Download Safari Books Online apps: Apple iOS | Android

Entire Site

Safari Books Online

    Free Trial

    Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

    Start ReadingShareBuy Print Version
    WebSphere Application Server V7.0 Security Guide

    • WebSphere Application Server V7.0 Security Guide

    • By: Carla Sadtler; Fabio Albertoni; Leonard Blunt; Shu Guang Chen; Elisa Ferracane; Grzegorz Smolko; Joerg-Ulrich Veser; Sean Zhu

    • Publisher: IBM Redbooks

    • Pub. Date:

    • Part Number: SG24-7660-00

    • Print ISBN-10: 0-7384-3300-4

    • Print ISBN-13: 978-0-7384-3300-4

    • Pages in Print Edition: 576

    • Subscriber Rating: 0 out of 5 rating0 [0 Ratings]

    ebooken
    Subscriber Reviews • Browse Similar Topics

    Overview

    This IBM® Redbooks® publication provides the information that is needed to implement secure solutions with WebSphere® Application Server V7.0. It focuses on security for the application server and its components, including enterprise applications.

    This book includes administrative and infrastructure security, application security, and z/OS specifics.

    This book is intended for anyone who plans to secure applications and the application serving environment.

    Subscriber Reviews

    Average Rating: 0 out of 5 rating Based on 0 Ratings

    No Subscribers have provided a review for this book.

    Table of Contents

     

    View Sample
    Notices
    View Sample

    Trademarks

    View Sample
    Preface
    View Sample

    The team that wrote this book

    View Sample

    Become a published author

    View Sample

    Comments welcome

    View Sample

    Part 1. Administrative and infrastructure security

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 1. Introduction

    View Sample
    1.1. Core concepts and technologies
    View Sample

    1.1.1. Global security and security domains

    View Sample

    1.1.2. Securing the administrative environment

    View Sample

    1.1.3. Defining user registries to WebSphere

    View Sample

    1.1.4. Authenticating clients

    View Sample

    1.1.5. Authorizing access to applications

    View Sample

    1.1.6. Authorization providers

    View Sample

    1.1.7. Protecting file systems with Java 2 security

    View Sample

    1.1.8. Single sign-on

    View Sample

    1.1.9. Web services security

    View Sample

    1.1.10. Messaging security

    View Sample

    1.2. Summary of new V7 security features and changes

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 2. Administrative security
    View Sample

    2.1. Administrative security overview

    View Sample
    2.2. Enabling administrative security
    View Sample

    2.2.1. Enabling security at profile creation

    View Sample

    2.2.2. Enabling security after profile creation

    View Sample

    2.2.3. Stopping the application server

    View Sample

    2.3. Disabling administrative security

    View Sample
    2.4. Administrative roles
    View Sample

    2.4.1. Mapping users and groups to administrative roles

    View Sample

    2.4.2. Mapping a group to an administrative role

    View Sample

    2.4.3. Mapping a user to an administrative role

    View Sample
    2.5. Fine-grained administrative security
    View Sample

    2.5.1. Authorization group

    View Sample

    2.5.2. Granting fine-grained access

    View Sample

    2.5.3. Using fine-grained security: An example

    View Sample

    2.6. Job manager security

    View Sample
    2.7. Naming service security: CosNaming roles
    View Sample

    2.7.1. Mapping a user or a group to a CosNaming role

    View Sample

    2.7.2. Applying CosNaming security: An example

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 3. Using security domains

    View Sample
    3.1. Global security compared to security domains
    View Sample

    3.1.1. Attributes that can be configured in a security domain

    View Sample

    3.1.2. Configuration files

    View Sample

    3.1.3. Security domain scope

    View Sample
    3.2. Application security domain scenarios
    View Sample

    3.2.1. Scenario: Application security at the global security level

    View Sample

    3.2.2. Scenario: Security domains that override global security

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 4. Configuring the user registry and authentication settings

