Security configuration properties

• For a list of IBM Business Process Manager specific properties, see Table 1.
• For a list of Process Admin Console specific properties, see Table 2.

• Get the deployment environment:

  wsadmin>deIds = AdminUtilities.convertToList(AdminConfig.getid ('/Cell:/BPMCellC
  onfigExtension:/BPMDeploymentEnvironment:/'))
  wsadmin>deIds
  ['De1(cells/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366695378330)', 'De2(ce
  lls/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366696771995)']
  wsadmin>AdminConfig.showAttribute(deIds[0], 'name')
  'De1'
  wsadmin>AdminConfig.showAttribute(deIds[1], 'name')
  'De2'

• Get the cluster with the correct capability:

  wsadmin>clusterPath = "/Cell:<cellName>/BPMCellConfigExtension:/BPMDeploymentEnvironm
  ent:%s/BPMCluster:/" % "<De_name>"
  wsadmin>clusterId = AdminUtilities.convertToList(AdminConfig.getid (clusterPath)
  )
  wsadmin>capabilities1 = AdminUtilities.convertToList(AdminConfig.showAttribute(cl
  usterId[0], 'capabilities'))
  wsadmin>capabilities1
  ['Application']
  wsadmin>capabilities2 = AdminUtilities.convertToList(AdminConfig.showAttribute(cl
  usterId[1], 'capabilities'))
  wsadmin>capabilities2
  ['Messaging']
  wsadmin>capabilities3 = AdminUtilities.convertToList(AdminConfig.showAttribute(cl
  usterId[2], 'capabilities'))
  wsadmin>capabilities3
  ['Support']

• List objects of a given type:
  Note: For each of the properties, refer to Table 1 for the configuration object, including the configuration object containment path. For example:

  wsadmin>path = "/ServerCluster:<clusterName>/BPMClusterConfigExtension:/BPMProce
  ssServer:/BPMServerSecurity:/"
  wsadmin>b = AdminConfig.getid(path)
  wsadmin>b
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurity_136669566
  2779)'

• Show attributes of an object with values (nested objects are listed using their configuration ID):

  wsadmin>print AdminConfig.show(b)
  [deploySnapshotUsingHttps false]
  [externalUserQueryLimit 100]
  [ldapOptions [twUserNameAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm
  .xml#BPMLdapOption_1366695662779) twUserDescriptionAttribute(cells/Cell1/cluster
  s/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662780) twGroupNameAttribut
  e(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662781
  ) twGroupDescriptionAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml
  #BPMLdapOption_1366695662782)]]
  [securityGroups (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSec
  urityGroups_1366695662779)]
  [securityUsers (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecu
  rityUsers_1366695662779)]
  [wildcardProcessingOptimized false]

• Show all attributes of an object with values (nested objects are listed):

  wsadmin>print AdminConfig.showall(b)
  [deploySnapshotUsingHttps false]
  [externalUserQueryLimit 100]
  [ldapOptions [[[name twUserNameAttribute]
  [value sAMAccountName]] [[name twUserDescriptionAttribute]
  [value description]] [[name twGroupNameAttribute]
  [value cn]] [[name twGroupDescriptionAttribute]
  [value description]]]]
  [securityGroups [[bpmAdminGroup tw_admins]
  [bpmAuthorGroup tw_authors]
  [collaborationAdmin tw_admins]
  [debug Debug]
  [offlineInstall []]
  [processHelpAccess tw_admins]
  [showXmlMetadata Debug]]]
  [securityUsers [[notifyError bpmadmin2]
  [userToCloseTask bpmadmin2]
  [userToCreateTask bpmadmin2]]]
  [wildcardProcessingOptimized false]

• Show the value of a particular attribute:

  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  100

• Modify the value for a property:
  Note: You must run the AdminConfig.save command each time a property is modified for the configuration changes to be saved.

  wsadmin>AdminConfig.modify(b,[['externalUserQueryLimit', '150']])
  ''
  wsadmin>AdminConfig.save()
  ''
  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  150

• Get the console element:

  wsadmin>consoleElements = AdminUtilities.convertToList(AdminConfig.getid ("/BPMC
  onsoleElement:/"))
  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[0]), 'name')
  wsadmin>elementName
  'console.admin.tools'

• Get the configuration IDs of the constraint object for this console element:

  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[4]), 'name')
  wsadmin>elementName
  'console.bulk.user.attribute.assignment'

• Use the configuration ID to locate the current value for the property:

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constra
  ints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_136669
  5662782)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMCo
  nsoleConstraint_1366695662782)"
  wsadmin>val = AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>val
  'tw_admins'

• Add a constraint:

  wsadmin>AdminConfig.create('BPMConsoleConstraint', consoleElements[4], [['type'
  , 'role'],['value', 'admins']])
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_136739
  4007068)'
  wsadmin>AdminConfig.save()
  ''

• Remove a constraint:
  Tip: Iterate through the returned list of constraints using the index.

