IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
Require
a
specific
authentication
strength
level
when
the
IP
address
of
the
requesting
client
is
within
a
defined
range
of
IP
addresses.
Syntax:
pdadmin>
pop
modify
pop_name
set
ipauth
add
network
netmask
level_index
Note
that
the
pdadmin
pop
modify
set
ipauth
add
command
specifies
both
the
network
addresses
and
the
required
authentication
level
in
the
IP
Endpoint
Authentication
Method
attribute.
For
example,
to
require
users
from
IP
address
range
9.1.2.[0–255]
to
use
authentication
strength
level
1:
pdadmin>
pop
modify
test
set
ipauth
add
9.1.2.1
255.255.255.0
1
Note
that
the
value
specified
for
the
netmask
determines
the
range
of
network
addresses
affected.
The
number
0
in
the
netmask
serves
as
a
wildcard
to
mean
all
IP
addresses
for
that
subnet.
See
the
example
that
follows.
Table
21.
Using
netmask
to
specify
a
network
range
Example
usage
IP
Address
Netmask
Network
range
affected
9.1.2.3
255.255.255.0
9.1.2.[0–255]
9.1.2.3
255.255.0.0
9.1.[0–255].[0–255]
9.1.2.3
255.0.0.0
9.[0–255].[0–255].[0–255]
v
Require
requests
from
one
specific
IP
address
to
use
a
specified
authentication
strength
level.
For
example,
to
require
requests
from
IP
address
9.1.2.3
to
use
authentication
strength
level
1:
pdadmin>
pop
modify
test
set
ipauth
add
9.1.2.3
255.255.255.255
1
To
require
requests
from
all
IP
addresses
on
subnet
9.1.2.x
to
use
authentication
strength
level
1:
pdadmin>
pop
modify
test
set
ipauth
add
9.1.2.3
255.255.255.0
1
v
Disable
use
of
authentication
strength
level
step-up
by
all
requests
from
a
range
of
network
addresses.
The
syntax
is:
pdadmin>
pop
modify
pop_name
set
ipauth
remove
network
netmask
For
example,
to
disable
all
requests
from
the
range
of
IP
addresses
on
the
9.1.2.x
subnet:
pdadmin>
pop
modify
test
set
ipauth
remove
9.1.2.1
255.255.255.0
v
Allow
access
to
the
protected
resource
based
solely
on
IP
address,
or
range
of
IP
addresses,
regardless
of
the
authentication
strength
level.
This
restriction
is
enforced
by
specifying
the
IP
address
or
addresses,
and
assigning
an
authentication
level
of
zero
(0).
For
example,
to
allow
requests
from
IP
address
9.1.2.3,
regardless
of
authentication
strength
level:
pdadmin>
pop
modify
test
set
ipauth
add
9.1.2.3
255.255.255.255
0
Likewise,
to
allow
requests
from
all
IP
addresses
on
the
9.1.2.x
subnet,
regardless
of
authentication
strength
level:
Chapter
5.
WebSEAL
security
policy
123