IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Extended<br />
attributes<br />
<strong>for</strong><br />
credentials<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Mechanisms<br />
<strong>for</strong><br />
adding<br />
registry<br />
attributes<br />
to<br />
a<br />
credential”<br />
v<br />
“Registry<br />
attribute<br />
entitlement<br />
service<br />
configuration”<br />
on<br />
page<br />
216<br />
v<br />
“Junction<br />
handling<br />
of<br />
extended<br />
credential<br />
attributes”<br />
on<br />
page<br />
218<br />
Mechanisms<br />
<strong>for</strong><br />
adding<br />
registry<br />
attributes<br />
to<br />
a<br />
credential<br />
The<br />
<strong>WebSEAL</strong><br />
authentication<br />
process<br />
accesses<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
registry<br />
and<br />
builds<br />
a<br />
credential<br />
<strong>for</strong><br />
the<br />
user.<br />
The<br />
credential<br />
contains<br />
user<br />
in<strong>for</strong>mation<br />
that<br />
is<br />
needed<br />
to<br />
make<br />
access<br />
decisions.<br />
This<br />
includes<br />
in<strong>for</strong>mation<br />
such<br />
as<br />
user<br />
name<br />
and<br />
list<br />
of<br />
groups<br />
to<br />
which<br />
the<br />
user<br />
belongs.<br />
<strong>WebSEAL</strong><br />
supports<br />
several<br />
different<br />
mechanisms<br />
(services)<br />
that<br />
allow<br />
administrators<br />
and<br />
application<br />
developers<br />
to<br />
extend<br />
the<br />
authentication<br />
process.<br />
When<br />
<strong>WebSEAL</strong><br />
conducts<br />
the<br />
authentication<br />
process,<br />
it<br />
checks<br />
to<br />
see<br />
if<br />
any<br />
external<br />
services<br />
have<br />
been<br />
implemented<br />
and<br />
configured.<br />
When<br />
they<br />
have,<br />
<strong>WebSEAL</strong><br />
calls<br />
those<br />
services.<br />
The<br />
services<br />
can<br />
do<br />
their<br />
own<br />
processing<br />
to<br />
build<br />
a<br />
list<br />
of<br />
extended<br />
attributes<br />
about<br />
the<br />
user<br />
identity.<br />
These<br />
extended<br />
attributes<br />
are<br />
added<br />
to<br />
the<br />
user<br />
credential.<br />
The<br />
following<br />
types<br />
of<br />
services<br />
are<br />
supported:<br />
v<br />
Registry<br />
attribute<br />
entitlement<br />
service<br />
This<br />
entitlement<br />
service<br />
is<br />
built-in<br />
to<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
by<br />
default.<br />
This<br />
service<br />
is<br />
an<br />
implementation<br />
of<br />
a<br />
class<br />
of<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
entitlement<br />
services<br />
known<br />
as<br />
credential<br />
attribute<br />
entitlement<br />
services.<br />
This<br />
service<br />
is<br />
called<br />
a<br />
registry<br />
attribute<br />
entitlement<br />
service<br />
because<br />
it<br />
obtains<br />
specified<br />
user<br />
in<strong>for</strong>mation<br />
from<br />
a<br />
user<br />
registry<br />
(such<br />
as<br />
an<br />
LDAP<br />
user<br />
registry)<br />
and<br />
inserts<br />
the<br />
data<br />
into<br />
an<br />
attribute<br />
list<br />
in<br />
the<br />
user<br />
credential.<br />
This<br />
built-in<br />
registry<br />
attribute<br />
entitlement<br />
service<br />
is<br />
a<br />
generic<br />
entitlement<br />
service<br />
that<br />
can<br />
be<br />
used<br />
by<br />
many<br />
resource<br />
managers.<br />
This<br />
service<br />
takes<br />
the<br />
place<br />
of<br />
a<br />
previous<br />
method<br />
that<br />
required<br />
administrators<br />
to<br />
add<br />
″tag/value″<br />
entries<br />
to<br />
the<br />
[ldap-ext-creds-tag]<br />
stanza<br />
in<br />
the<br />
pd.conf<br />
configuration<br />
file.<br />
In<br />
Version<br />
5.1,<br />
you<br />
should<br />
use<br />
the<br />
built-in<br />
entitlement<br />
service<br />
to<br />
obtain<br />
LDAP<br />
user<br />
registry<br />
data.<br />
For<br />
configuration<br />
in<strong>for</strong>mation,<br />
see<br />
“Registry<br />
attribute<br />
entitlement<br />
service<br />
configuration”<br />
on<br />
page<br />
216.<br />
Note:<br />
Note<br />
that<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
provides<br />
additional<br />
built-in<br />
entitlement<br />
services<br />
that<br />
can<br />
be<br />
used<br />
to<br />
add<br />
additional<br />
in<strong>for</strong>mation.<br />
These<br />
additional<br />
services,<br />
however,<br />
obtain<br />
the<br />
additional<br />
in<strong>for</strong>mation<br />
from<br />
sources<br />
other<br />
than<br />
user<br />
registry<br />
entries.<br />
For<br />
example,<br />
the<br />
extended<br />
attribute<br />
entitlement<br />
service<br />
obtains<br />
in<strong>for</strong>mation<br />
from<br />
ACLs<br />
and<br />
POPs<br />
in<br />
the<br />
protected<br />
resource<br />
object<br />
space.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
the<br />
description<br />
of<br />
entitlement<br />
services<br />
in<br />
the<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong><br />
Authorization<br />
C<br />
API<br />
Developer<br />
Reference.<br />
v<br />
Customized<br />
credential<br />
attribute<br />
entitlement<br />
service<br />
When<br />
the<br />
built-in<br />
credential<br />
attribute<br />
entitlement<br />
service<br />
cannot<br />
provide<br />
all<br />
of<br />
the<br />
in<strong>for</strong>mation<br />
needed<br />
<strong>for</strong><br />
your<br />
deployment,<br />
you<br />
can<br />
write<br />
your<br />
own<br />
credential<br />
attribute<br />
entitlement<br />
service.<br />
This<br />
can<br />
include<br />
your<br />
own<br />
version<br />
of<br />
a<br />
registry<br />
attribute<br />
entitlement<br />
service.<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
supports<br />
this<br />
as<br />
part<br />
of<br />
the<br />
authorization<br />
API.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
the<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong><br />
Authorization<br />
C<br />
API<br />
Developer<br />
Reference.<br />
v<br />
Credential<br />
extended<br />
attributes<br />
external<br />
authentication<br />
service<br />
(CDAS)<br />
Chapter<br />
7.<br />
Advanced<br />
<strong>WebSEAL</strong><br />
authentication<br />
215
Change language