WebSphere administrative role checking within servlet context

Question

I am simply trying to check whether a given user has a given WebSphere administrative role, within a Java servlet.

The idiom:

HttpServletRequest#isUserInRole

... works for non-administrative roles, and the iscadmins administrative role defined in this documentation page.

However, all other roles in the page above (which seem to differ from iscadmins , scope-aside, by having their first letter capitalized) are not reflected when invoking isUserInRole .

I've tried checking both with the primary administrative user (file-based, created with the profile) and with other users whom I've explicitly added administrative roles to.

In all cases, only iscadmin role checks return true when assigned.

Using standard WAS 8.5.5 if that's any relevant.

I am wondering whether there is something crucial I misunderstand about security and scope in this context.

Note

I have tried different combinations to check for role names that have a first capitalized letter: as is, lowercase, all-caps, etc. even got more creative with the Admin Security Manager role...

Answer 1

After hours and hours of headaches and searches through undocumented APIs, I think I've found what I'm looking for.

Fair warning

I couldn't find any documentation about this, not even javadocs. I cannot honestly tell if this is the recommended approach.

This said, the approach below works for me (tested by assigning and removing the Admin security manager role from the logged on user, then reloading the servlet and debugging).

Also, the mistery remains on why these roles are not visible through the HttpServletRequest#isUserInRole idiom.

Code recipe

// relevant imports
import com.ibm.websphere.management.authorizer.AdminAuthorizer;
import com.ibm.websphere.management.authorizer.AdminAuthorizerFactory;
import static com.ibm.ws.security.util.Constants.*;

// you'll need the com.ibm.ws.admin.core.jar plugin in your classpath for this
AdminAuthorizer aa = AdminAuthorizerFactory.getAdminAuthorizer();

// all admin roles are there as constants, 
// save for "iscadmins", which you can retrieve with
// the HttpServletRequest#isUserInRole idiom anyway
String role = com.ibm.ws.security.util.Constants.ADMINSECURITY_ROLE;

// that's it!
boolean test = aa.isCallerInRole(role);