WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Note: Be aware that some configuration options are only available as global
security settings and cannot be configured in a domain, although they can be
used by multiple domains:
► Federated repositories
► JACC
The global security configuration applies to all administrative functions, naming
resources, and Mbeans, and is the default security configuration for user
applications. Each security domain has to be associated with a scope (cell, or
specific clusters, servers and service integration buses) where it will be applied.
The attributes that can be configured at the domain level are as follows:
► Application security
► Java security
► User realm (registry)
► Trust association
► SPNEGO Web authentication
► RMI/IIOP security (CSIv2)
► JAAS logins (application, system and J2C authentication data)
► Authentication mechanism attributes
► Authorization provider
► Custom properties
You do not need to configure all the attributes. Those not defined in the domain
are obtained from the global configuration. When planning for security, you have
to determine whether you need different security attributes for your servers or if
they can use the global configuration settings. For example, you may want to use
various user registries if you have different sets of users that can not be mixed
(for instance, when the responsibility for user administration of each registry falls
on different teams).
Note: We suggest using at least one security domain, at cell scope, in order to
separate administrative users from application users.
If you plan to use a security domain for a special application with stringent
security requirements, this application should be deployed in a dedicated server
or cluster. The scope of the domain should include only the server(s) or cluster(s)
where the application is deployed.
Note: Deploying an application in more than one server with different security
domains may lead to inconsistent behavior.
400 WebSphere Application Server V7.0: Concepts, Planning, and Design