Removing Security Access Manager | HCL Digital Experience
After you install and use IBM Security Access Manager, you might find that you no longer require its use. You can then remove it from the HCL Digital Experience environment and restore authentication capabilities to IBM WebSphere Application Server and authorization capabilities to HCL Digital Experience.
About this task
Complete the following steps to remove Security Access Manager from the HCL Digital Experience environment:
Procedure
- Complete the following steps, from the WebSphere® Integrated Solutions Console, if you configured Security Access Manager for authentication:
- Select .
- Delete com.ibm.sec.authn.tai.TAMETai or if you are still using the deprecated Trust Association Interceptors (TAIs) implementation, delete com.ibm.ws.security.web.TAMTrustAssociationInterceptorPlus.
- Click OK then Save.
- Optional:
Complete the following steps, from the WebSphere® Integrated Solutions Console (WAS), if you configured
Security Access Manager for authorization:
- Login to the WAS console/DMGR.
- Navigate to All Scopes. . Then, click on
- Navigate to WP ExternalAccessControlService, then select Custom Properties.
- Delete all custom properties in this section, then save changes.
- Navigate to WP AccessControlService, then select Custom Properties.
- Update the property accessControlConfig.enableExternalization from TRUE to FALSE.
- Navigate to one more time.
- Select WP AccessControlDataManagementService, then select Custom Properties.
- Delete the accessControlDataManagement.cacheTimeout and accessControlDataManagement.reorderRoleNames custom properties.
- Save all changes and sync the nodes, if cluster
- On the Portal server itself, edit the services.properties file that is found in the wp_profile_root/PortalServer/config/config directory.
- Find the value com.ibm.wps.services.ac.ExternalAccessControlService and change it to com.ibm.wps.ac.impl.ExternalAccessControlDefaultImpl.
- Restart the Portal server(s).
- Optional: Complete the following steps to remove
the credential vault adapter and its associated segments if you configured
it for Security Access Manager:
- Optional: If you enabled user provisioning, go to Disabling user provisioning.
- Optional: Restore the backup copy of the theme so that the login and logout pages restore to the default before Security Access Manager was enabled.
- Optional: Remove all junction points, access control lists (ACLs), protected objectspace entries (POS entries), custom actions, and custom action groups.
- Optional: Run the following task to remove
the connection to Security Access Manager:
- AIX® HP-UX Linux™ Solaris: ./ConfigEngine.sh run-svrssl-unconfig -DWasPassword=password -Dwp.ac.impl.PDAdminPwd=password from the wp_profile_root/ConfigEngine directory
- IBM® i: ConfigEngine.sh run-svrssl-unconfig -DWasPassword=password -Dwp.ac.impl.PDAdminPwd=password from the wp_profile_root/ConfigEngine directory
- Windows™: ConfigEngine.bat run-svrssl-unconfig -DWasPassword=password -Dwp.ac.impl.PDAdminPwd=password from the wp_profile_root\ConfigEngine directory
- z/OS®: ./ConfigEngine.sh run-svrssl-unconfig -DWasPassword=password -Dwp.ac.impl.PDAdminPwd=password from the wp_profile_root/ConfigEngine directory
Clustered environments:- Complete this step on all nodes.
- WasPassword is the Deployment Manager administrative password.
Tip: If the connection still shows up after you run this task, go to Invalid or Stale Server Definitions for more information. - If necessary, uninstall any Security Access Manager components.
- Stop and restart the appropriate servers to propagate the changes. For specific instructions, see Starting and stopping servers, deployment managers, and node agents.