WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

After the profile has been created, you also have different options for the user
account repository (or user registry):
► Federated repository (including the file-based registry created for
administrative security)
► Local operating system
► Stand-alone LDAP registry
► Stand-alone custom registry
Scenarios
In order to give a better explanation of the implications if you select one of the
previous options, we describe three scenarios with different configurations to
illustrate common setups.
Scenario 1: Enable administrative security at profile creation
In this scenario, let us say that you want to enable administrative security during
the installation process. The profile creation tools create a file-based registry in
the configuration file system (profile_root/config/cells/cellname/fileRegistry.xml),
and a user ID /password combination of your choice is registered with
administrator authority. Self-signed digital certificates for servers are created in
the configuration file system automatically and LTPA is enabled.
Additional users can be added and assigned administrative roles through the
administrative tools (for example, through the Integrated Solutions Console by
navigating to Users and groups → Manage users).
So far, only administrative security has been enabled. After the profile is
complete and the application server or deployment manager is running, you can
enable application security through the administrative console or wsadmin.
You can federate the file-based registry holding the administrative security
information with another user registry of your choice.
Scenario 2: Enable security after profile creation
In this scenario, let us say that you do not enable administrative security during
the profile creation process. Anyone with access to the administrative console
port can make changes to the server or cell configuration.
After profile creation, you can enable both administrative and application security
using a user registry of your choice.
Chapter 12. Security 403