IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Administrators<br />
requesting<br />
use<br />
of<br />
switch<br />
user<br />
authentication<br />
must<br />
be<br />
members<br />
of<br />
the<br />
su-admins<br />
group.<br />
Membership<br />
in<br />
this<br />
group<br />
must<br />
be<br />
configured<br />
be<strong>for</strong>e<br />
switch<br />
user<br />
can<br />
be<br />
used.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
“Part<br />
1:<br />
Configuring<br />
user<br />
access”<br />
on<br />
page<br />
190.<br />
b.<br />
<strong>WebSEAL</strong><br />
examines<br />
the<br />
membership<br />
of<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
su-admins,<br />
securitygroup<br />
and<br />
su-excluded<br />
groups<br />
to<br />
ensure<br />
the<br />
user<br />
identity<br />
supplied<br />
in<br />
the<br />
switch<br />
user<br />
<strong>for</strong>m<br />
is<br />
not<br />
a<br />
member<br />
of<br />
one<br />
of<br />
these<br />
groups.<br />
User<br />
identities<br />
that<br />
belong<br />
to<br />
any<br />
of<br />
these<br />
groups<br />
cannot<br />
be<br />
accessed<br />
by<br />
the<br />
switch<br />
user<br />
function.<br />
The<br />
<strong>WebSEAL</strong><br />
administrator<br />
must<br />
configure<br />
memberships<br />
in<br />
these<br />
groups<br />
be<strong>for</strong>e<br />
administrators<br />
use<br />
the<br />
switch<br />
user<br />
function.<br />
For<br />
configuration<br />
instructions<br />
and<br />
more<br />
in<strong>for</strong>mation<br />
on<br />
these<br />
groups,<br />
see<br />
“Part<br />
1:<br />
Configuring<br />
user<br />
access”<br />
on<br />
page<br />
190<br />
4.<br />
When<br />
access<br />
to<br />
the<br />
switch<br />
user<br />
function<br />
has<br />
been<br />
granted,<br />
<strong>WebSEAL</strong><br />
calls<br />
the<br />
appropriate<br />
switch<br />
user<br />
shared<br />
library<br />
to<br />
per<strong>for</strong>m<br />
the<br />
special<br />
switch<br />
user<br />
authentication.<br />
<strong>WebSEAL</strong><br />
supports<br />
a<br />
number<br />
of<br />
different<br />
authentication<br />
mechanisms.<br />
Each<br />
authentication<br />
mechanism<br />
has<br />
a<br />
corresponding<br />
switch<br />
user<br />
authentication<br />
mechanism.<br />
<strong>WebSEAL</strong><br />
provides<br />
shared<br />
libraries<br />
that<br />
contain<br />
the<br />
special<br />
switch<br />
user<br />
mechanisms.<br />
Be<strong>for</strong>e<br />
switch<br />
user<br />
authentication<br />
can<br />
be<br />
used,<br />
the<br />
<strong>WebSEAL</strong><br />
administrator<br />
must<br />
configure<br />
<strong>WebSEAL</strong><br />
to<br />
use<br />
the<br />
necessary<br />
shared<br />
libraries.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
“Part<br />
2:<br />
Configuring<br />
switch<br />
user<br />
authentication<br />
mechanisms”<br />
on<br />
page<br />
191.<br />
Note:<br />
Switch<br />
user<br />
authentication<br />
can<br />
also<br />
be<br />
per<strong>for</strong>med<br />
by<br />
a<br />
custom<br />
switch<br />
user<br />
CDAS<br />
library.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
“Developing<br />
a<br />
custom<br />
authentication<br />
module<br />
<strong>for</strong><br />
switch<br />
user”<br />
on<br />
page<br />
197.<br />
5.<br />
When<br />
authentication<br />
of<br />
the<br />
designated<br />
user<br />
succeeds,<br />
the<br />
switch<br />
user<br />
authentication<br />
mechanism<br />
returns<br />
a<br />
valid<br />
credential<br />
<strong>for</strong><br />
the<br />
user<br />
—<br />
without<br />
requiring<br />
the<br />
user<br />
password<br />
<strong>for</strong><br />
input.<br />
6.<br />
<strong>WebSEAL</strong><br />
manipulates<br />
the<br />
contents<br />
of<br />
the<br />
appropriate<br />
entry<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
session<br />
cache<br />
by:<br />
a.<br />
Placing<br />
the<br />
user’s<br />
credential<br />
into<br />
a<br />
new<br />
cache<br />
data<br />
structure.<br />
b.<br />
Removing<br />
the<br />
administrator’s<br />
<strong>WebSEAL</strong><br />
session<br />
cache<br />
data<br />
and<br />
storing<br />
it<br />
in<br />
a<br />
separate<br />
location.<br />
c.<br />
Inserting<br />
the<br />
user<br />
cache<br />
data,<br />
including<br />
the<br />
user’s<br />
credential,<br />
in<br />
place<br />
of<br />
the<br />
administrator’s<br />
cache<br />
data.<br />
7.<br />
<strong>WebSEAL</strong><br />
sends<br />
a<br />
redirect<br />
to<br />
the<br />
browser<br />
<strong>for</strong><br />
the<br />
destination<br />
URL<br />
supplied<br />
in<br />
the<br />
switch<br />
user<br />
<strong>for</strong>m.<br />
The<br />
request<br />
is<br />
processed<br />
normally,<br />
using<br />
the<br />
user’s<br />
credential,<br />
and<br />
the<br />
URL<br />
is<br />
accessed.<br />
8.<br />
The<br />
administrator<br />
can<br />
continue<br />
to<br />
make<br />
other<br />
requests.<br />
All<br />
authorization<br />
decisions<br />
<strong>for</strong><br />
these<br />
requests<br />
are<br />
based<br />
on<br />
the<br />
credential<br />
of<br />
the<br />
user.<br />
When<br />
using<br />
switch<br />
user<br />
functionality,<br />
administrators<br />
might<br />
need<br />
to<br />
establish<br />
and<br />
manage<br />
sessions<br />
with<br />
additional<br />
applications.<br />
These<br />
sessions<br />
need<br />
to<br />
be<br />
established<br />
using<br />
the<br />
identity<br />
of<br />
the<br />
new<br />
user.<br />
To<br />
enable<br />
this,<br />
the<br />
new<br />
user<br />
credential<br />
also<br />
contains<br />
a<br />
new<br />
User<br />
Session<br />
ID.<br />
This<br />
User<br />
Session<br />
ID<br />
is<br />
used,<br />
<strong>for</strong><br />
example,<br />
when<br />
troubleshooting<br />
the<br />
user’s<br />
ability<br />
to<br />
access<br />
and<br />
use<br />
additional<br />
Web<br />
resources.<br />
For<br />
more<br />
in<strong>for</strong>mation<br />
on<br />
<strong>WebSEAL</strong><br />
session<br />
caches,<br />
see<br />
“GSKit<br />
and<br />
<strong>WebSEAL</strong><br />
session<br />
cache<br />
overview”<br />
on<br />
page<br />
132<br />
and<br />
“The<br />
<strong>WebSEAL</strong><br />
session/credentials<br />
cache<br />
structure”<br />
on<br />
page<br />
10.<br />
Chapter<br />
7.<br />
Advanced<br />
<strong>WebSEAL</strong><br />
authentication<br />
189