安全配置属性

• 有关特定于 IBM Business Process Manager 的属性的列表，请参阅表 1。
• 有关特定于 Process Admin Console 的属性的列表，请参阅表 2。

• 获取部署环境：

  wsadmin>deIds = AdminUtilities.convertToList(AdminConfig.getid ('/Cell:/BPMCellConfigExtension:/BPMDeploymentEnvironment:/'))
  wsadmin>deIds['De1(cells/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366695378330)', 'De2
  (cells/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366696771995)']
  wsadmin>AdminConfig.showAttribute(deIds[0], 'name')'De1'
  wsadmin>AdminConfig.showAttribute(deIds[1], 'name')'De2'

• 获取带有正确功能的集群：

  wsadmin>clusterPath = "/Cell:<cellName>/BPMCellConfigExtension:/BPMDeploymentEnvironment:%s/BPMCluster:/" % "<De_name>"
  wsadmin>clusterId = AdminUtilities.convertToList(AdminConfig.getid (clusterPath))
  wsadmin>capabilities1 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[0], 'capabilities'))
  wsadmin>capabilities1['Application']
  wsadmin>capabilities2 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[1], 'capabilities'))
  wsadmin>capabilities2['Messaging']
  wsadmin>capabilities3 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[2], 'capabilities'))
  wsadmin>capabilities3['Support']

• 列示给定类型的对象：
  注： 对于每个属性，请参阅表 1 以了解配置对象，包括配置对象包含路径。例如：

  wsadmin>path = "/ServerCluster:<clusterName>/BPMClusterConfigExtension:/BPMProcessServer:/BPMServerSecurity:/"
  wsadmin>b = AdminConfig.getid(path)
  wsadmin>b
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurity_1366695662779)'

• 显示具有值的对象属性（嵌套对象通过其配置标识进行列示）：

  wsadmin>print AdminConfig.show(b)
  [deploySnapshotUsingHttps false][externalUserQueryLimit 100][ldapOptions 
      [twUserNameAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662779) 
      twUserDescriptionAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662780) 
      twGroupNameAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662781) 
      twGroupDescriptionAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662782)]]
      [securityGroups (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurityGroups_1366695662779)]
      [securityUsers (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurityUsers_1366695662779)]
      [wildcardProcessingOptimized false]

• 显示具有值的所有对象属性（已列示嵌套对象）：

  wsadmin>print AdminConfig.showall(b)
  [deploySnapshotUsingHttps false]
  [externalUserQueryLimit 100]
  [ldapOptions [[[name twUserNameAttribute]
  [value sAMAccountName]] [[name twUserDescriptionAttribute]
  [value description]] [[name twGroupNameAttribute]
  [value cn]] [[name twGroupDescriptionAttribute]
  [value description]]]]
  [securityGroups [[bpmAdminGroup tw_admins]
  [bpmAuthorGroup tw_authors]
  [collaborationAdmin tw_admins]
  [debug Debug]
  [offlineInstall []]
  [processHelpAccess tw_admins]
  [showXmlMetadata Debug]]]
  [securityUsers [[notifyError bpmadmin2]
  [userToCloseTask bpmadmin2]
  [userToCreateTask bpmadmin2]]]
  [wildcardProcessingOptimized false]

• 显示特殊属性的值：

  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  100  

• 修改属性的值：
  注： 每次针对要保存的配置变更来修改属性时都必须运行 AdminConfig.save 命令。

  wsadmin>AdminConfig.modify(b,[['externalUserQueryLimit', '150']])''
  wsadmin>AdminConfig.save()''
  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  150

• 获取控制台元素：

  wsadmin>consoleElements = AdminUtilities.convertToList(AdminConfig.getid ("/BPMConsoleElement:/"))
  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[0]), 'name')
  wsadmin>print elementName
  'console.admin.tools'

• 获取此控制台元素的约束对象的配置标识：

  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[4]), 'name')
  wsadmin>print elementName
  'console.bulk.user.attribute.assignment'

• 使用配置标识来查找属性的当前值：

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constraints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)"
  wsadmin>val = AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>print val
  'tw_admins'

• 添加约束：

  wsadmin>AdminConfig.create('BPMConsoleConstraint', consoleElements[4], [['type', 'role'],['value', 'admins']])
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)'
  wsadmin>AdminConfig.save()''

• 除去约束：
  提示： 使用索引迭代所返回的约束列表。

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constraints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782) 
  (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)"
  wsadmin>constraint2 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)"
  wsadmin>val1= AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>val2= AdminConfig.showAttribute(constraint2, 'value')
  wsadmin>print val1
  'tw_admins'
  wsadmin>print val2
  'admins'
  wsadmin>AdminConfig.remove(constraint2)
  wsamdin>AdminConfig.save()

用法：使用该脚本来获取/修改已配置的安全属性。
          -E|--de DE_name -option')
                          -g|--get property_name')
                          -s|--set property_name , new_value')
                          -a|--add console_property_name , constraint_value')
                                |action_policy_name , role to be added')
                          -r|--remove console_property_name , constraint_value')
                                |action_policy_name , role to be removed')

• 获取外部用户查询限制的值：

  install_root\bin>wsadmin -conntype NONE -f <install-root>/util/Security/BPMSecurityConfig_sample.py 
  -E <de_name> -g externalUserQueryLimit
  
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available 
  as arguments that are stored in the argv variable: "[-E, De1, -g, externalUserQueryLimit]"
  Current value for property externalUserQueryLimit in DE De1 is:99

• 获取操作策略的值：

  INSTALL_ROOT\bin>wsadmin -conntype NONE -f 
  <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -g ACTION_ABORT_INSTANCE
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -g, ACTION_ABORT_INSTANCE]"
  Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins

• 修改现有值：
  注： 列示在表 2中的所有安全属性都可按如下所示进行修改。
  • 设置外部用户查询限制的值：

    install_root\bin>wsadmin -conntype NONE -f 
    <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -s externalUserQueryLimit,100
    WASX7357I: By request, this scripting client is not connected to any server process. 
    Certain configuration and application operations will be available in local mode.
    WASX7303I: The following options are passed to the scripting environment and are
    available as arguments that are stored in the argv variable: "[-E, De1, -s, externalUserQueryLimit,100]"
    Current value for property externalUserQueryLimit in DE De1 is:99
    INFO : The given value for the property was set successfully.
    Current value for property externalUserQueryLimit in DE De1 is:100

  • 将角色添加到操作策略：

    install_root\bin>wsadmin -conntype NONE -f <install-root>/util/Security/BPMSecurityConfig_sample.py 
        -E <de_name > -s ACTION_ABORT_INSTANCE,adminsWASX7357I: 
    By request, this scripting client is not connected to any server process. Certain configuration and application operations will be available in local mode.
    WASX7303I: The following options are passed to the scripting environment and are available 
    as arguments that are stored in the argv variable: "[-E, De1, -a, ACTION_ABORT_INSTANCE,admins]"
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins;admins

• 为控制台属性添加约束：

  install_root\bin>wsadmin -conntype NONE -f 
  <install-root>/util/Security/BPMSecurityConfig_sample.py -D <de_name> -a console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available as arguments 
  that are stored in the argv variable: "[-E, De1, -a, console.monitor,admins]"
  Current value for property console.monitor in DE De1 is:constraint 0 : tw_admins
  constraint 1 : tw_authors
  
  INFO : The given value for the property was set successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins

• 除去控制台属性的约束：

  install_root\bin>wsadmin -conntype NONE -f BPMSecurityConfig_sample.py -r console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available 
  as arguments that are stored in the argv variable: "[-E, De1, -r, console.monitor,admins]"
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins
  
  The given constraint was removed successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors

• 使用 suppressRedirectUrlPasswd 选项可禁止在 Process Designer 打开的 URL 中包含用户密码。例如，每次在 Process Designer 中运行回放时，都会打开一个新的 Process Portal 浏览器会话。Process Designer 随后会提交用户凭证（包含用户标识和密码），并且浏览器会话会使用这些凭证进行登录。suppressRedirectUrlPasswd 选项可防止将密码包含在 URL 中以提高安全性。
  注： 当使用 suppressRedirectUrlPasswd 选项时，您只需在 Process Designer 中首次打开 Web 可编辑工件或运行回放时登录到浏览器。该选项仅适用于 Process Designer，并可根据需要来开启和关闭。
  下面显示了使用 Jython 的示例：

  dmgr_profile_root>wsadmin.bat -connType NONE
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7031I: For help, enter: "print Help.help()"wsadmin>path='/ServerCluster:AppCluster/BPMClusterConfigExtension:/BPMAuthoringEnvironment:/'
  wsadmin>b=AdminConfig.getid(path)
  wsadmin>b
  '(cells/PCCell1/clusters/AppCluster|cluster-bpm.xml#BPMAuthoringEnvironment_1376890854832)'
  wsadmin>AdminConfig.modify(b,[['suppressRedirectUrlPasswd','true']])
  wsadmin>AdminConfig.save()