IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Table
20.
Example
integer
values
for
authentication
strength
levels
(continued)
password
1
certificate
2
For
example,
to
add
the
password
authentication
strength
level
(index
value
1)
to
the
test
POP,
enter:
pdadmin>
pop
modify
test
set
ipauth
anyothernw
1
To
verify
the
modification,
display
the
POP:
pdadmin>
pop
show
test
Protected
object
policy:
test
Description:
Test
POP
Warning:
no
Audit
level:
none
Quality
of
protection:
none
Time
of
day
access:
sun,
mon,
tue,
wed,
thu,
fri,
sat:
anytime:local
IP
Endpoint
Authentication
Method
Policy
Any
Other
Network
1
Note:
In
the
above
example,
the
only
valid
index
values
are:
0,1,2.
If
any
other
index
value
is
configured,
WebSEAL
presents
an
error
page
whenever
a
client
requests
any
object
with
that
has
the
POP
attached.
Specify
network-based
access
restrictions
Tivoli
Access
Manager
supports
an
optional
POP
configuration
setting
that
enables
the
application
of
authentication
strength
levels
to
client
requests
originating
from
specified
network
addresses.
The
network
addresses
can
be
defined
as
either
a
single
IP
address,
or
as
a
range
of
IP
addresses.
Note:
In
most
deployments,
user
access
is
not
restricted
based
on
the
IP
address
within
POPs.
In
most
deployments,
this
configuration
section
can
be
skipped.
The
pdadmin
pop
modify
set
ipauth
command
is
used
to
specify
IP
addresses.
Note
that
this
is
the
same
pdadmin
command
used
to
specify
authentication
levels.
The
default
usage
of
pdadmin
pop
modify
set
ipauth
does
not
impose
any
network-based
access
restrictions.
This
usage
consists
of
specifying
the
command
line
argument
anyothernw
as
the
value
for
the
IP
Endpoint
Authentication
Method
Policy
attribute.
This
setting
applies
to
all
user
access,
regardless
of
the
IP
address
of
the
requestor,
and
requires
all
users
to
authenticate
at
the
specified
level.
The
syntax
is:
pdadmin>
pop
modify
pop-name
set
ipauth
anyothernw
level_index
For
example,
in
“Create
a
protected
object
policy”
on
page
121
above,
the
following
command
created
a
POP
that
required
all
users
to
authenticate
at
authentication
level
1,
and
did
not
impose
any
network-based
access
requirements:
pdadmin>
pop
modify
test
set
ipauth
anyothernw
1
The
following
network-based
access
restrictions
can
be
applied:
122
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide