IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Overview
of
the
authentication
process
Authentication
is
the
method
of
identifying
an
individual
process
or
entity
that
is
attempting
to
login
to
a
secure
domain.
v
WebSEAL
supports
several
authentication
methods
by
default
and
can
be
customized
to
use
other
methods.
v
The
result
of
successful
authentication
to
WebSEAL
is
a
Tivoli
Access
Manager
user
registry
identity.
v
WebSEAL
uses
this
identity
to
obtain
a
credential
for
that
user.
v
The
authorization
service
uses
this
credential
to
permit
or
deny
access
to
protected
objects
after
evaluating
the
ACL
permissions
and
POP
conditions
governing
the
policy
for
each
object.
Note:
ACL
=
access
control
list
policy
POP
=
protected
object
policy
During
authentication,
WebSEAL
examines
a
client
request
for
the
following
information:
v
Session
data
Session
data
is
information
that
identifies
a
specific
connection
between
the
client
and
the
WebSEAL
server.
Session
data
is
stored
with
the
client
and
accompanies
subsequent
requests
by
that
client.
It
is
used
to
re-identify
the
client
session
to
the
WebSEAL
server
and
avoid
the
overhead
of
establishing
a
new
session
for
each
request.
v
Authentication
data
Authentication
data
is
information
from
the
client
that
identifies
the
client
to
the
WebSEAL
server.
Authentication
data
types
include
client-side
certificates,
passwords,
and
token
codes.
When
WebSEAL
receives
a
client
request,
WebSEAL
always
looks
for
session
data
first,
followed
by
authentication
data.
The
initial
client
request
never
contains
session
data.
Supported
session
data
types
WebSEAL
supports
the
following
session
data
types:
v
SSL
ID
(defined
by
the
SSL
protocol)
v
Server-specific
session
cookie
v
BA
header
data
v
HTTP
header
data
v
IP
address
When
WebSEAL
examines
a
client
request,
it
searches
for
session
data
in
the
order
specified
in
this
list.
Supported
authentication
methods
Although
WebSEAL
functions
independently
of
the
authentication
process,
WebSEAL
uses
credentials
to
monitor
all
users
participating
in
the
secure
domain.
To
obtain
the
necessary
identity
information
for
credentials
acquisition,
WebSEAL
relies
on
the
information
gained
from
the
authentication
process.
The
following
table
lists
the
authentication
methods
supported
by
WebSEAL
for
credentials
acquisition.
When
WebSEAL
examines
a
client
request,
it
searches
for
authentication
data
in
the
order
specified
in
this
table.
130
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide