WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Fine-grained administrative security
Fine-grained administrative security was introduced in WebSphere Application
Server V6.1, although it was only configurable with the wsadmin command tool.
Fine-grained administrative security can grant access to each user role per
resource instance instead of granting access to all of the resources in the cell,
which allows a better separation of administrative duties.
WebSphere Application Server V7.0 includes new panels in the Integrated
Solutions Console that simplify the fine-grained administrative security
configuration.
In order for a user ID to have administrative authority, it must be assigned to one
of the following roles:
► Monitor
The Monitor role has the least permissions. This role primarily confines the
user to viewing the configuration and current state.
► Configurator
The Configurator role has the same permissions as the Monitor, and in
addition, can change the configuration.
► Operator
The Operator role has Monitor permissions and can change the runtime state.
For example, the Operator can start or stop services.
► Administrator
The Administrator role has the combined permissions of the Operator and
Configurator and the permission required to access sensitive data, including
server password, Lightweight Third Party Authentication (LTPA) password and
keys, and so on.
► ISC Admins
An individual or group that uses the ISC Admins role has Administrator
privileges for managing users and groups in the federated repositories from
within the Integrated Solutions Console only.
Note: The ISC Admins role is only available for Integrated Solutions
Console users. It is not available for wsadmin users.
► Deployer
Users granted this role can perform both configuration actions and runtime
operations on applications.
394 WebSphere Application Server V7.0: Concepts, Planning, and Design