    View Sample
    4.1. User registry basics
    View Sample

    4.1.1. User registry types

    View Sample

    4.1.2. User registry content

    View Sample

    4.1.3. Using multiple registries with domains

    View Sample
    4.2. Configuring a stand-alone LDAP registry
    View Sample

    4.2.1. Configuration checklist

    View Sample

    4.2.2. Understanding the directory structure

    View Sample

    4.2.3. Configuring a stand-alone LDAP using the console

    View Sample

    4.2.4. Configuring a stand-alone LDAP using wsadmin commands

    View Sample

    4.2.5. Stand-alone LDAP dynamic and nested group configuration

    View Sample

    4.2.6. Stand-alone LDAP configuration defaults

    View Sample
    4.3. Federated repositories
    View Sample

    4.3.1. Configuration checklist

    View Sample

    4.3.2. Understanding user realms when using federated repositories

    View Sample

    4.3.3. VMM entity types

    View Sample

    4.3.4. Configuring an LDAP federated repository using the console

    View Sample

    4.3.5. Configuring VMM database base adapter features

    View Sample

    4.3.6. Configuring elements of federated repositories using wsadmin

    View Sample

    4.3.7. Configuring a database repository in VMM

    View Sample
    4.4. Authentication and authorization settings
    View Sample

    4.4.1. Identifying key authentication and authorization defaults

    View Sample

    4.4.2. Custom authentication choices

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 5. Secure Sockets Layer administration

    View Sample
    5.1. Secure communications using SSL
    View Sample

    5.1.1. Certificates

    View Sample

    5.1.2. Keystores and truststores

    View Sample

    5.1.3. SSL configurations

    View Sample
    5.2. Basic usage scenarios
    View Sample

    5.2.1. Securing administrative communication

    View Sample

    5.2.2. Securing LDAP communication

    View Sample

    5.2.3. Securing Web inbound and outbound communication

    View Sample

    5.2.4. Securing EJB inbound and outbound communication

    View Sample

    5.2.5. Securing communication with WebSphere MQ

    View Sample
    5.3. Basic SSL administration
    View Sample

    5.3.1. Creating keystores

    View Sample

    5.3.2. Managing personal certificates

    View Sample

    5.3.3. Managing signer certificates

    View Sample

    5.3.4. Recovering deleted certificates

    View Sample

    5.3.5. Certificate expiration monitoring

    View Sample

    5.3.6. Managing SSL configurations

    View Sample

    5.3.7. Creating SSL configurations

    View Sample
    5.4. Advanced concepts
    View Sample

    5.4.1. Changing default chained certificates

    View Sample

    5.4.2. Creating and defining a CA client

    View Sample

    5.4.3. SSL isolation

    View Sample
    5.5. SSL troubleshooting and traces
    View Sample

    5.5.1. Diagnostic steps

    View Sample

    5.5.2. SSL traces

    View Sample
    5.6. Implementation examples
    View Sample

    5.6.1. Securing LDAP communication

    View Sample

    5.6.2. Securing Web inbound communication

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 6. Common Secure Interoperability Version 2 administration
    View Sample

    6.1. Overview of CSIv2

    View Sample

    6.2. The CSIv2 authentication protocol

    View Sample
    6.3. Features of CSIv2
    View Sample

    6.3.1. Three layers for authentication

    View Sample

    6.3.2. Identity assertion and identity mapping

    View Sample

    6.3.3. Security attribute propagation

    View Sample

    6.3.4. Error handling

    View Sample

    6.3.5. Stateful and stateless sessions

    View Sample
    6.4. Configuring CSIv2
    View Sample

    6.4.1. Configuring CSIv2 on a server

    View Sample

    6.4.2. Configuring CSIv2 on a stand-alone client

    View Sample

    6.4.3. CSIv2 considerations in special scenarios

    View Sample
    6.5. Troubleshooting CSIv2
    View Sample

    6.5.1. Identifying a CSIv2 problem

    View Sample

    6.5.2. Approach to debugging a CSIv2 problem

    View Sample

    6.5.3. Enabling trace for CSIv2

    View Sample

    6.5.4. Case studies of CSIv2 problems

    View Sample

    6.6. References

    View Sample

    Part 2. Application security

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 7. Application security

    View Sample
    7.1. Application security design considerations
    View Sample

    7.1.1. Programmatic and declarative security

    View Sample
    7.2. Deploying a secured enterprise application
    View Sample

    7.2.1. Mapping modules to servers filtered by security domains

    View Sample

    7.2.2. Role mapping during application installation

    View Sample

    7.2.3. Run-As role mappings

    View Sample

    7.2.4. Unprotected 2.x methods

    View Sample

    7.2.5. Mapping roles at assembly compared to deployment

    View Sample

    7.3. Role mapping after installation

    View Sample

    7.4. Mapping roles in the development environment

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 8. Securing a Web application
    View Sample

