. Disabling Global Security has the effect of turningoff all security checks, including checks made when accessing the Adminconsole.Other configuration options on the Global Security page are as follows.► Enforce Java 2 Security: this option is disabled by default, but may beenabled by selecting this option. Refer to 8.5, “Java 2 security” on page 195for details regarding Java 2 security managers.► User Domain Qualified User IDs: if this option is enabled, user names willappear with their fully-qualified domain attribute when retrievedprogrammatically.► Cache Timeout: when the timeout is reached, the Application Server clearsthe security cache and rebuilds the security data. Since this affectsperformance, this value should not be set too low.► Issue Permission Warning: the filter.policy file contains a list of permissionsthat an application should not have according to the J2EE 1.3 Specification. Ifan application is installed with a permission specified in this policy file and thisoption is enabled, a warning will be issued.► Active Protocol: this determines which ORB-based authentication protocolsare accepted by the Application Server. Refer to 6.2, “CSIv2 and SAS” onpage 100 for a description of the CSI specification.Once Global Security is enabled, user identification must be provided to start andstop WebSphere.►►If the startServer script is started from the WebSphere service, provide theidentity in the server entry.If the startServer and stopServer scripts are started from the command linewith no additional options, the identity that the command line shell isoperating under will be used to start the server. Therefore, it is necessary toensure that this identity has the authority to start and stop WebSphere (seebelow).238 IBM WebSphere V5.0 Security Handbook