WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

WebSphere Application Server provides a default audit service provider and
event factory 2 , but you can change them if you have special needs. For instance,
you could configure a third-party audit service provider to record the generated
events to a different repository.
12.3 Security configuration considerations
When planning for security, it is important to keep in mind the difference between
administrative security and application security from the WebSphere perspective:
► Administrative security protects the cell from unauthorized modification.
► Application security enables security for the applications in your environment.
This type of security provides application isolation and requirements for
authenticating application users.
In previous releases of WebSphere Application Server, when a user enabled
global security, both administrative and application security were enabled. Since
WebSphere Application Server V6.1, these security functions can be enabled
separately. Administrative security can be enabled during profile creation. The
default is for administrative security to be enabled. Application security is
disabled, by default, and must be enabled after profile creation using the
administrative tools. To enable application security, you must also enable
administrative security.
When a new application server profile or deployment manager profile is created,
you have the following options for administrative security:
► Use WebSphere Application Server to manage user identities and the
authorization policy (file-based repository).
► Do not enable security.
► Use a z/OS security product to manage user identities and authorization
policy (z/OS only).
The default authentication mechanism is LTPA, but when Kerberos is included in
the product, you can select Kerberos and LTPA later.
2 The audit service provider formats and records audit events. The event factory collects the data
associated to the auditable security events and sends it to the audit service provider.
402 WebSphere Application Server V7.0: Concepts, Planning, and Design