IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Switch<br />
user<br />
authentication<br />
The<br />
<strong>WebSEAL</strong><br />
switch<br />
user<br />
function<br />
allows<br />
administrators<br />
to<br />
assume<br />
the<br />
identity<br />
of<br />
a<br />
user<br />
who<br />
is<br />
a<br />
member<br />
of<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
secure<br />
domain.<br />
The<br />
ability<br />
to<br />
assume<br />
a<br />
user’s<br />
identity<br />
can<br />
help<br />
an<br />
administrator<br />
in<br />
a<br />
Help<br />
Desk<br />
environment<br />
to<br />
troubleshoot<br />
and<br />
diagnose<br />
problems.<br />
Switch<br />
user<br />
can<br />
also<br />
be<br />
used<br />
to<br />
test<br />
a<br />
user’s<br />
access<br />
to<br />
resources<br />
and<br />
to<br />
per<strong>for</strong>m<br />
application<br />
integration<br />
testing.<br />
Read<br />
this<br />
entire<br />
section<br />
to<br />
ensure<br />
that<br />
you<br />
understand<br />
the<br />
switch<br />
user<br />
function<br />
be<strong>for</strong>e<br />
configuring<br />
and<br />
using<br />
it.<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Overview<br />
of<br />
the<br />
switch<br />
user<br />
function”<br />
v<br />
“Configuration<br />
procedure”<br />
on<br />
page<br />
190<br />
v<br />
“Using<br />
switch<br />
user”<br />
on<br />
page<br />
195<br />
v<br />
“Developing<br />
a<br />
custom<br />
authentication<br />
module<br />
<strong>for</strong><br />
switch<br />
user”<br />
on<br />
page<br />
197<br />
Overview<br />
of<br />
the<br />
switch<br />
user<br />
function<br />
The<br />
switch<br />
user<br />
implementation<br />
is<br />
similar<br />
to<br />
the<br />
su<br />
command<br />
in<br />
UNIX<br />
environments.<br />
In<br />
the<br />
<strong>WebSEAL</strong><br />
environment,<br />
the<br />
administrator<br />
acquires<br />
the<br />
user’s<br />
credentials<br />
and<br />
interacts<br />
with<br />
resources<br />
and<br />
back-end<br />
applications<br />
with<br />
the<br />
exact<br />
same<br />
abilities<br />
as<br />
the<br />
actual<br />
user.<br />
The<br />
administrator<br />
uses<br />
a<br />
special<br />
HTML<br />
<strong>for</strong>m<br />
to<br />
supply<br />
switch<br />
user<br />
in<strong>for</strong>mation.<br />
<strong>WebSEAL</strong><br />
processes<br />
the<br />
<strong>for</strong>m<br />
and<br />
activates<br />
a<br />
special<br />
authentication<br />
mechanism<br />
that<br />
returns<br />
the<br />
specified<br />
user’s<br />
credential<br />
without<br />
the<br />
requirement<br />
of<br />
knowing<br />
the<br />
user’s<br />
password.<br />
The<br />
following<br />
sequence<br />
describes<br />
the<br />
switch<br />
user<br />
process<br />
flow:<br />
1.<br />
An<br />
administrator<br />
authenticates<br />
to<br />
<strong>WebSEAL</strong>.<br />
<strong>WebSEAL</strong><br />
establishes<br />
a<br />
session<br />
<strong>for</strong><br />
the<br />
administrator,<br />
and<br />
creates<br />
an<br />
entry<br />
<strong>for</strong><br />
the<br />
administrator<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
session<br />
cache.<br />
The<br />
session<br />
cache<br />
entry<br />
contains<br />
a<br />
cache<br />
data<br />
structure.<br />
This<br />
data<br />
structure<br />
stores<br />
the<br />
administrator’s<br />
credential.<br />
During<br />
the<br />
switch<br />
user<br />
process<br />
flow,<br />
the<br />
cache<br />
data<br />
will<br />
be<br />
manipulated.<br />
For<br />
more<br />
in<strong>for</strong>mation<br />
on<br />
<strong>WebSEAL</strong><br />
session<br />
caches,<br />
see<br />
“The<br />
<strong>WebSEAL</strong><br />
session/credentials<br />
cache<br />
structure”<br />
on<br />
page<br />
10.<br />
2.<br />
The<br />
administrator<br />
connects<br />
to<br />
a<br />
pre-configured<br />
switch<br />
user<br />
HTML<br />
<strong>for</strong>m,<br />
and<br />
completes<br />
the<br />
<strong>for</strong>m.<br />
On<br />
the<br />
<strong>for</strong>m,<br />
the<br />
administrator<br />
specifies:<br />
v<br />
The<br />
name<br />
of<br />
the<br />
user<br />
identity<br />
that<br />
the<br />
administrator<br />
needs<br />
to<br />
assume.<br />
v<br />
A<br />
destination<br />
URL.<br />
v<br />
An<br />
authentication<br />
method.<br />
This<br />
action<br />
results<br />
in<br />
a<br />
POST<br />
request<br />
being<br />
sent<br />
to<br />
/pkmssu.<strong>for</strong>m.<br />
The<br />
<strong>WebSEAL</strong><br />
administrator<br />
can<br />
optionally<br />
modify<br />
the<br />
contents<br />
of<br />
the<br />
switch<br />
user<br />
HTML<br />
<strong>for</strong>m<br />
be<strong>for</strong>e<br />
making<br />
it<br />
available<br />
<strong>for</strong><br />
use<br />
by<br />
other<br />
administrators.<br />
See<br />
“Part<br />
3:<br />
Configuring<br />
the<br />
switch<br />
user<br />
HTML<br />
<strong>for</strong>m”<br />
on<br />
page<br />
193.<br />
The<br />
administrator<br />
can<br />
also<br />
optionally<br />
extend<br />
the<br />
capabilities<br />
of<br />
the<br />
<strong>for</strong>m.<br />
See<br />
“Part<br />
4:<br />
Designing<br />
additional<br />
input<br />
<strong>for</strong>ms”<br />
on<br />
page<br />
195.<br />
3.<br />
<strong>WebSEAL</strong><br />
determines<br />
whether<br />
to<br />
grant<br />
the<br />
switch<br />
user<br />
request<br />
by<br />
per<strong>for</strong>ming<br />
the<br />
following<br />
checks:<br />
a.<br />
<strong>WebSEAL</strong><br />
examines<br />
the<br />
membership<br />
of<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
su-admins<br />
group<br />
to<br />
determine<br />
if<br />
the<br />
administrator<br />
has<br />
permission<br />
to<br />
invoke<br />
the<br />
switch<br />
user<br />
function.<br />
188<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide