IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
token
authentication
v
certificate
authentication
Authentication
strength
is
supported
over
both
HTTP
and
HTTPS,
with
the
exception
of
certificate
authentication.
Since
certificates
are
valid
only
over
an
SSL
connection,
it
is
not
possible
to
step
up
to
certificates
over
HTTP.
If
an
object
that
requires
certificate
authentication
is
requested
over
HTTP,
an
error
page
will
be
served,
as
specified
by
the
certstepup
entry
in
the
[acnt-mgt]
stanza
of
the
WebSEAL
configuration
file.
Administrators
apply
the
authentication
levels
to
a
protected
resource
by
declaring
and
attaching
a
Tivoli
Access
Manager
protected
object
policy
(POP)
to
the
resource
object.
The
POP
is
a
standard
Tivoli
Access
Manager
POP.
Authentication
strength
policy
is
set
and
stored
in
a
POP
attribute
called
an
IP
Endpoint
Authentication
Method.
The
attribute
takes
an
integer
value
that
represents
the
authentication
level.
The
lowest
level,
unauthenticated,
is
always
0.
Each
level
increases
the
integer
index
up
to
the
total
number
of
authentication
methods
that
have
been
assigned
a
level.
When
clients
first
authenticate
to
WebSEAL,
the
authentication
method
used
is
stored
as
an
extended
attribute
in
the
client’s
credential.
The
Tivoli
Access
Manager
authorization
service
compares
the
authentication
method
(level)
in
the
credential
against
the
authentication
level
for
the
requested
resource,
as
specified
in
the
POP.
When
the
level
in
the
POP
exceeds
the
level
in
the
credential,
the
user
is
prompted
to
increase
the
authentication
strength
level.
The
IP
Endpoint
Authentication
Method
attribute
can
also
optionally
be
used
to
restrict
access
to
a
resource,
based
on
the
network
address
of
the
client
that
sent
the
access
request.
The
access
can
be
restricted
based
on
an
individual
network
(IP)
address,
or
a
range
of
network
addresses.
WebSEAL
uses
the
following
algorithm
to
process
the
conditions
in
a
POP:
1.
Check
the
IP
endpoint
authentication
method
policy
on
the
POP.
2.
Check
ACL
permissions.
3.
Check
time-of-day
policy
on
the
POP.
4.
Check
the
audit
level
policy
on
the
POP.
118
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide