Home
User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
Securing
These topics describe the security features of WebSphere Commerce and how to configure these features.
Quick reference to user IDs, passwords, and Web addresses
Administration in the WebSphere Commerce environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the WebSphere Commerce user IDs, the default passwords are identified.
Generating WebSphere Commerce encrypted passwords
You can generate encrypted passwords in order to manually reset the password of a user from a command line. There are other tools (such as the ResetPassword command) that accomplish the same task. To manually reset the password, the administrator would take the encrypted password that is output by the utilities and update the LOGONPASSWORD field of the USERREG table. The administrator would also update the SALT field of the USERREG table with the chosen salt.

User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
- Planning
  Creating a custom implementation of a WebSphere Commerce store requires a significant amount of planning. From gathering client needs, to deploying the live solution, much work is needed to successfully deploy a custom client store. Use the resources in here to help you plan every phase of store creation.
- Installing
  Review the following sections for information about installing the WebSphere Commerce product, associated maintenance, and WebSphere Commerce enhancements.
- Migrating
  Before you migrate to WebSphere Commerce Version 8.0, review this information to help plan and execute your migration.
- Deploying
  The topics in this section describe how to publish stores to either a test or production environment, and how to deploy customized code.
- Operating
- Integrating
  Topics in the Integrating category highlight the tasks that are commonly performed for using WebSphere Commerce in combination with other products.
- Administering
- Tutorials
  WebSphere Commerce provides many tutorials to help you customize and understand your WebSphere Commerce instance and stores.
- Samples
- Developing
  The topics in the Developing section describe tasks performed by an application developer.
- Compliance
  The following section describes how you can leverage WebSphere Commerce features and functionality to help your site be compliant with different privacy and security standards.
- Securing
  These topics describe the security features of WebSphere Commerce and how to configure these features.
  - WebSphere Commerce security model
    Authentication is the process of verifying that users or applications are who they claim to be. In a WebSphere Commerce system, authentication is required for all users and applications that access the system, except for guest customers.
  - WebSphere Commerce authentication model
    The WebSphere Commerce authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
  - Authorization
    WebSphere Commerce views access control or authorization as the process of verifying that users or applications have sufficient authority to access a resource. This section describes the details of several aspects of WebSphere Commerce access control.
  - Security standards
    Some main security standards are: NIST SP 800-131A, FIPS 140-2 and PCI.
  - Security bulletins
    WebSphere Commerce releases security bulletins for APARs that address issues that are considered to be security vulnerabilities. These bulletins provide security risk assessment information to help you assess if a particular issue might impact your organization.
  - Security fixes
    The following WebSphere Commerce releases contain security fixes for defects that are considered to be security vulnerabilities. The following details provide security risk assessment information to help you assess if a particular issue might impact your organization.
  - Hardening site security checklist
    To harden the security of your WebSphere Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.
  - Site security considerations
    To enhance the security of your WebSphere Commerce site, you can enable various features in Configuration Manager and the Administration Console.
  - Session management
    Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
  - Quick reference to user IDs, passwords, and Web addresses
    Administration in the WebSphere Commerce environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the WebSphere Commerce user IDs, the default passwords are identified.
    - Changing the Configuration Manager password
      You can change the password to access the Configuration Manager client. Two methods are available to change the password.
    - Changing database passwords
      You can change database user passwords (DBUserPwd) and database administrator passwords (DBAPwd) by updating the WebSphere Commerce configuration file and updating properties in the WebSphere Application Server administrative console.
    - Setting your IBM HTTP Server administrator password
      You can set your IBM HTTP Server administrator password.
    - Changing the SSL key file password
      If you are using IBM HTTP Server, follow these steps to change your SSL key file password.
    - Generating WebSphere Commerce encrypted passwords
      You can generate encrypted passwords in order to manually reset the password of a user from a command line. There are other tools (such as the ResetPassword command) that accomplish the same task. To manually reset the password, the administrator would take the encrypted password that is output by the utilities and update the LOGONPASSWORD field of the USERREG table. The administrator would also update the SALT field of the USERREG table with the chosen salt.
    - Resetting accounts
      If a WebSphere Commerce account gets locked or disabled for some reason, an administrator can unlock or enable the account.
    - LDAP server password storage consideration
      If you have chosen to use LDAP as your user registry, you should decide how you want your passwords to be stored. Many LDAP servers will provide options for encrypting or hashing the passwords, and sometimes even allow the passwords to be stored in plain text. Although the decision on how to store the password has no impact on the integration with WebSphere Commerce, you should investigate your settings and ensure that they comply with your security requirements. For information about configuring your LDAP server, refer to the product documentation provided with your LDAP server.
  - Enabling WebSphere Application Server security
    You can enable WebSphere Application Server security, which includes two orthogonal components: WebSphere global security and Java 2 security.
- Performance
- Troubleshooting

Generating WebSphere Commerce encrypted passwords

You can generate encrypted passwords in order to manually reset the password of a user from a command line. There are other tools (such as the ResetPassword command) that accomplish the same task. To manually reset the password, the administrator would take the encrypted password that is output by the utilities and update the LOGONPASSWORD field of the USERREG table. The administrator would also update the SALT field of the USERREG table with the chosen salt.

Procedure

Go to the following directory:
- WC_installdir/bin
- WC_installdir\bin
Generate an encrypted password:
- Run the wcs_password utility using the wcs_password command.
- Run the wcs_password utility using the wcs_password.sh command.