Server User Guide > Security Configurations > Configuring Your Application Server to Work with Process Server Security Roles

Configuring Your Application Server to Work with Process Server Security Roles

Setting up secure access to Process Server includes the following steps:
Mapping Roles to Users and Groups
Each application server has a different set of steps for configuring security for deployed applications. You must familiarize yourself with your application server environment to understand how to configure the security methods you need. However, here are some general guidelines and links to documentation.
Application Server
Setup Guidelines
Add a realm to server.xml, connecting to an existing "database" of usernames, passwords, and user roles.
See examples below.
For an LDAP-based database, add the Process Server security roles to your database and map them to groups.
Refer to Realm Configuration HOW-TO at the following URL (Tomcat 6.0):
Refer to
Add a security domain and login module to your chosen configuration file. The security domain must be named the same as what was selected in the Process Server config-deploy utility. If the name was not changed in the utility, it defaults to "ActiveVOS". Add roles to one of the following: a set of user/role files, LDAP-based database, or JDBC-based database.
Login to the WebLogic console and set up the LDAP provider, if you have not already done so: (Navigate to Security Realms. In the default realm, select Providers > Authentication > Default Authenticator and change the Control Flag from REQUIRED to OPTIONAL. Add and configure your LDAP provider.)
For details, see Configuring Authentication Providers at
In your security realm, navigate to Roles and Policies. Expand Global Roles, select Roles, and enter the Process Server security roles.
For details, see Users, Groups, and Security Roles at
Login to the WebSphere console and follow the links similar to this example:
Applications > Application types > WebSphere enterprise applications > Process Server
Look for the Security role to user/group mapping group. Map the existing Process Server security roles to groups.
Note: You must ensure that WebSphere application security is set up correctly. On the WebSphere Console navigation area, select Security > Secure administration, applications, and infrastructure. Then select the checkbox next to Enable Application Security and select Apply.
Tomcat Examples
tomcat\conf\server.xml (file-based configuration)
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"

tomcat\conf\tomcat-users.xml file:
   <role rolename="abTaskClient"/>
   <role rolename="abServiceConsumer"/>
   <role rolename="abAdmin"/>
   <user username="admin" password="admin"
  roles="abAdmin, abTaskClient, abServiceConsumer"/>
tomcat\conf\server.xml (LDAP-based configuration)
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
JBoss Examples
Note: The following two examples are specific to JBoss 7.1.1; other versions require different configurations. Also, what you see here is just to indicate how you might configure JBoss. What you will actually declare will almost certainly be different. For all JBoss versions, you must review the JBoss documentation.
[Path] \configuration\ [file.xml] (file-based configuration)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example: C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml
<security-domain name="ActiveVOS" >
    <login-module code="RealmUsersRoles" flag="required">
      <module-option name="usersProperties"
      <module-option name="rolesProperties"
      <module-option name="realm" value="ApplicationRealm"/>
            name="unauthenticatedIdentity"> anonymous


[Path] \configuration\[Path](LDAP-based configuration)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example: C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml.
<security-domain name="ActiveVOS">
    <login-module code=""
      <module-option name="java.naming.provider.url"
      <module-option name="bindDN"
      <module-option name="bindCredential" value="admin"/>
      <module-option name="baseCtxDN"
      <module-option name="baseFilter"
      <module-option name="rolesCtxDN"
      <module-option name="roleFilter" value="(member={1})"/>
      <module-option name="roleAttributeID" value="memberOf"/>
      <module-option name="roleAttributeIsDN" value="true"/>
      <module-option name="roleNameAttributeID" value="cn"/>
      <module-option name="roleRecursion" value="2"/>
      <module-option name="searchScope" value="SUBTREE_SCOPE"/>
      <module-option name="allowEmptyPasswords" value="true"/>
      <module-option name="java.naming.referral"  value="follow"/>
      <module-option name="unauthenticatedIdentity" value="aeadmin"/>