Step 1: Configuring access to Rule Execution Server

You control security access to Rule Execution Server by defining users and mapping them to the predefined roles.

The standard Rule Execution Server roles and an associated default user and password are summarized in the following table. In JBoss®, passwords must have at least one digit and one non-alphanumeric symbol.

Role	Use	Default user/password
resAdministrators	Gives a user full administrator rights to: Access and use the Rule Execution Server console to populate the database schema Deploy, browse, and modify RuleApps Monitor the decision history, purge and back up the history Run diagnostics and view server information	resAdmin/resAdmin+0
resDeployers	Gives a user the rights to: Deploy, browse, and modify RuleApps Test rulesets	resDeployer/resDeployer+0
resMonitors	Gives a user the rights to: View RuleApps Monitor decision history and access Decision Center reports	resMonitor/resMonitor+0

Rule Execution Server users must be declared:

Map users to roles.
Have a registry of users from which JBoss authenticates access to Rule Execution Server, typically an LDAP.

Follow these steps to provide user access to Rule Execution Server.

Part 1: Map users to roles

You can map users to roles by editing application-roles.properties in either <JBOSS_HOME>/standalone/configuration/ or <JBOSS_HOME>/domain/configuration/ depending on your operating mode. For example, you declare a user for each of the standard roles as follows:

resAdmin=resAdministrators
resDeployer=resDeployers
resMonitor=resMonitors

You can add user/password combinations and map them to roles at the same time:

Open a command prompt in the <JBOSS_HOME>/bin directory.
Enter the script ./add-user[.sh|.bat] -a <username> <password>

Here are examples based on the users listed in the table above:

./add-user[.sh|.bat] -a -u resAdmin -p resAdmin+0 -ro "resAdministrators"
./add-user[.sh|.bat] -a -u resDeployer -p resDeployer+0 -ro "resDeployers"
./add-user[.sh|.bat] -a -u resMonitor -p resMonitor+0 -ro "resMonitors"

Part 2: Provide a registry for access

If you are using an LDAP, update the <JBOSS_HOME>/standalone/configuration/standalone-full.xml file:

In the <management> section, define your security realm, for example:

<security-realm name="ldap-security-realm">
            <authentication>
               <ldap connection="ldap-connection" base-dn="o=ibm.com" recursive="true">
                  <username-filter attribute="(&(emailAddress={0})(objectclass=person))" />
               </ldap>
            </authentication>
         </security-realm>
      </security-realms>
      <outbound-connections>
         <ldap name="ldap-connection" url="ldap://bluepages.ibm.com:389"/>
      </outbound-connections>

In the <profile> section, add the security domain for your LDAP with the option to authenticate all users to the resMonitors role, for example:

<security-domain name="LDAP" cache-type="default">
               <authentication>
                  <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
                     <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory" />
                     <module-option name="java.naming.provider.url" value="ldap://bluepages.ibm.com:389" />
                     <module-option name="baseCtxDN" value="o=ibm.com" />
                     <module-option name="baseFilter" value="(&(emailAddress={0})(objectclass=person))" />
                     <module-option name="roleFilter" value="(&(cn={0})(|(objectclass=groupOfUniqueNames)))" />
                     <module-option name="roleNameAttributeID" value="cn" />
                     <module-option name="defaultRole" value="resMonitors" />
                     <module-option name="java.naming.referral" value="follow" />
                     <module-option name="searchTimeLimit" value="100000" /> 
                     <module-option name="allowEmptyPasswords" value="false"/>
                     <module-option name="trace" value="true"/>
                     <module-option name="throwValidateError" value="true"/> 
                     <module-option name="rolesCtxDN" value="ou=memberList,ou=ibmgroups,O=IBM.COM" />
                     
                  </login-module>
               </authentication>
            </security-domain>