WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Scenario 3: Using a z/OS security product
In this scenario, let us say that you want to enable administrative security during
the profile creation process using a z/OS security product to manage security.
With this option, each user and group identity corresponds to a user ID or group
in the z/OS system SAF-compliant security system (IBM RACF or an equivalent
product).
Access to WebSphere Application Server roles is controlled using the SAF
EJBROLE profile, and digital certificates for SSL communication are stored in the
z/OS security product.
Summary of options to enable security at profile creation
Table 12-1 summarizes these options.
Table 12-1 Options to enable security at profile creation
Option chosen Implications
Use WebSphere Application Server to manage
user identities and the authorization policy.
404 WebSphere Application Server V7.0: Concepts, Planning, and Design
► Each WebSphere Application Server user and
group identity corresponds to an entry in a
WebSphere Application Server user registry.
The initial registry is a file-based user registry,
created during customization, and residing in
the configuration file system.
► Access to roles is controlled using WebSphere
Application Server role bindings. In particular,
administrative roles are controlled using the
Console users and groups settings in the
administrative console.
► Digital certificates for SSL communication are
stored in the configuration file system.
Do not enable security. No administrative security is configured. Anyone
with network access to the administrative console
port can make changes to the server or cell
configuration.
Use a z/OS security product to manage user
identities and authorization policy (z/OS only).
► Each WebSphere Application Server user and
group identity corresponds to a user ID or
group in the z/OS system SAF-compliant
security system (RACF or an equivalent
product).
► Access to WebSphere Application Server roles
is controlled using the SAF EJBROLE profile.
► Digital certificates for SSL communication are
stored in the z/OS security product.