    8.1. Application security

    View Sample
    8.2. Declarative security
    View Sample

    8.2.1. Defining security roles for an application

    View Sample

    8.2.2. Defining security constraints

    View Sample
    8.3. Programmatic security
    View Sample

    8.3.1. JEE security API

    View Sample

    8.3.2. Defining security role references in the deployment descriptor

    View Sample

    8.3.3. Defining security roles using annotations

    View Sample
    8.4. Delegation
    View Sample

    8.4.1. Delegation using a deployment descriptor

    View Sample

    8.4.2. Delegation using annotation

    View Sample

    8.4.3. Annotation usage considerations

    View Sample

    8.5. Authentication mechanisms

    View Sample
    8.6. Configuring form-based authentication
    View Sample

    8.6.1. Building the login page

    View Sample

    8.6.2. Getting the login exception details

    View Sample

    8.6.3. Logout

    View Sample
    8.7. Configuring client certificate authentication
    View Sample

    8.7.1. Application configuration

    View Sample

    8.7.2. Application server configuration

    View Sample

    8.7.3. Web server configuration

    View Sample

    8.7.4. Browser configuration

    View Sample

    8.8. Customizing the login process

    View Sample
    8.9. Other security-related application settings
    View Sample

    8.9.1. Web application extensions

    View Sample

    8.9.2. Session security integration

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 9. Securing an Enterprise JavaBeans application
    View Sample

    9.1. Application security

    View Sample

    9.2. Security mechanisms

    View Sample

    9.3. JEE Security policies: Annotations and XML descriptors

    View Sample
    9.4. Declarative security
    View Sample

    9.4.1. Protecting beans using annotations

    View Sample

    9.4.2. Protecting beans using the deployment descriptor

    View Sample
    9.5. Programmatic security
    View Sample

    9.5.1. Security API

    View Sample
    9.6. Delegation
    View Sample

    9.6.1. Bean-level delegation

    View Sample

    9.6.2. Method-level delegation

    View Sample
    9.7. Java Authentication and Authorization Service
    View Sample

    9.7.1. WSSubject API

    View Sample

    9.8. Using annotations

    View Sample

    Part 3. z/OS specifics

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 10. WebSphere z/OS and local operating system security
    View Sample

    10.1. Local operating system (LocalOS) security

    View Sample

    10.2. User ID strategy for a Network Deployment environment

    View Sample
    10.3. Administrative security
    View Sample

    10.3.1. Common groups and user IDs

    View Sample

    10.3.2. Security configuration options

    View Sample

    10.3.3. z/OS security product options

    View Sample
    10.4. RACF jobs for WebSphere z/OS
    View Sample

    10.4.1. RACF classes

    View Sample

    10.4.2. Skeleton of the generated RACF jobs

    View Sample
    10.5. System Authorization Facility authorization
    View Sample

    10.5.1. SAF authorization for administrative roles

    View Sample

    10.5.2. SAF authorization for applications

    View Sample

    10.5.3. Displaying EJBROLE profiles

    View Sample

    10.5.4. SAF EJB role mapper

    View Sample
    10.6. Generic RACF profiles (best practices)
    View Sample

    10.6.1. Generic RACF profiles using wildcards

    View Sample

    10.6.2. Creating a new server with the administrative console

    View Sample

    10.7. Case-sensitive passwords for RACF

    View Sample

    10.8. Fine-grained security

    View Sample
    10.9. Naming service security
    View Sample

    10.9.1. CosNaming roles

    View Sample

    10.9.2. Mapping users or groups to CosNaming roles

    View Sample
    Download ChapterDownload Chapter
    0 Tokens    Chapter 11. Administrative security
    View Sample

