Configuration Guides › Policy Server Configuration Guide › Administrative User Interface Management › SiteMinder Administrators › How to Configure an External Administrator Store › External Administrator Store Considerations

External Administrator Store Considerations

Before you configure an external administrator store connection, consider the following:

• Important! Discontinuing the use of the policy store as the source of administrator identities is permanent. This only affects the Administrative UI that is configured to use the external store. Any other Administrative UI not yet configured to use the external store continues to use the policy store to identify administrators.
• Legacy Administrators, including the default SOA Security Manager super user account, can continue to do the following:
  • Manage the Policy Management API
  • Function as a Trusted Host administrator
  • Use Policy Server tools, such as smobjimport and smobjexport
• Legacy Administrators, including the default SOA Security Manager super user account, can no longer manage SOA Security Manager objects in the Administrative UI.
• If you have Legacy Administrators who must continue using the Administrative UI, use your vendor-specific tools to add these users to the external store. Once the user identities are established in the external store, you can reinstate these privileges by mapping the existing user paths from the policy store to the external store.

  Important! External administrator authentication does not let a single Legacy Administrator account retain rights to the Administrative UI, the Policy Management API, and Trusted Host privileges at the same time. If a Legacy Administrator must continue functioning in these roles, leave the Legacy Administrator unchanged. Be sure that the user is present in the external store and separately configure a new Administrator using the external user identity.

• A super user that you identify when configuring the connection to the external store replaces the default SOA Security Manager super user account. The external user becomes the super user and has maximum permissions in the Administrative UI and access to all Policy Server tools.

  Use the external super user to delegate permissions to new Administrators.

• If multiple Administrative UI instances are to use to use the same administrator authentication store, be sure to configure each connection using the same network identifier. Mixing network identifiers for multiple Administrative UI connections to the same external administrator authentication store is not supported.

  Example: If you configured the first connection with 172.16.0.0, create subsequent connections with 172.16.0.0. If you configured the first connection with comp001@example.com, create subsequent connections with comp001@example.com.