IBM Support

How to disable WebSphere Global Security for one Application Server in a secure cell

Troubleshooting


Problem

In a WebSphere Application Server cell where Global Security is enabled, you may want to disable security for individual application servers, for example, when you run some applications that can be accessed anonymously, while others require authentication. This can be done either from the Application Server Administrative Console or using wsadmin.

Resolving The Problem

Solution using Administrative Console:

For WAS v6.0:

  1. Go to "Application Servers"
  2. Select the appropriate server
  3. Select "Server security"
  4. Select "Server level security"
  5. Uncheck the "Enable global security" checkbox
  6. Save the settings and synchronize

For WAS v6.1
  1. Go to "Application Servers"
  2. Select the appropriate server
  3. Select "Server security"
  4. Check "Security settings for this server override the cell settings"
  5. Uncheck the "Enable application security" checkbox
  6. Save the settings and synchronize

For WAS v7.0 and later:

Create a separate security domain for the server to set different security settings on a server scope:


http://www-01.ibm.com/support/knowledgecenter/SSAW57_7.0.0/com.ibm.websphere.nd.doc/info/ae/ae/csec_sec_multiple_domains.html

Solution using wsadmin for WAS v6.0 and v6.1:
(assume you want to disable security for server1 on node WASI02Base.)

  1. start wsadmin in Deploymentmanager/bin directory
    wsadmin>$AdminConfig list Security
    (cells/WASICELL:security.xml#Security_1106748574007)

  2. wsadmin>$AdminConfig list Server
    dmgr(cells/WASICELL/nodes/WASI02DMGR/servers/dmgr:server.xml#Server_1)
    nodeagent(cells/WASICELL/nodes/WASI02Base/servers/nodeagent:server.xml# Server_1)
    server1(cells/WASICELL/nodes/WASI02Base/servers/server1:server.xml#Server_1)
    wsadmin>set server [$AdminConfig getid /Cell:WASICELL/Node:WASI02Base/Server:server1]
    server1(cells/WASICELL/nodes/WASI02Base/servers/server1:server.xml#Server_1)

  3. wsadmin>$AdminConfig list Security $server

  4. wsadmin>$AdminConfig create Security $server {{enabled false}}
    (cells/WASICELL/nodes/WASI02Base/servers/server1:security.xml#Security_1151410503621)

  5. wsadmin>$AdminConfig save



For WAS v7.0 and later, configuring security domains using wsadmin is also described in the Knowledge Center:
http://www-01.ibm.com/support/knowledgecenter/SSAW57_7.0.0/com.ibm.websphere.nd.doc/info/ae/ae/txml_7sdconfig.html

After restarting server1, its applications (For example, Snoop) can be accessed without being
prompted for userid and password as it was before, while security for the other servers in the cell is still active.

Remark:
It does not work the other direction. You cannot enable Server Level Security, when the cell-wide Global Security is disabled.

[{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Administrative Scripting Tools (for example: wsadmin or ANT)","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.5;8.0;7.0","Edition":"Network Deployment","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSNVBF","label":"Runtimes for Java Technology"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Java SDK","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
15 June 2018

UID

swg21245098

Page Feedback