    11.1. Selecting an authorization provider

    View Sample

    11.2. Enabling security with a SAF user repository

    View Sample

    11.3. Disabling administrative security

    View Sample

    11.4. Security trace

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 12. WebSphere z/OS and user registries

    View Sample
    12.1. Introduction to user registries
    View Sample

    12.1.1. Local operating system registry

    View Sample

    12.1.2. Stand-alone Lightweight Directory Access Protocol registry

    View Sample

    12.1.3. Stand-alone custom registry

    View Sample

    12.1.4. Federated repositories

    View Sample

    12.2. Our scenario and our environment

    View Sample
    12.3. Stand-alone LDAP registry
    View Sample

    12.3.1. WebSphere and z/OS LDAP SDBM back end (RACF)

    View Sample

    12.3.2. WebSphere and z/OS LDAP TDBM back end (DB2)

    View Sample

    12.3.3. WebSphere and z/OS LDAP TDBM native authentication

    View Sample
    12.4. Federated repositories
    View Sample

    12.4.1. Federated repositories

    View Sample

    12.4.2. Our federated repositories scenario

    View Sample

    12.4.3. Federated z/OS LDAP with TDBM back end (DB2)

    View Sample

    12.4.4. Federated z/OS LDAP TDBM native authentication

    View Sample

    12.4.5. Federated IBM Tivoli Directory Server

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 13. Implementing Secure Sockets Layer in WebSphere for z/OS

    View Sample
    13.1. Keyrings and certificates in RACF
    View Sample

    13.1.1. Certificates

    View Sample

    13.1.2. Keyrings

    View Sample

    13.1.3. Building a trust chain with WebSphere for z/OS

    View Sample

    13.1.4. Establishing SSL connections in an secured environment

    View Sample

    13.2. Centrally managed SSL

    View Sample

    13.3. WebSphere V7 for z/OS SSSL to JSSE changes

    View Sample
    13.4. Writable SAF keyrings
    View Sample

    13.4.1. Prerequisites for writable keyring support

    View Sample

    13.4.2. Integration into the administrative console

    View Sample

    13.4.3. Importing personal certificates

    View Sample

    13.4.4. Exporting personal certificates

    View Sample

    13.4.5. Creating personal certificates

    View Sample

    13.4.6. Removing certificates from a keyring

    View Sample

    13.4.7. Renewing certificates

    View Sample

    13.4.8. Exporting public certificates

    View Sample

    13.4.9. Common error messages

    View Sample
    13.5. RACF certificate management
    View Sample

    13.5.1. Monitoring certificate expiration

    View Sample

    13.5.2. Importing certificates

    View Sample

    13.5.3. Exporting certificates

    View Sample

    13.5.4. Deleting certificates and keyrings

    View Sample
    13.6. Hardware cryptography and Java cryptography providers
    View Sample

    13.6.1. Choosing a JCE provider

    View Sample

    13.6.2. Administrative console keystore types

    View Sample

    13.6.3. IBMJCECCA and IBMJCE characteristics

    View Sample

    13.6.4. SSL and JCERACFKS keystore

    View Sample

    13.6.5. Hardware cryptography using a JCECCARACFKS keystore

    View Sample
    13.7. SSL troubleshooting and traces
    View Sample

    13.7.1. Diagnostic steps

    View Sample

    13.7.2. SSL traces

    View Sample

    13.7.3. Common errors

    View Sample

    Download ChapterDownload Chapter
    0 Tokens    Chapter 14. Security identity propagation

    View Sample
    14.1. Sync-to-Thread Allowed and RunAs thread identity
    View Sample

    14.1.1. Required RACF profiles for Sync-to-Thread

    View Sample

    14.1.2. Sync-to-Thread example

    View Sample

    14.1.3. SAF delegation

    View Sample

    14.2. Propagating user credentials to DB2 using JDBC Type 2 driver

    View Sample
    14.3. Propagating credentials to CICS
    View Sample

    14.3.1. Application-related settings

    View Sample

    14.3.2. Required RACF profiles

    View Sample
    Related publications
    View Sample

    IBM Redbooks publications

    View Sample

    Online resources

    View Sample

    How to get IBM Redbooks publications

    View Sample

    Help from IBM

    View Sample

    Back cover