{"id":2712,"date":"2014-01-21T18:12:13","date_gmt":"2014-01-21T10:12:13","guid":{"rendered":"http:\/\/rmohan.com\/?p=2712"},"modified":"2014-01-21T18:12:51","modified_gmt":"2014-01-21T10:12:51","slug":"how-to-disable-websphere-global-security-for-one-application-server-in-a-secure-cell","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=2712","title":{"rendered":"How to disable WebSphere Global Security for one Application Server in a secure cell"},"content":{"rendered":"

Problem(Abstract)<\/h2>\n

In a WebSphere Application Server cell where Global Security is enabled, you may want to disable security for individual application servers, for example, when you run some applications that can be accessed anonymously, while others require authentication.<\/p>\n

This can be done either from the Application Server Administrative Console or using wsadmin.<\/p>\n

Resolving the problem<\/h2>\n
\n

Solution using Administrative Console:<\/b><\/p>\n

    \n
  1. Go to “Application Servers”<\/li>\n
  2. Select the appropriate server<\/li>\n
  3. Select “Server security”<\/li>\n
  4. Select “Server level security”<\/li>\n
  5. Disable the “Enable global security” checkbox<\/li>\n
  6. Save the settings and synchronize<\/li>\n<\/ol>\n

    Solution using wsadmin:
    \n<\/b>(assume you want to disable security for server1 on node WASI02Base.)<\/p>\n

      \n
    1. start wsadmin in Deploymentmanager\/bin directory
      \nwsadmin>$AdminConfig list Security
      \n(cells\/WASICELL:security.xml#Security_1106748574007)<\/li>\n
    2. wsadmin>$AdminConfig list Server
      \ndmgr(cells\/WASICELL\/nodes\/WASI02DMGR\/servers\/dmgr:server.xml#Server_1)
      \njmsserver(cells\/WASICELL\/nodes\/wasi01base\/servers\/jmsserver:server.xml# Server_1106748571434)
      \nnodeagent(cells\/WASICELL\/nodes\/WASI02Base\/servers\/nodeagent:server.xml# Server_1)
      \nnodeagent(cells\/WASICELL\/nodes\/wasi01base\/servers\/nodeagent:server.xml# Server_1106748571153)
      \nserver1(cells\/WASICELL\/nodes\/WASI02Base\/servers\/server1:server.xml#Server_1)
      \nserver1(cells\/WASICELL\/nodes\/wasi01base\/servers\/server1:server.xml#Server_1)<\/li>\n
    3. wsadmin>set server [$AdminConfig getid \/Cell:WASICELL\/Node:WASI02Base\/Server:server1]
      \nserver1(cells\/WASICELL\/nodes\/WASI02Base\/servers\/server1:server.xml#Server_1)<\/li>\n
    4. wsadmin>$AdminConfig list Security $server<\/li>\n
    5. wsadmin>$AdminConfig create Security $server {{enabled false}}
      \n(cells\/WASICELL\/nodes\/WASI02Base\/servers\/server1:security.xml#Security_1151410503621)<\/li>\n
    6. wsadmin>$AdminConfig save<\/li>\n<\/ol>\n

      The result of both solutions described above (Administrative Console and wsadmin), is a separate\u00a0security.xm<\/i>l file for\u00a0server1<\/i>\u00a0containing\u00a0security enabled=’false’<\/i>.
      \nAfter restarting server1, its applications (For example, Snoop) can be accessed without being
      \nprompted for userid and password as it was before, while security for the other servers in the cell is still active.<\/p>\n

      Remark:
      \nIt does not work the other direction. You cannot enable Server Level Security, when the cell-wide Global Security is disabled.<\/p>\n<\/div>\n

      \n

      WebSphere Global Security OFF<\/h3>\n
      This is a massive pain, WAS 6.1 is failing with my new SSL certs with larger (2048) size keys. No matter how perfectly configured my Node Default Trust Store looks with it’s happy Signer Certificate, the SSL connection still fails.<\/p>\n

      I changed a setting to do with SSL – I knew that was a bad idea! Server won’t let me back in the console, time to turn off security.<\/p>\n

      To disable global security either edit the security.xml file or use the wsadmin tool.<\/p>\n

      $WAS_HOME\\config\\cells\\cellname\\security.xml<\/p>\n

      Using WAS command-line client wsadmin (run with was user or root privileges):
      \n1. Open a connection to local WAS in offline mode
      \nwsadmin -conntype NONE<\/p>\n

      2. Turn off global security
      \nwsadmin> securityoff<\/p>\n

      3. Save
      \nwsadmin> $AdminConfig save<\/p><\/div>\n<\/div>\n

      <\/div>\n
      <\/div>\n
      \n\n\n\n\n\n\n\n\n\n
      WebSphere Administrative (WAS) Console: turn off global security<\/b><\/td>\n<\/tr>\n
      Article ID:558727<\/td>\n<\/tr>\n
      <\/td>\n<\/td>\n<\/tr>\n
      Description:<\/b><\/td>\n<\/td>\n<\/tr>\n
      I am\u00a0locked out of the\u00a0\u00a0WebSphere Administrative (WAS)\u00a0console\u00a0<\/strong>and have forgotten the password.\u00a0 I want to\u00a0turn off the WebSphere Application Server global security from outside the WAS console so I can login to the WebSphere Administrative console. How do I do this?\u00a0\u00a0<\/span><\/td>\n<\/tr>\n
      Resolution:<\/b><\/td>\n<\/td>\n<\/tr>\n
      \n
      To do this you can either modify the security.xml file in WAS or use the .\/wsadmin tool to make this change:<\/div>\n
      <\/div>\n
        \n
      1. Login as root to\u00a0Lawson Insight Desktop (LID).<\/strong><\/li>\n
      2. Navigate to the\u00a0$WAS_HOME\/profiles\/Dmgr01\/bin\u00a0<\/strong>directory.<\/li>\n
      3. Run the WAS command line client in offline mode,\u00a0.\/wsadmin -conntype NONE<\/strong><\/li>\n
      4. Turn off global security by entering\u00a0securityoff\u00a0<\/strong>from the wsadmin> prompt.<\/li>\n
      5. Save this by executing\u00a0$AdminConfig save\u00a0<\/strong>from the wsadmin> prompt.<\/li>\n<\/ol>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        Problem(Abstract) <\/p>\n

        In a WebSphere Application Server cell where Global Security is enabled, you may want to disable security for individual application servers, for example, when you run some applications that can be accessed anonymously, while others require authentication.<\/p>\n

        This can be done either from the Application Server Administrative Console or using wsadmin.<\/p>\n

        Resolving the problem […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2712"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2712"}],"version-history":[{"count":2,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2712\/revisions"}],"predecessor-version":[{"id":2714,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2712\/revisions\/2714"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}