TEC Workbook - IBM

Lab 4 Access Control Framework
Prerequisites: This lab requires the completion of labs 1 through 3.
IBM Software
Up until now, you’ve seen how WebSphere DataPower can protect XML Web traffic using built-in XML
threat protection, digital signatures, and encryption. This lab will introduce the access control framework
which provides authentication, authorization, and audit services. Collectively, this is referred to as AAA.
An AAA policy identifies a set of resources and procedures used to determine whether or not a
requesting client is granted access to a specific service, file, or document. AAA policies are thus filters in
that they accept or deny a specific client request. Basic AAA processing is depicted in the figure below.
4.1 Extract identity & extract resource
The first action that occurs is to extract the claimed identity of the service requester and the requested
resource from an incoming message and its protocol envelope. WebSphere DataPower appliances
provide an extensive list of predefined identity and resource extraction methods. For example, the
identity can be based on IP address, account name/password, SAML assertion, or other criteria, while
the requested resource can be specified by (among others) an HTTP URL, a namespace, or a WSDL
method.
4.2 Authenticate
If the identity is successfully extracted from the message, it will then be authenticated. Authentication is
most commonly accomplished via an external service such as Tivoli Access Manager or LDAP. If the
authentication is successful, the process enters the resource and credential mapping phase.
Lab 4 - Access Control Framework Page 69