Question
Allianz
DE
Last activity: 12 Feb 2016 9:22 EST
Questions to Admin/pw in SMA
Hi,
we have installed Pega 7.1.7 and are using the SMA quite frequently. Therefore, we want to create a variety of roles with different access rights as SMA is not secure by default. That being said, I have some questions to the Image depicted below which is part of the Node Configuration in the SMA:
1. What happens when I enter a Username + Passwort? Is it like initially creating an Administrator role and noone has access to the SMA except the admin with the entered credentials?
2. Where is the entered username + Passwort saved? Within PRPC? On the DB?
3. After having created this admin-role, how can I retrieve the password if I loose/forget it?
4. Are there any best practices regarding the roles concept of the SMA? Is it recommended to have only one role (admin)?
Even though I have found a guide how to create roles, those questions are still interesting to me.
Thank you!
Best regards
Hi,
we have installed Pega 7.1.7 and are using the SMA quite frequently. Therefore, we want to create a variety of roles with different access rights as SMA is not secure by default. That being said, I have some questions to the Image depicted below which is part of the Node Configuration in the SMA:
1. What happens when I enter a Username + Passwort? Is it like initially creating an Administrator role and noone has access to the SMA except the admin with the entered credentials?
2. Where is the entered username + Passwort saved? Within PRPC? On the DB?
3. After having created this admin-role, how can I retrieve the password if I loose/forget it?
4. Are there any best practices regarding the roles concept of the SMA? Is it recommended to have only one role (admin)?
Even though I have found a guide how to create roles, those questions are still interesting to me.
Thank you!
Best regards
Accepted Solution
Hi Martin,
SMA is built on Java Management Extensions (JMX) interface and is instrumented using JMX objects called Managed Beans (MBeans), which expose their management interfaces to the SMA applications through a JMX agent. JMX provides a standard API to monitor and manage resources either locally or via remote access.JMX security mechanisms vary among the different web servers, look into following articles to secure SMA depending on web sever you are using:
Securing SMA on IBM Websphere:
Securing SMA on Tomcat:
https://pdn.pega.com/implementing-authentication-prsysmgmt-and-prdbutil
Securing SMA on Weblogic:
See the attached document
1. What happens when I enter a Username + Password? Is it like initially creating an Administrator role and noone has access to the SMA except the admin with the entered credentials?
Hi Martin,
SMA is built on Java Management Extensions (JMX) interface and is instrumented using JMX objects called Managed Beans (MBeans), which expose their management interfaces to the SMA applications through a JMX agent. JMX provides a standard API to monitor and manage resources either locally or via remote access.JMX security mechanisms vary among the different web servers, look into following articles to secure SMA depending on web sever you are using:
Securing SMA on IBM Websphere:
Securing SMA on Tomcat:
https://pdn.pega.com/implementing-authentication-prsysmgmt-and-prdbutil
Securing SMA on Weblogic:
See the attached document
1. What happens when I enter a Username + Password? Is it like initially creating an Administrator role and noone has access to the SMA except the admin with the entered credentials?
Authentication for prsysmgmt servlet is enabled at the application server side. Saying that user/roles/groups can be created to restrict access to SMA. Username is an administrative user with access rights to the JMX server and admin password is tje JMX server administrator’s password.
2. Where is the entered username + Passwort saved? Within PRPC? On the DB?
user/role/groups are created at the application server level to restrict access to prsysmgmt servlet
3. After having created this admin-role, how can I retrieve the password if I loose/forget it?
password to user is created at the application server level and can be retrieve/reset from there
4. Are there any best practices regarding the roles concept of the SMA? Is it recommended to have only one role (admin)?
You can set user/role/groups at application server level and restrict access to prsysmgmt servlet. Saying that you cannot restrict the SMA operations as per user basis. Either the SMA operation is blocked for all, or it is available for all (like prmbeans.properties).
Refer PDN documentation (Page 12, SMA security) - https://docs-previous.pega.com/system-management-application-reference-guide-63-sp1