NamingAuthzCommands command group for the AdminTask object
You can use the Jython scripting language to configure naming roles for groups and users with the wsadmin tool. Use the commands and parameters in the NamingAuthzCommands group to assign, remove, and query naming role configuration. CosNaming security offers increased granularity of security control over CosNaming functions.
A number of naming roles are defined to provide the degrees of authority that are needed to perform certain application server naming service functions. The authorization policy is only enforced when global security is enabled.
listGroupsForNamingRoles
The listGroupsForNamingRoles command displays the groups and special subjects that are mapped to the naming roles.
Target object
None.
Return value
The command returns a list of the groups and special subjects associated with each naming role.
Batch mode example usage
- Using Jython:
AdminTask.listGroupsForNamingRoles()
Interactive mode example usage
- Using Jython:
AdminTask.listGroupsForNamingRoles('-interactive')
listUsersForNamingRoles
The listUsersForNamingRoles command displays the users that are mapped to the naming roles.
Target object
None.
Return value
The command returns a list of the users associated with each naming role.
Batch mode example usage
- Using Jython:
AdminTask.listUsersForNamingRoles()
Interactive mode example usage
- Using Jython:
AdminTask.listUsersForNamingRoles('-interactive')
mapGroupsToNamingRole
The mapGroupsToNamingRole command maps groups, special subjects, or groups and special subjects to the naming roles.
Target object
None.
Required parameters
- -roleName
- Specifies the name of the naming role. (String)
Table 1. Name space security roles . Four name space security roles are available: CosNamingRead, CosNamingWrite, CosNamingCreate, and CosNamingDelete. The roles have authority levels from low to high, as the following table defines: Role name Description CosNamingRead You can query the application server name space using, for example, the Java™ Naming and Directory Interface (JNDI) lookup method. The EVERYONE special-subject is the default policy for this role. CosNamingWrite You can perform write operations such as JNDI bind, rebind, or unbind, and CosNamingRead operations. CosNamingCreate You can create new objects in the name space through operations such as JNDI createSubcontext and CosNamingWrite operations. CosNamingDelete You can destroy objects in the name space, for example using the JNDI destroySubcontext method and CosNamingCreate operations.
Optional parameters
- -groupids
- Specifies the names of the groups to map to the naming roles. (String[])
- -accessids
- Specifies the access IDs of the users in the format <group:realmName/uniqueID>. (String[])
- -specialSubjects
- Specifies the special subjects to map. (String[])
Table 2. Special subjects . The special subjects include EVERYONE, ALLAUTHENTICATED, ALLAUTHENTICATEDINTRUSTEDREALMS, as the following table defines: Header Header EVERYONE Maps everyone to a specified role. When you map everyone to a role, anyone can access the resources that are protected by this role and, essentially, there is no security. ALLAUTHENTICATED Maps each authenticated user to a specified role. When you map each authenticated user to a specified role, each valid user in the current registry who has been authenticated can access resources that are protected by this role. ALLAUTHENTICATEDINTRUSTEDREALMS Maps each authenticated user to a specified role. When you map each authenticated user to a specified role, each valid user in the current registry who has been authenticated can access resources that are protected by this role in the trusted realm.
Return value
The command does not return output.
Batch mode example usage
- Using Jython string:
AdminTask.mapGroupsToNamingRole('[-roleName CosNamingCreate -groupids [group1, group2]]') - Using Jython list:
AdminTask.mapGroupsToNamingRole(['-roleName', 'CosNamingCreate', '-groupids', '[group1, group2]'])
Interactive mode example usage
- Using Jython:
AdminTask.mapGroupsToNamingRole('-interactive')
mapUsersToNamingRole
The mapUsersToNamingRole command maps users to the naming roles.
Target object
None.
Required parameters
- -roleName
- Specifies the name of the naming role. (String)
Table 3. Name space security roles . Four name space security roles are available: CosNamingRead, CosNamingWrite, CosNamingCreate, and CosNamingDelete. The roles have authority levels from low to high, as the following table defines: Role name Description CosNamingRead You can query the application server name space using, for example, the Java Naming and Directory Interface (JNDI) lookup method. The EVERYONE special-subject is the default policy for this role. CosNamingWrite You can perform write operations such as JNDI bind, rebind, or unbind, and CosNamingRead operations. CosNamingCreate You can create new objects in the name space through operations such as JNDI createSubcontext and CosNamingWrite operations. CosNamingDelete You can destroy objects in the name space, for example using the JNDI destroySubcontext method and CosNamingCreate operations.
Optional parameters
- -userids
- Specifies the user IDs to map to the naming roles of interest. (String[])
- -accessids
- Specifies the access IDs of the users in the format <user:realmName/uniqueID>. (String[])
Return value
The command does not return output.
Batch mode example usage
- Using Jython string:
AdminTask.mapUsersToNamingRole([-roleName CosNamingDelete -userids [user1, user2, user3]]') - Using Jython list:
AdminTask.mapUsersToNamingRole(['-roleName', 'CosNamingDelete', '-userids', '[user1, user2, user3]'])
Interactive mode example usage
- Using Jython:
AdminTask.mapUsersToNamingRole('-interactive']
removeGroupsFromNamingRole
The removeGroupsFromNamingRole command removes groups, special subjects, or groups and special subjects from a naming role.
Target object
None.
Required parameters
- -roleName
- Specifies the name of the naming role. (String)
Table 4. Name space security roles . Four name space security roles are available: CosNamingRead, CosNamingWrite, CosNamingCreate, and CosNamingDelete. The roles have authority levels from low to high, as the following table defines: Role name Description CosNamingRead You can query the application server name space using, for example, the Java Naming and Directory Interface (JNDI) lookup method. The EVERYONE special-subject is the default policy for this role. CosNamingWrite You can perform write operations such as JNDI bind, rebind, or unbind, and CosNamingRead operations. CosNamingCreate You can create new objects in the name space through operations such as JNDI createSubcontext and CosNamingWrite operations. CosNamingDelete You can destroy objects in the name space, for example using the JNDI destroySubcontext method and CosNamingCreate operations.
Optional parameters
- -groupids
- Specifies the names of the groups to remove from the naming roles of interest. (String[])
- -specialSubjects
- Specifies the special subjects to remove. (String[])
Table 5. Special subjects . The special subjects include EVERYONE, ALLAUTHENTICATED, ALLAUTHENTICATEDINTRUSTEDREALMS, as the following table defines: Header Header EVERYONE Maps everyone to a specified role. When you map everyone to a role, anyone can access the resources that are protected by this role and, essentially, there is no security. ALLAUTHENTICATED Maps each authenticated user to a specified role. When you map each authenticated user to a specified role, each valid user in the current registry who has been authenticated can access resources that are protected by this role. ALLAUTHENTICATEDINTRUSTEDREALMS Maps each authenticated user to a specified role. When you map each authenticated user to a specified role, each valid user in the current registry who has been authenticated can access resources that are protected by this role in the trusted realm.
Return value
The command does not return output.
Batch mode example usage
- Using Jython string:
AdminTask.removeGroupsFromNamingRole('-roleName CosNamingRead -groupids [group1, group2] -specialSubjects EVERYONE') - Using Jython list:
AdminTask.removeGroupsFromNamingRole(['-roleName', 'CosNamingRead', '-groupids', '[group1, group2]', '-specialSubjects', 'EVERYONE'])
Interactive mode example usage
- Using Jython:
AdminTask.removeGroupsFromNamingRole('-interactive')
removeUsersFromNamingRole
The removeUsersFromNamingRole command removes users from a naming role.
Target object
None.
Required parameters
- -roleName
- Specifies the name of the naming role. (String)
Table 6. Name space security roles . Four name space security roles are available: CosNamingRead, CosNamingWrite, CosNamingCreate, and CosNamingDelete. The roles have authority levels from low to high, as the following table defines: Role name Description CosNamingRead You can query the application server name space using, for example, the Java Naming and Directory Interface (JNDI) lookup method. The EVERYONE special-subject is the default policy for this role. CosNamingWrite You can perform write operations such as JNDI bind, rebind, or unbind, and CosNamingRead operations. CosNamingCreate You can create new objects in the name space through operations such as JNDI createSubcontext and CosNamingWrite operations. CosNamingDelete You can destroy objects in the name space, for example using the JNDI destroySubcontext method and CosNamingCreate operations.
Optional parameters
- -userids
- Specifies the user IDs to remove from the naming roles of interest. (String[])
Return value
The command does not return output.
Batch mode example usage
- Using Jython string:
AdminTask.removeUsersFromNamingRole('-roleName CosNamingRead') - Using Jython list:
AdminTask.removeUsersFromNamingRole(['-roleName', 'CosNamingRead'])
Interactive mode example usage
- Using Jython:
AdminTask.removeUsersFromNamingRole('-interactive')