Security is not correctly configured for cross-cell communication

Resolving The Problem

Complete the following four procedures to ensure that application server security is correctly set to enable cross-cell communication:

• Enabling cross-cell single sign-on
• Enabling security attribute propagation
• Configuring SSL communication
• Configuring cross realm communication

Note: These procedures assume a scenario where security is enabled for both servers and each server has its own user registry.

Enabling cross-cell single sign-on

1. Export the Lightweight Third Party Authentication (LTPA) key from IBM InfoSphere Information Server:

a. Log in to the WebSphere Application Server administration console on the IBM InfoSphere Information Server machine.
b. Navigate to the Global security Authentication, LTPA panel.
c. In the Password and Confirm password fields, type your password.
d. In the Key file name field, type the file path and name of the LTPA key.
e. Click Export Keys.
f. Copy the exported key file to the InfoSphere MDM server machine.
g. Click OK.

2. Import the LTPA key to InfoSphere MDM server:
a. Log in to the WebSphere Application Server administration console on the InfoSphere MDM server machine.
b. Navigate to the Security Global security Authentication, LTPA panel.
c. In the Password and Confirm password fields, type the password for the IBM InfoSphere Information Server LTPA key.
d. In the Fully qualified key file name field, type the file path and name of the key file that you exported from IBM InfoSphere Information Server.
e. Click Import keys.
f. Click OK.

Enabling security attribute propagation

1. Log in to the WebSphere Application Server administration console on the InfoSphere MDM server machine.
2. Navigate to Security Global security RMI/IIOP security CSIv2 outbound communications.
3. Select the Propagate security attributes check box.
4. Under Transport layer, change transport to ‘SSL-supported’ if not already selected.
Note: By default, SSL-required is selected but in InfoSphere Information Server, the inbound transport is configured to TCP/IP only (NO-SSL). SSL-supported will allow both SSL and non-SSL communication between servers.
5. Click OK to save the settings.
6. Synchronize the nodes.
7. Restart the deployment manager, the node agent, and InfoSphere MDM server.

Configuring SSL communication

1. Log in to the WebSphere Application Server administration console on the InfoSphere MDM server machine.
2. Navigate to SSL certificate and key management Key stores and certificates CellDefaultTrustStore Signer certificates.
Note: CellDefaultTrustStore or NodeDefaultTrustStore should be selected according to the server environment settings. For Enterprise Edition, by default the CellDefaultTrustStore is used.
3. Click Retrieve from port and provide the QualityStage server host name, alias name, and port (such as 9043).
4. Click Retrieve signer information to verify the certificate.
5. Click OK to save the settings.
6. Synchronize the nodes.
7. Restart the deployment manager, the node agent, and InfoSphere MDM server.

Configuring cross realm communication

1. Log in to the WebSphere Application Server administration console on the InfoSphere MDM server machine.
2. Navigate to Security Global security RMI/IIOP security CSIv2 outbound communications.
3. Click Trusted authentication realms – outbound.
4. On the Trusted authentication realms – outbound screen, select Trust realms as indicated below, then click Add External Realm…
5. Specify ASBRealm as the External realm name, click OK.
6. Click OK to save the settings.
7. Synchronize the nodes.
8. Restart the deployment manager, the node agent, and InfoSphere MDM server.

Note: For information about cross realm communication, see the WebSphere Application Server documentation: http://pic.dhe.ibm.com/infocenter/wasinfo/v8r5/topic/com.ibm.websphere.nd.multiplatform.doc/ae/csec_sec_multiple_domains.html