Configuring stand-alone custom registries

Use the following information to configure stand-alone custom registries through the administrative console.

1. Click Security > Global security.
2. Under User account repositories, select Stand-alone custom registry and click Configure.
3. Enter a valid user name in the Primary administrative user name field.
   This ID is the security server ID, which is only used for WebSphere Application Server security and is not associated with the system process that runs the server. The server calls the local operating system registry to authenticate and obtain privilege information about users by calling the native APIs in that particular registry.
4. Enter the dot-separated class name that implements the com.ibm.websphere.security.UserRegistry interface in the Custom registry class name field.
   For the sample, this file name is com.ibm.websphere.security.FileRegistrySample.

   This file exists in all the product processes. Thus, this file exists in the cell class path and in all of the node class paths.

   Attention: The sample provided is intended to familiarize you with this feature. Do not use this sample in an actual production environment.
5. Add your custom registry class name to the class path.
   It is recommended that you add the Java™ Archive (JAR) file that contains your custom user registry implementation to the following directory:

   • app_server_root/classes
   • profile_root/classes
     Important: The file can be located in any directory in the integrated file system. However, it is recommended that the directory is not located in a product directory.
6. Optional: Select the Ignore case for authorization option for the authorization to perform a case insensitive check.
   Enabling this option is necessary only when your user registry is case insensitive and does not provide a consistent case when queried for users and groups.
7. Click Apply if you have any other additional properties to enter for the registry initialization.
8. Optional: Enter additional properties to initialize your implementation.
   1. Click Custom properties > New.
   2. Enter the property name and value.

      For the sample, enter the following two properties. It is assumed that the users.props file and the groups.props file are in the customer_sample directory under the product installation directory. You can place these properties in any directory that you choose and reference their locations through custom properties. However, make sure that the directory has the appropriate access permissions.

      Table 1. Additional properties .

      This table lists additional custom properties when configuring stand-alone custom registries.

      Property name	Property value
      usersFile	${USER_INSTALL_ROOT}/customer_sample /users.props
      groupsFile	${USER_INSTALL_ROOT}/customer_sample /groups.props

      Attention: The QEJBSVR user profile must have Execute (*X) authority for the directory that contains user.props and groups.props files. Additionally, QEJBSVR must have Read and Execute (*RX) authority for the user.props and groups.props files.

      Samples of these two properties are available in users.props file and groups.props file.

      To use the users.props and the groups.props files on the z/OS® platform, save these files in the ASCII format before calling them from the administrative console.

      The Description, Required, and Validation Expression fields are not used and can remain blank.

      In a WebSphere Application Server Network Deployment environment where multiple WebSphere Application Server processes exist, such as cell and multiple nodes in different machines, these properties are available for each process. Use the USER_INSTALL_ROOT relative name to locate any files, as this name expands to the product installation directory. If this name is not used, ensure that the files exist in the same location in all the nodes.

      WebSphere Application Server version 4-based custom user registry is migrated to the custom user registry based on the com.ibm.websphere.security.UserRegistry interface.

   3. Click Apply.
   4. Repeat this step to add other additional properties.
9. Click Security > Global security.
10. Under User account repository, click the Available realm definitions drop-down list, select Stand-alone custom registry, and click Configure.
11. Select either the Automatically generated server identity or Server identity that is stored in the repository option.
    If you select the Server identity that is stored in the repository option, enter the following information:

    Server user ID or administrative user on a Version 6.0.x node

    Specify the short name of the account that is chosen in the second step.

    Server user password

    Specify the password of the account that is chosen in the second step.

12. Click OK and complete the required steps to turn on security.