IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Authentication
strength
policy
This
section
consists
of
the
following
topics:
v
“Overview
of
authentication
strength”
v
“Authentication
strength
configuration”
on
page
119
Overview
of
authentication
strength
WebSEAL
supports
many
authentication
methods.
These
include
basic
authentication,
forms
authentication,
token
authentication,
certificate
authentication,
and
others.
Any
client
that
accesses
a
WebSEAL
server
has
an
authentication
state,
such
as
unauthenticated
or
token,
which
indicates
the
method
by
which
the
client
last
authenticated
with
WebSEAL
WebSEAL
provides
a
feature
that
enables
administrators
to
assign
a
ranking
or
level
to
some
of
the
authentication
methods.
Administrators
can
define
an
ordered
list
that
ranks
each
authentication
method
from
lowest
to
highest.
This
hierarchal
ranking
can
be
arbitrarily
tailored
to
each
individual
WebSEAL
deployment.
There
is
no
absolute
ranking
between
the
authentication
methods.
This
means
that
no
one
authentication
method
is
inherently
better
or
stronger
than
another
method.
The
ranking
is
simply
a
method
for
an
administrator
to
define
a
relative
level
for
each
authentication
method
for
use
with
a
specific
Tivoli
Access
Manager
WebSEAL
protected
object
namespace.
The
only
rule
governing
the
assignment
of
levels
is
that
the
unauthenticated
level
is
always
lower
than
all
other
authenticated
levels.
This
set
of
authentication
levels
can
be
used
to
implement
an
authentication
strength
policy.
Authentication
strength
is
sometimes
called
step-up
authentication.
Note,
however,
that
step-up
authentication
is
not
a
unique
authentication
method
like
forms
authentication
or
certificate
authentication.
Instead,
it
is
a
defined
process
for
allowing
users
to
change
their
current
authentication
method
to
another
authentication
method.
The
concept
of
changing
the
authentication
method
is
useful
as
a
way
of
providing
additional
protection
for
selected
resources
in
the
IBM
Tivoli
Access
Manager
WebSEAL
protected
object
namespace.
For
example,
a
user
can
log
in
using
certificate
authentication,
and
then
access
many
resources
that
are
protected
by
Tivoli
Access
Manager
security.
When
the
user
attempts
to
access
a
more
sensitive
resource,
which
has
been
marked
to
require
a
higher
level
of
access,
the
user
is
prompted
to
log
in
to
a
different
authentication
level.
Note
that
when
a
user
activates
authentication
strength
by
attempting
to
access
a
protected
object,
the
user
does
not
have
to
log
out
first.
Instead,
the
user
is
presented
with
a
login
prompt,
and
simply
logs
in
again
to
the
higher
level.
Users
can
change
authentication
strength
multiple
times
per
authentication
session.
When
a
user
increases
authentication
strength,
the
user
can
jump
directly
to
any
level
that
is
higher
than
the
user’s
current
level.
The
following
authentication
methods
can
be
assigned
an
authentication
level:
v
unauthenticated
v
password
authentication
Note
that
this
covers
both
basic
authentication
and
forms
authentication.
Both
of
these
methods
are
implemented
by
the
same
built-in
shared
library
in
WebSEAL.
Chapter
5.
WebSEAL
security
policy
117