Loading access control policy definitions and other policy-related elements

To load access control policy definitions, run the acpload script. This script loads the following elements: <Action>, <ActionGroup>, <Attribute>, <ResourceCategory>, <ResourceGroup>, <Relation>, <RelationGroup>, <Policy>, <PolicyGroup>.

  1. To load the access groups and access control policies, you need to run the following related utilities in this sequence:
    1. acugload (loads the user access group definitions)
    2. acpload (loads the main access control policy)
    3. acpnlsload (loads the display names and descriptions)
  2. If you create customized XML files, you need to copy them into the WC_installdir/xml/policies/xml directory to have them loaded into the databases.
  3. There is a setting in the loading scripts that specifies the following parameter setting while resolving ID's and loading the data to the database: "-maxerror 100000". This means that if there up to 100000 foreign key violations while loading the data, they will be ignored, instead of aborting. This value can be increased or decreased as needed. For example, if you want to stop after one such error, you would change the value to 1.
  4. For IBM i OS operating system If you create customized XML files, you must use the full path to the DTD in your file. The access control policies DTDs are located in the WC_installdir/xml/policies/dtd directory.
  5. When creating a custom policy, do not alter the defaultAccessControlPolicies.xml file. Use this file as a reference to see the structure when creating a custom policy.

Procedure

  1. Ensure that you have loaded the user access group definitions.
  2. Copy your customized access control policy files to the following directory:
    • LinuxAIXFor IBM i OS operating systemWC_installdir/xml/policies/xml
    • Windows WC_installdir\xml\policies\xml

    The customized XML files must conform to the accesscontrolpolicies.dtd file in the following directory:

    • LinuxAIXFor IBM i OS operating system WC_installdir/xml/policies/dtd
    • Windows WC_installdir\xml\policies\dtd
  3. To run the utility:

    LinuxAIX You must login as a user which has the following permissions:

    • Read/write/execute authority to the directories, subdirectories, and files of WC_installdir/xml/policies and WC_installdir/logs.
    • Read/execute authority to the WC_installdir/bin directory and its files.

      If the user does not have the required authority, you need to grant this authority using the chmod command.

    For IBM i OS operating system You must login with a profile which has the following permissions:
    • Read/write/execute authority to files under WC_installdir/xml/policies, WC_userdir /instances and WC_userdir /instances/ instance_name/logs.
    • Read/execute authority to the WC_installdir/bin directory and its files.

      For example, define the profile with USRCLS *SECOFR.

  4. From the WC_installdir/bin directory, type the following:
    • LinuxAIXFor IBM i OS operating system ./acpload.sh database_name database_user database_user_password policies_xml_file schema_name
    • Windows acpload.cmd database_name database_user database_user_password policies_xml_file schema_name
    • Apache Derby acpload policies_xml_file

    where:

    database_name
    Required: Name of the database in which to load the policy.
    database_user
    Required: Name of the database user who can connect to the database.
    database_user_password
    Required: The associated password for the database user.
    policies_xml_file
    Required: The input policy XML file that specifies what policy data to load into the database.
    schema_name
    Optional: The name of target database schema. This name is normally the same as database_user.
    • For example: LinuxAIXFor IBM i OS operating system
      ./acpload.sh mall dbuser dbusrpwd defaultAccessControlPolicies.xml
      Windows
      acpload.cmd mall dbuser dbusrpwd defaultAccessControlPolicies.xml
  5. Check for errors in the log files. Note that errors might not appear on the command line.
    1. LinuxAIXWindows Check the acpload.log and messages.txt files in the following directory: WC_installdir/logs
    2. For IBM i OS operating system Check the acpload.log and messages.txt files in the following directories:
      • WC_userdir /instances/acpload.log
      • WC_userdir /instances/ instance_name/logs/messages.txt
    3. Any error files generated in WC_installdir/xml/policies/xml directory.
  6. Update the registries: Access Control Policies and Access Control Policy Groups.