Security configuration properties

You can modify the following properties by replacing the previous values, except for properties in the BPMActionPolicy configuration objects. For BPMActionPolicy properties, you do not modify existing values: instead, you add and remove roles.

You can control the navigator entries that are displayed for specific users in the Process Admin Console by configuring the BPMConsoleSection configuration object. Note that you do not control who is authorized to use the functionality. For example, the ability to create an internal group requires a user to be a member of the bpmAdminGroup (which defaults to tw_admins). For BPMConsoleSection properties, you do not modify existing values: instead, you add and remove constraints.

You can use the wsadmin AdminConfig object commands to access and modify security properties. For a list of AdminConfig commands that WebSphere Application Server provides, see Commands for the AdminConfig object using wsadmin scripting.

• For a list of IBM Business Process Manager specific properties, see Table 1.
• For a list of Process Admin Console specific properties, see Table 2.

For multiple deployment environments, each cluster can be set up with different capabilities and the properties defined for a cluster are based on these capabilities. Before you can access and modify properties, you must locate the correct cluster.

• Get the deployment environment:

  wsadmin>deIds = AdminUtilities.convertToList(AdminConfig.getid 
      ('/Cell:/BPMCellConfigExtension:/BPMDeploymentEnvironment:/'))
  wsadmin>deIds['De1(cells/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366695378330)', 'De2
  (cells/Cell1|cell-bpm.xml#BPMDeploymentEnvironment_1366696771995)']
  wsadmin>AdminConfig.showAttribute(deIds[0], 'name')
  'De1'
  wsadmin>AdminConfig.showAttribute(deIds[1], 'name')
  'De2'

• Get the cluster with the correct capability:

  wsadmin>clusterPath = "/Cell:<cellName>/BPMCellConfigExtension:
      /BPMDeploymentEnvironment:%s/BPMCluster:/" % "<De_name>"
  wsadmin>clusterId = AdminUtilities.convertToList(AdminConfig.getid (clusterPath))
  wsadmin>capabilities1 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[0], 'capabilities'))
  wsadmin>capabilities1['Application']
  wsadmin>capabilities2 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[1], 'capabilities'))
  wsadmin>capabilities2['Messaging']
  wsadmin>capabilities3 = AdminUtilities.convertToList(AdminConfig.showAttribute(clusterId[2], 'capabilities'))
  wsadmin>capabilities3['Support']

• List objects of a given type:
  Note: For each of the properties, refer to Table 1 for the configuration object, including the configuration object containment path, for example

  wsadmin>path = "/ServerCluster:<clusterName>/BPMClusterConfigExtension:/BPMProcessServer:/BPMServerSecurity:/"
  wsadmin>b = AdminConfig.getid(path)
  wsadmin>b
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurity_1366695662779)'

• Show attributes of an object with values (Nested objects are listed using their configuration ID):

  wsadmin>print AdminConfig.show(b)
  [deploySnapshotUsingHttps false][externalUserQueryLimit 100][ldapOptions 
      [twUserNameAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662779) 
      twUserDescriptionAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662780) 
      twGroupNameAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662781) 
      twGroupDescriptionAttribute(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMLdapOption_1366695662782)]]
      [securityGroups (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurityGroups_1366695662779)]
      [securityUsers (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMServerSecurityUsers_1366695662779)]
      [wildcardProcessingOptimized false]

• Show all attributes of an object with values (Nested objects are listed):

  wsadmin>print AdminConfig.showall(b)
  [deploySnapshotUsingHttps false]
  [externalUserQueryLimit 100]
  [ldapOptions [[[name twUserNameAttribute]
  [value sAMAccountName]] [[name twUserDescriptionAttribute]
  [value description]] [[name twGroupNameAttribute]
  [value cn]] [[name twGroupDescriptionAttribute]
  [value description]]]]
  [securityGroups [[bpmAdminGroup tw_admins]
  [bpmAuthorGroup tw_authors]
  [collaborationAdmin tw_admins]
  [debug Debug]
  [offlineInstall []]
  [processHelpAccess tw_admins]
  [showXmlMetadata Debug]]]
  [securityUsers [[notifyError bpmadmin2]
  [userToCloseTask bpmadmin2]
  [userToCreateTask bpmadmin2]]]
  [wildcardProcessingOptimized false]

• Show the value of a particular attribute:

  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  100

• Modify the value for a property:
  Note: To ensure that configuration changes are saved, run the AdminConfig.save command each time a property is modified.

  wsadmin>AdminConfig.modify(b,[['externalUserQueryLimit', '150']])
  ''
  wsadmin>AdminConfig.save()
  ''
  wsadmin>print AdminConfig.showAttribute(b,'externalUserQueryLimit')
  150

• Get the console element:

  wsadmin>consoleElements = AdminUtilities.convertToList(AdminConfig.getid ("/BPMConsoleElement:/"))
  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[0]), 'name')
  wsadmin>print elementName
  'console.admin.tools'

• Get the configuration IDs of the constraint object for this console element:

  wsadmin>elementName = AdminConfig.showAttribute((consoleElements[4]), 'name')
  wsadmin>print elementName
  'console.bulk.user.attribute.assignment'

• Use the configuration ID to locate the current value for the property:

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constraints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)"
  wsadmin>val = AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>print val
  'tw_admins'

• Add a constraint:

  wsadmin>AdminConfig.create('BPMConsoleConstraint', consoleElements[4], [['type', 'role'],['value', 'admins']])
  '(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)'
  wsadmin>AdminConfig.save()''

• Remove a constraint:
  Tip: Iterate through the returned list of constraints by using the index.

  wsadmin>constraintIds = AdminConfig.showAttribute((consoleElements[4]), 'constraints')
  wsadmin>print constraintIds
  [(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782) 
  (cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)]
  wsadmin>constraint1 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1366695662782)"
  wsadmin>constraint2 = "(cells/Cell1/clusters/AppClusterDe1|cluster-bpm.xml#BPMConsoleConstraint_1367394007068)"
  wsadmin>val1= AdminConfig.showAttribute(constraint1, 'value')
  wsadmin>val2= AdminConfig.showAttribute(constraint2, 'value')
  wsadmin>print val1
  'tw_admins'
  wsadmin>print val2
  'admins'
  wsadmin>AdminConfig.remove(constraint2)
  wsamdin>AdminConfig.save()

For more advanced scenarios, see Commands for the AdminConfig object using wsadmin scripting.

Usage: Use this script to get/modify the configured security properties.
          -E|--de DE_name -option')
                          -g|--get property_name')
                          -s|--set property_name , new_value')
                          -a|--add console_property_name , constraint_value')
                                |action_policy_name , role to be added')
                          -r|--remove console_property_name , constraint_value')
                                |action_policy_name , role to be removed')

You can access the property values by using the -g|get option and you can change the value by using the -s|set option. For the console properties, you can add or remove constraints to restrict access to console sections. These properties have their own -a|--addConstraint and -r|--removeConstraint options as previously described.

• Get the value of the external user query limit:

  install_root\bin>wsadmin -conntype NONE -f <install-root>/util/Security/BPMSecurityConfig_sample.py 
  -E <de_name> -g externalUserQueryLimit
  
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available 
  as arguments that are stored in the argv variable: "[-E, De1, -g, externalUserQueryLimit]"
  Current value for property externalUserQueryLimit in DE De1 is:99

• Get the value of an action policy:

  INSTALL_ROOT\bin>wsadmin -conntype NONE -f 
  <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -g ACTION_ABORT_INSTANCE
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are
   available as arguments that are stored in the argv variable: "[-E, De1, -g, ACTION_ABORT_INSTANCE]"
  Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins

• Modify an existing value:
  Note: You can modify any of the security properties listed in Table 2.
  • Set the value of the external user query limit:

    install_root\bin>wsadmin -conntype NONE -f 
    <install-root>/util/Security/BPMSecurityConfig_sample.py -E <de_name> -s externalUserQueryLimit,100
    WASX7357I: By request, this scripting client is not connected to any server process. 
    Certain configuration and application operations will be available in local mode.
    WASX7303I: The following options are passed to the scripting environment and are 
    available as arguments that are stored in the argv variable: "[-E, De1, -s, externalUserQueryLimit,100]"
    Current value for property externalUserQueryLimit in DE De1 is:99
    INFO : The given value for the property was set successfully.
    Current value for property externalUserQueryLimit in DE De1 is:100

  • Add a role to an action policy:

    install_root\bin>wsadmin -conntype NONE -f <install-root>/util/Security/BPMSecurityConfig_sample.py 
        -E <de_name > -s ACTION_ABORT_INSTANCE,adminsWASX7357I: 
    By request, this scripting client is not connected to any server process. Certain configuration 
    and application operations will be available in local mode.
    WASX7303I: The following options are passed to the scripting environment and are available 
    as arguments that are stored in the argv variable: "[-E, De1, -a, ACTION_ABORT_INSTANCE,admins]"
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins
    Current value for property ACTION_ABORT_INSTANCE in DE De1 is:tw_admins;admins

• Add a constraint to a console property:

  install_root\bin>wsadmin -conntype NONE -f 
  <install-root>/util/Security/BPMSecurityConfig_sample.py -D <de_name> -a console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available as arguments 
  that are stored in the argv variable: "[-E, De1, -a, console.monitor,admins]"
  Current value for property console.monitor in DE De1 is:constraint 0 : tw_admins
  constraint 1 : tw_authors
  
  INFO : The given value for the property was set successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins

• Remove a constraint from a console property:

  install_root\bin>wsadmin -conntype NONE -f BPMSecurityConfig_sample.py -r console.monitor,admins
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7303I: The following options are passed to the scripting environment and are available 
  as arguments that are stored in the argv variable: "[-E, De1, -r, console.monitor,admins]"
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors
  constraint 2 : admins
  
  The given constraint was removed successfully.
  
  Current value for property console.monitor in DE De1 is:
  constraint 0 : tw_admins
  constraint 1 : tw_authors

• To suppress the inclusion of the user password in the URLs that Process Designer opens, use the suppressRedirectUrlPasswd option. For example, each time you run a playback in Process Designer, a new Process Portal browser session is opened. Process Designer then submits the user credentials, which consist of the user ID and password, and the browser session uses these credentials to log in. The suppressRedirectUrlPasswd option stops the password from being included in the URL to improve security.
  Note: When you use the suppressRedirectUrlPasswd option, you need to log in to the browser only the first time that you open a web editable artifact or run a playback in Process Designer. This option applies only to Process Designer and can be turned on and off as needed.
  The following example is shown using Jython:

  dmgr_profile_root>wsadmin.bat -connType NONE
  WASX7357I: By request, this scripting client is not connected to any server process. 
  Certain configuration and application operations will be available in local mode.
  WASX7031I: For help, enter: "print Help.help()"
  wsadmin>path='/ServerCluster:AppCluster/BPMClusterConfigExtension:/BPMAuthoringEnvironment:/'
  wsadmin>b=AdminConfig.getid(path)
  wsadmin>b
  '(cells/PCCell1/clusters/AppCluster|cluster-bpm.xml#BPMAuthoringEnvironment_1376890854832)'
  wsadmin>AdminConfig.modify(b,[['suppressRedirectUrlPasswd','true']])
  wsadmin>AdminConfig.save()