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constra
  ints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_136669
  5662782) (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstrain
  t_1367394007068)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMCo
  nsoleConstraint_1366695662782)"
  wsadmin>constraint2 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMCo
  nsoleConstraint_1367394007068)"
  wsadmin>val1= AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>val2= AdminConfig.showAttribute(constraint2, 'value')
  wsadmin>val1
  'tw_admins'
  wsadmin>val2
  'admins'
  wsadmin>AdminConfig.remove(constraint2)
  wsamdin>AdminConfig.save()

Usage: Use this script to get/modify the configured security properties.
          -E|--de DE_name -option')
                          -g|--get property_name')
                          -s|--set property_name , new_value')
                          -a|--add console_property_name , constraint_value')
                                |action_policy_name , role to be added')
                          -r|--remove console_property_name , constraint_value')
                                |action_policy_name , role to be removed')

• Get the value of the external user query limit:

  INSTALL_HOME\bin>wsadmin -conntype NONE -lang jython -f <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -g externalUserQueryLimit
  
  WASX7357I: By request, this scripting client is not connected to any server proc
  ess. Certain configuration and application operations will be available in local
   mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -g, ext
  ernalUserQueryLimit]"
  
  Current value for property externalUserQueryLimit in DE De1 is:
  99

• Get the value of an action policy:

  INSTALL_ROOT\bin>wsadmin -conntype NONE -lang jython -f <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -g ACTION_ABORT_INSTANCE
  WASX7357I: By request, this scripting client is not connected to any server proc
  ess. Certain configuration and application operations will be available in local
   mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -g, ACT
  ION_ABORT_INSTANCE]"
  
  Current value for property ACTION_ABORT_INSTANCE in DE De1 is:
  tw_admins

• Modify an existing value:
  Note: Any of the security properties listed in Table 2 can be modified as shown below.
  • Set the value of the external user query limit:

    INSTALL_HOME\bin>wsadmin -conntype NONE -lang jython -f <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -s externalUserQueryLimit,100
    WASX7357I: By request, this scripting client is not connected to any server proc
    ess. Certain configuration and application operations will be available in local
     mode.
    WASX7303I: The following options are passed to the scripting environment and are
     available as arguments that are stored in the argv variable: "[-E, De1, -s, ext
    ernalUserQueryLimit,100]"
    
    Current value for property externalUserQueryLimit in DE De1 is:
    99
    
    INFO : The given value for the property was set successfully.
    
    Current value for property externalUserQueryLimit in DE De1 is:
    100

  • Add a role to an action policy:

    INSTALL_HOME\bin>wsadmin -conntype NONE -lang jython -f <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name > -s ACTION_ABORT_INSTANCE,admins
    WASX7357I: By request, this scripting client is not connected to any server proc
    ess. Certain configuration and application operations will be available in local
     mode.
    WASX7303I: The following options are passed to the scripting environment and are
     available as arguments that are stored in the argv variable: "[-E, De1, -a, ACT
    ION_ABORT_INSTANCE,admins]"
    
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:
    tw_admins
    
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:
    tw_admins;admins

• Add a constraint to a console property:

  INSTALL_HOME\bin>wsadmin -conntype NONE -lang jython -f <install-root>/util/Security/BPMSecurityConfig_sample.py -D <de_name> -a console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server proc
  ess. Certain configuration and application operations will be available in local
   mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -a, con
  sole.monitor,admins]"
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  
  INFO : The given value for the property was set successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins

• Remove a constraint from a console property:

  INSTALL_HOME\bin>wsadmin -conntype NONE -lang jython -f BPMSecurityConfig_sample.py -r console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server proc
  ess. Certain configuration and application operations will be available in local
   mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -r, con
  sole.monitor,admins]"
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins
  
  The given constraint was removed successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors