IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Client-side<br />
certificate<br />
authentication<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Overview<br />
of<br />
client-side<br />
certificate<br />
authentication”<br />
v<br />
“Certificate<br />
authentication<br />
configuration”<br />
on<br />
page<br />
151<br />
Overview<br />
of<br />
client-side<br />
certificate<br />
authentication<br />
Client-side<br />
certificate<br />
authentication<br />
enables<br />
a<br />
client<br />
to<br />
use<br />
a<br />
client-side<br />
digital<br />
certificate<br />
to<br />
request<br />
an<br />
authenticated<br />
identity<br />
<strong>for</strong><br />
use<br />
within<br />
a<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
secure<br />
domain.<br />
When<br />
authentication<br />
is<br />
successful,<br />
<strong>WebSEAL</strong><br />
obtains<br />
a<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
identity<br />
that<br />
is<br />
used<br />
to<br />
build<br />
a<br />
credential<br />
<strong>for</strong><br />
the<br />
user.<br />
The<br />
credential<br />
specifies<br />
the<br />
permissions<br />
and<br />
authorities<br />
to<br />
be<br />
granted<br />
to<br />
the<br />
user.<br />
Client-side<br />
certificate<br />
authentication<br />
is<br />
disabled<br />
by<br />
default.<br />
<strong>WebSEAL</strong><br />
supports<br />
client-side<br />
certificate<br />
authentication<br />
in<br />
three<br />
different<br />
modes.<br />
The<br />
administrator<br />
must<br />
specify<br />
the<br />
appropriate<br />
mode<br />
at<br />
configuration<br />
time.<br />
The<br />
following<br />
sections<br />
describe<br />
each<br />
mode:<br />
v<br />
“Required<br />
certificate<br />
authentication<br />
mode”<br />
v<br />
“Optional<br />
certificate<br />
authentication<br />
mode”<br />
v<br />
“Delayed<br />
certificate<br />
authentication<br />
mode”<br />
Required<br />
certificate<br />
authentication<br />
mode<br />
<strong>WebSEAL</strong><br />
always<br />
requires<br />
a<br />
client<br />
certificate.<br />
When<br />
the<br />
user<br />
requests<br />
access<br />
to<br />
a<br />
resource<br />
over<br />
SSL,<br />
<strong>WebSEAL</strong><br />
provides<br />
its<br />
server-certificate,<br />
which<br />
allows<br />
the<br />
client<br />
to<br />
establish<br />
an<br />
SSL<br />
session.<br />
<strong>WebSEAL</strong><br />
then<br />
asks<br />
the<br />
client<br />
<strong>for</strong><br />
a<br />
client-side<br />
certificate.<br />
If<br />
the<br />
client<br />
does<br />
not<br />
present<br />
a<br />
certificate,<br />
the<br />
SSL<br />
connection<br />
with<br />
the<br />
client<br />
is<br />
closed<br />
and<br />
client-side<br />
certificate<br />
authentication<br />
is<br />
not<br />
attempted.<br />
Optional<br />
certificate<br />
authentication<br />
mode<br />
<strong>WebSEAL</strong><br />
requests<br />
a<br />
client<br />
certificate<br />
but<br />
does<br />
not<br />
require<br />
it.<br />
When<br />
the<br />
user<br />
requests<br />
access<br />
to<br />
a<br />
resource<br />
over<br />
SSL,<br />
<strong>WebSEAL</strong><br />
provides<br />
its<br />
server-certificate,<br />
which<br />
allows<br />
the<br />
client<br />
to<br />
establish<br />
an<br />
SSL<br />
session.<br />
<strong>WebSEAL</strong><br />
then<br />
asks<br />
the<br />
client<br />
<strong>for</strong><br />
a<br />
client-side<br />
certificate.<br />
If<br />
the<br />
client<br />
presents<br />
its<br />
client-side<br />
certificate,<br />
<strong>WebSEAL</strong><br />
uses<br />
it<br />
to<br />
initiate<br />
a<br />
certificate-based<br />
authentication<br />
session.<br />
If<br />
the<br />
client<br />
does<br />
not<br />
present<br />
a<br />
client-side<br />
certificate,<br />
<strong>WebSEAL</strong><br />
allows<br />
the<br />
SSL<br />
session<br />
to<br />
continue<br />
but<br />
the<br />
user<br />
remains<br />
unauthenticated<br />
to<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong>.<br />
Delayed<br />
certificate<br />
authentication<br />
mode<br />
In<br />
this<br />
mode,<br />
<strong>WebSEAL</strong><br />
does<br />
not<br />
request<br />
a<br />
client<br />
certificate<br />
<strong>for</strong><br />
the<br />
purpose<br />
of<br />
client-side<br />
certificate<br />
authentication<br />
until<br />
the<br />
client<br />
attempts<br />
to<br />
access<br />
a<br />
protected<br />
resource<br />
that<br />
requires<br />
certificate-based<br />
authentication.<br />
When<br />
the<br />
user<br />
requests<br />
access<br />
to<br />
a<br />
resource<br />
over<br />
SSL,<br />
<strong>WebSEAL</strong><br />
provides<br />
its<br />
server-certificate,<br />
which<br />
allows<br />
the<br />
client<br />
to<br />
establish<br />
an<br />
SSL<br />
session.<br />
<strong>WebSEAL</strong><br />
checks<br />
the<br />
security<br />
policy<br />
on<br />
the<br />
requested<br />
resource<br />
to<br />
determine<br />
if<br />
certificate<br />
authentication<br />
is<br />
required.<br />
The<br />
security<br />
policy<br />
is<br />
described<br />
in<br />
the<br />
contents<br />
of<br />
an<br />
access<br />
control<br />
list<br />
(ACL)<br />
or<br />
protected<br />
object<br />
policy<br />
(POP)<br />
that<br />
has<br />
been<br />
attached<br />
to<br />
the<br />
protected<br />
resource.<br />
If<br />
the<br />
security<br />
policy<br />
does<br />
not<br />
require<br />
certificate<br />
authentication,<br />
<strong>WebSEAL</strong><br />
does<br />
not<br />
request<br />
a<br />
client-side<br />
digital<br />
certificate.<br />
Chapter<br />
6.<br />
Authentication<br />
149
Change language