Allowing non-administrators to run diagnostics

After you have created users and added them to groups, you might want to allow non-administrators to run diagnostics in Rule Execution Server.

Before you begin

You work in the WebLogic Server Administration Console. See Before you start: Opening the administration console for details.

About this task

By default, the resDeployer and resMonitor users do not have WebLogic Server administrator rights, which they need to run the diagnostics. The following procedure shows how to add a Java Management Extensions (JMX) policy for these users to access all the MBeans. For the JMX Policy Editor to be available on the Policies page, you must first activate a specific option to protect JMX access.

Procedure

From the breadcrumbs at the top of the console, or from the Home Page, open the Summary of Security Realms page, and in the Realms table, click myrealm.
On the Settings for myrealm page, on the Configurations > General tab, select the Use Authorization Providers to Protect JMX Access check box.
Click Save and restart the server.
Tip: It is not necessary to restart the Administration Console.
After the server is restarted, click the Roles and Policies tab, and then the Realm Policies tab.
Under Policies, click JMX Policy Editor.
On the JMX Policy Editor page, check that GLOBAL SCOPE is selected and click Next.
In the next panel, check that ALL MBEAN TYPES is selected and click Next.
In the Attributes and Operations table, select Operations: Permission to Invoke and click Create Policy.
Click Add Conditions, select Role from the Predicate List, and click Next.
Type Admin in the Role Argument Name field and click Add, and then click Finish.
On the Edit JMX Policies page, click Add Conditions, select Group from the Predicate List list, and click Next.
Add the groups that do not have administrator privilege and whom you allow to run the diagnostic tests. For example, to add all the resDeployers and resMonitors groups follow these steps:
1. Type resDeployers in the Group Argument Name field and click Add.
2. Type resMonitors in the Group Argument Name field and click Add.
3. Click Finish
The policy conditions and the overridden policy are shown:
```
Group: resDeployers or resMonitors

Role: Admin
```
Click Save.
Restart WebLogic Server.