IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Authentication<br />
strength<br />
policy<br />
This<br />
section<br />
consists<br />
of<br />
the<br />
following<br />
topics:<br />
v<br />
“Overview<br />
of<br />
authentication<br />
strength”<br />
v<br />
“Authentication<br />
strength<br />
configuration”<br />
on<br />
page<br />
119<br />
Overview<br />
of<br />
authentication<br />
strength<br />
<strong>WebSEAL</strong><br />
supports<br />
many<br />
authentication<br />
methods.<br />
These<br />
include<br />
basic<br />
authentication,<br />
<strong>for</strong>ms<br />
authentication,<br />
token<br />
authentication,<br />
certificate<br />
authentication,<br />
and<br />
others.<br />
Any<br />
client<br />
that<br />
accesses<br />
a<br />
<strong>WebSEAL</strong><br />
server<br />
has<br />
an<br />
authentication<br />
state,<br />
such<br />
as<br />
unauthenticated<br />
or<br />
token,<br />
which<br />
indicates<br />
the<br />
method<br />
by<br />
which<br />
the<br />
client<br />
last<br />
authenticated<br />
with<br />
<strong>WebSEAL</strong><br />
<strong>WebSEAL</strong><br />
provides<br />
a<br />
feature<br />
that<br />
enables<br />
administrators<br />
to<br />
assign<br />
a<br />
ranking<br />
or<br />
level<br />
to<br />
some<br />
of<br />
the<br />
authentication<br />
methods.<br />
Administrators<br />
can<br />
define<br />
an<br />
ordered<br />
list<br />
that<br />
ranks<br />
each<br />
authentication<br />
method<br />
from<br />
lowest<br />
to<br />
highest.<br />
This<br />
hierarchal<br />
ranking<br />
can<br />
be<br />
arbitrarily<br />
tailored<br />
to<br />
each<br />
individual<br />
<strong>WebSEAL</strong><br />
deployment.<br />
There<br />
is<br />
no<br />
absolute<br />
ranking<br />
between<br />
the<br />
authentication<br />
methods.<br />
This<br />
means<br />
that<br />
no<br />
one<br />
authentication<br />
method<br />
is<br />
inherently<br />
better<br />
or<br />
stronger<br />
than<br />
another<br />
method.<br />
The<br />
ranking<br />
is<br />
simply<br />
a<br />
method<br />
<strong>for</strong><br />
an<br />
administrator<br />
to<br />
define<br />
a<br />
relative<br />
level<br />
<strong>for</strong><br />
each<br />
authentication<br />
method<br />
<strong>for</strong><br />
use<br />
with<br />
a<br />
specific<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>WebSEAL</strong><br />
protected<br />
object<br />
namespace.<br />
The<br />
only<br />
rule<br />
governing<br />
the<br />
assignment<br />
of<br />
levels<br />
is<br />
that<br />
the<br />
unauthenticated<br />
level<br />
is<br />
always<br />
lower<br />
than<br />
all<br />
other<br />
authenticated<br />
levels.<br />
This<br />
set<br />
of<br />
authentication<br />
levels<br />
can<br />
be<br />
used<br />
to<br />
implement<br />
an<br />
authentication<br />
strength<br />
policy.<br />
Authentication<br />
strength<br />
is<br />
sometimes<br />
called<br />
step-up<br />
authentication.<br />
Note,<br />
however,<br />
that<br />
step-up<br />
authentication<br />
is<br />
not<br />
a<br />
unique<br />
authentication<br />
method<br />
like<br />
<strong>for</strong>ms<br />
authentication<br />
or<br />
certificate<br />
authentication.<br />
Instead,<br />
it<br />
is<br />
a<br />
defined<br />
process<br />
<strong>for</strong><br />
allowing<br />
users<br />
to<br />
change<br />
their<br />
current<br />
authentication<br />
method<br />
to<br />
another<br />
authentication<br />
method.<br />
The<br />
concept<br />
of<br />
changing<br />
the<br />
authentication<br />
method<br />
is<br />
useful<br />
as<br />
a<br />
way<br />
of<br />
providing<br />
additional<br />
protection<br />
<strong>for</strong><br />
selected<br />
resources<br />
in<br />
the<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>WebSEAL</strong><br />
protected<br />
object<br />
namespace.<br />
For<br />
example,<br />
a<br />
user<br />
can<br />
log<br />
in<br />
using<br />
certificate<br />
authentication,<br />
and<br />
then<br />
access<br />
many<br />
resources<br />
that<br />
are<br />
protected<br />
by<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
security.<br />
When<br />
the<br />
user<br />
attempts<br />
to<br />
access<br />
a<br />
more<br />
sensitive<br />
resource,<br />
which<br />
has<br />
been<br />
marked<br />
to<br />
require<br />
a<br />
higher<br />
level<br />
of<br />
access,<br />
the<br />
user<br />
is<br />
prompted<br />
to<br />
log<br />
in<br />
to<br />
a<br />
different<br />
authentication<br />
level.<br />
Note<br />
that<br />
when<br />
a<br />
user<br />
activates<br />
authentication<br />
strength<br />
by<br />
attempting<br />
to<br />
access<br />
a<br />
protected<br />
object,<br />
the<br />
user<br />
does<br />
not<br />
have<br />
to<br />
log<br />
out<br />
first.<br />
Instead,<br />
the<br />
user<br />
is<br />
presented<br />
with<br />
a<br />
login<br />
prompt,<br />
and<br />
simply<br />
logs<br />
in<br />
again<br />
to<br />
the<br />
higher<br />
level.<br />
Users<br />
can<br />
change<br />
authentication<br />
strength<br />
multiple<br />
times<br />
per<br />
authentication<br />
session.<br />
When<br />
a<br />
user<br />
increases<br />
authentication<br />
strength,<br />
the<br />
user<br />
can<br />
jump<br />
directly<br />
to<br />
any<br />
level<br />
that<br />
is<br />
higher<br />
than<br />
the<br />
user’s<br />
current<br />
level.<br />
The<br />
following<br />
authentication<br />
methods<br />
can<br />
be<br />
assigned<br />
an<br />
authentication<br />
level:<br />
v<br />
unauthenticated<br />
v<br />
password<br />
authentication<br />
Note<br />
that<br />
this<br />
covers<br />
both<br />
basic<br />
authentication<br />
and<br />
<strong>for</strong>ms<br />
authentication.<br />
Both<br />
of<br />
these<br />
methods<br />
are<br />
implemented<br />
by<br />
the<br />
same<br />
built-in<br />
shared<br />
library<br />
in<br />
<strong>WebSEAL</strong>.<br />
Chapter<br />
5.<br />
<strong>WebSEAL</strong><br />
security<br />
policy<br />
117