Switching to an LDAP user registry when using a non-clustered WebSphere Application Server Network Deployment

After an IBM® InfoSphere® Information Server installation finishes, you can configure IBM InfoSphere Information Server to authenticate users by using a Lightweight Directory Access Protocol (LDAP) user registry. If you are using a non-cluster (stand-alone) WebSphere® Application Server Network Deployment, then there are specific configuration steps you must follow to set up the LDAP user registry.

Before you begin

The InfoSphere Information Server engine performs user authentication separately from other InfoSphere Information Server components. You can configure the engine to use the LDAP user registry that you set up. For IBM AIX®, HP-UX, and Linux® platforms, you can optionally configure Pluggable Authentication Module (PAM) support before you switch the user registry. For more information, see Configuring IBM InfoSphere Information Server to use PAM (Linux, UNIX).
WebSphere Application Server must be running. This is mandatory for all IBM WebSphere Application Server stand-alone installations.

About this task

InfoSphere Information Server supports any LDAP-compliant user registry that IBM WebSphere Application Server Network Deployment supports. For more information about supported LDAP servers, see the IBM WebSphere Application Server Network Deployment system requirements:

IBM WebSphere Application Server Network Deployment 8.5.5: http://www-01.ibm.com/support/docview.wss?uid=swg27038218

Procedure

Do the procedures in the WebSphere Application Server documentation for configuring LDAP user registries.
Procedures for configuring LDAP user registries within WebSphere Application Server can be found in the WebSphere Application Server information center:
- IBM WebSphere Application Server Network Deployment 8.5: http://publib.boulder.ibm.com/infocenter/wasinfo/v8r5/topic/com.ibm.websphere.nd.doc/ae/tsec_ldap.html
Stop WebSphere Application Server.
Important: When stopping the WebSphere Application Server processes, use the credentials of the WebSphere Application Server administrator from the previous user registry.
Log in to the services tier computer on which the AppServerAdmin tool is installed.
From the command line, run the AppServerAdmin command.
This command propagates the WebSphere Application Server administrator user name and password to WebSphere Application Server.
```
/opt/IBM/InformationServer/ASBServer/bin/AppServerAdmin.sh -was 
   -user was_admin_user_id -password was_admin_password
```
```
C:\IBM\InformationServer\ASBServer\bin\AppServerAdmin.bat -was 
   -user was_admin_user_id -password was_admin_password
```
In the command, was_admin_user_id and was_admin_password must match the new WebSphere Application Server administrator credentials that you provided in the WebSphere Application Server administrative console.

Tip: The -password parameter is optional. If not provided, you will be prompted for a password. If you do provide a password, it can be either plain text or an encrypted string that has been created with the encrypt command.
If you are switching the user registry for a system that has been used for a while by multiple users, clean up the users and groups that are related to the security configuration. See Switching the user registry configuration for a system in use.
Restart WebSphere Application Server.
After WebSphere Application Server is restarted, during the InfoSphere Information Server initialization, the WebSphere Application Server user registry configuration is checked and the InfoSphere Information Server user registry configuration is automatically adjusted if needed. The default WebSphere Application Server administrator user is also automatically configured as the initial new InfoSphere Information Server default administrator user.
If one of the node agents was not running when you did the previous steps, the node agent cannot be restarted because the user registry configuration at the Deployment Manager and node levels do not match. To fix this problem, run the WebSphere Application Server syncNode command to synchronize the node with the Deployment manager. To run the syncNode command:
1. Log in to the node.
2. Run the syncNode command.
  - ```
  /opt/IBM/WebSphere/AppServer/profiles/custom_profile/bin/syncNode.sh 
     dmgr_hostname dmgr_port -user was_admin_username -password 
     was_admin_password
```
- ```
C:\IBM\WebSphere\AppServer\profiles\custom_profile\bin\syncNode 
   dmgr_hostname dmgr_port -user was_admin_username -password 
   was_admin_password
```
  In the command:
  - dmgr_hostname is the host name of the computer where the Deployment Manager is running.
  - dmgr_port is the port number of the Deployment Manager (the default is 8879).
  - was_admin_username is the user name of the WebSphere Application Server administrator.
  - was_admin_password is the administrator password.
3. Restart the node agent.
  See Starting IBM WebSphere Application Server (Windows) or Starting IBM WebSphere Application Server (Linux, UNIX).

What to do next

After you change the user registry, you can use theWebSphere Application Server administrator user name and password to log in to the InfoSphere Information Server Web console. In the console, grant suite administrator access to additional users as needed. The WebSphere Application Server administrator is granted InfoSphere Information Server administrator privileges by default.