test

Sun Java System Portal Server 7.1 Release Notes

Securing Data in Java DB Database for Portal Server

There are two portal components that use the relational database: community membership and configuration and portlet applications, such as wiki, survey, and filesharing. By default, Portal Server uses Java DB. After the installation, Portal Server can be configured to switch to Oracle. In that case, you need to shut down the Java DB database.

Java DB should also be stopped if community features and the portlet application are not used in the deployed portal.

For each portal component using relational database, a separate database instance is configured with default userid and password. The default userid is "portal" and the default password is "portal". After the installation, you are recommended to change the default password and the access permissions of the properties files containing them.

ProcedureTo Secure the Community Membership and Configuration Database

Repeat the following instructions for each portal in your environment. Replace the <portal-ID> string with actual portalid (for example, portal1, portal2, and so on).

  1. Restart the Java DB.

  2. Use Derby CLI or any other equivalent tool to change the password for default user portal by connecting to the communitymc_portal-ID database. If you are using a GUI like SQuirrel-j, use the sql editor to execute the following command after connecting to the PS's Java DB database.CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.portal', 'your-new-password');

  3. Restart Java DB.

  4. Use Java DB command line or any other equivalent tool to connect to the communitymc_portalID database with new password to verify that the password was set correctly.

  5. For each portal instance do the following.

    1. Refer to the Web container's administrator guide and change the password for the jdbc/communitymc datasource to the new password that was set in step 2.

    2. Open the PortalServer-data-dir/portals/portal-ID/config/portal.dbadmin file and change the password for the property community.db.password to the new password that you set using the Java DB CLI or any other equivalent tool in step 2.

    3. Change permission of the PortalServer-DataDir/portals/portal-ID/config/portal.dbadmin file so that it is readable and writable only by the owner (for example, chmod 600 portal.dbadmin).

    4. Restart the web container.

ProcedureTo Secure Data for Fileshare Portlet Application

Repeat the following instructions for each portal in your environment. Replace the <portal-ID> string with actual portalid (for example, portal1, portal2, and so on).

  1. Restart the Java DB.

  2. Use Java DB CLI or any other equivalent tool to change the password for default user "portal" by connecting to the filesharingdb_portal-ID database. If you are using Squirrel-j, you need to execute the following steps on your sql editor.


    CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.authentication.provider', 'BUILTIN');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.connection.requireAuthentication', 'true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.user.portal', 'your-new-password');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.fullAccessUsers', 'portal');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.defaultConnectionMode', 'noAccess');

  3. Restart Java DB.

  4. Use Java DB command line or any other equivalent tool to connect to the filesharingdb_portal-ID database with new password to verify that the password was set correctly.

  5. For each portal instance do the following.

    1. Refer to Web container's administrator guide and change the password for the jdbc/FileSharingDB datasource to the new password that was set in step 2.

    2. Open PortalServer-DataDir/portals/portal-ID/portletapps/filesharing/tokens.properties file and change the password value for the property DB_ADMIN_PASSWORD and DB_PASSWORD to the new password that you set using the Java DB CLI or any other equivalent tool in step 2.

    3. Change permission of the PortalServer-DataDir/portals/portal-ID/portletapps/filesharing/tokens.properties file so that it is readable and writable only by the owner (for example, chmod 600 tokens.properties).

    4. Restart the web container.

ProcedureTo Secure Data for Wiki Portlet Application

Repeat the following instructions for each portal in your environment. Replace the <portal-ID> string with actual portalid (for example, portal1, portal2, and so on).

  1. Restart the Java DB.

  2. Use Java DB CLI or any other equivalent tool to change the password for default user "portal" by connecting to the wikidb_portal-ID database. If you are using Squirrel-j, you need to execute the following steps on your sql editor. 


    CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.authentication.provider', 'BUILTIN');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.connection.requireAuthentication', 'true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.user.portal', 'your-new-password');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.fullAccessUsers', 'portal');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.defaultConnectionMode', 'noAccess');

  3. Restart the Java DB.

  4. Use Java DB command line or any other equivalent tool to connect to the wikidb_portal-ID database with new password to verify that the password was set correctly.

  5. For each portal instance do the following.

    1. Refer to the web container's administrator guide and change the password for the jdbc/WikiDB datasource to the new password that was set in step 2.

    2. Open the PortalServer-DataDir/portals/portal-ID/portletapps/wiki/tokens.properties file and change the password value for the property DB_ADMIN_PASSWORD and DB_PASSWORD to the new password that you set using the Java DB CLI or any other equivalent tool in step 2.

    3. Change permission of the PortalServer-DataDir/portals/portal-ID/portletapps/wiki/tokens.properties file so that it is readable and writable only by the owner (for example, chmod 600 tokens.properties).

  6. Restart the web container.

ProcedureTo Secure Data for Surveys Portlet Application

Repeat the following instructions for each portal in your environment. Replace the <portal-ID> string with actual portalid (for example, portal1, portal2, and so on).

  1. Restart the Java DB.

  2. Use Java DB CLI or any other equivalent tool to change the password for default user "portal" by connecting to the surveysdb_portal-ID database. If you are using Squirrel-j, you need to execute the following steps on your sql editor. 


    CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.authentication.provider', 'BUILTIN');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.connection.requireAuthentication', 'true');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.user.portal', 'your-new-password');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.fullAccessUsers', 'portal');
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY
	('derby.database.defaultConnectionMode', 'noAccess');

  3. Restart the Java DB.

  4. Use Java DB command line or any other equivalent tool to connect to the surveysdb_portal-ID database with new password to verify that the password was set correctly.

  5. For each portal instance do the following.

    1. Refer to the web container's administrator guide and change the password for the jdbc/SurveysDB datasource to the new password that was set in step 2.

    2. Open the PortalServer-DataDir/portals/portal-ID/portletapps/surveys/tokens.properties file and change the password value for the property DB_ADMIN_PASSWORD and DB_PASSWORD to the new password that you set using the Java DB CLI or any other equivalent tool in step 2.

    3. Change permission of the PortalServer-DataDir/portals/portal-ID>/portletapps/surveys/tokens.properties file so that it is readable and writable only by the owner (for example, chmod 600 tokens.properties).

    4. Restart the web container.