IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

WebSEAL
provides
an
external
authentication
API
interface
that
can
be
used
to
develop
external
authentication
services.
These
services
are
commonly
called
CDASs
(cross-domain
authentication
service).
You
can
use
the
WebSEAL
external
authentication
API
to
develop
your
own
external
authentication
service.
This
can
be
used
when
the
need
to
obtain
user
authentication
information
extends
beyond
entitlement
information.
The
use
of
a
credential
extended
attributes
CDAS
is
recommended
when
an
application
needs
to
access
information
available
only
at
authentication
time,
or
when
the
application
needs
to
map
a
user
ID
used
at
authentication
to
the
Tivoli
Access
Manager
user
ID.
For
more
information,
see
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference.
Registry
attribute
entitlement
service
configuration
Complete
the
instructions
in
the
following
sections:
v
“Step
1
—
Determine
the
attributes
to
be
added
to
the
credential”
v
“Step
2
—
Define
your
use
of
the
entitlement
service”
v
“Step
3
—
Specify
the
attributes
to
be
added
to
the
credential”
on
page
217
Step
1
—
Determine
the
attributes
to
be
added
to
the
credential
Each
user
attribute
that
you
want
to
add
to
the
user
credential
must
be
defined
in
a
Tivoli
Access
Manager
configuration
file.
Typically,
this
is
done
in
the
WebSEAL
configuration
file.
Go
to
the
Tivoli
Access
Manager
user
registry
(for
example,
an
LDAP
user
registry).
Make
a
list
of
the
names
of
each
user
registry
entry
that
you
want
the
credential
attributes
entitlement
service
to
extract
from
the
registry
and
place
into
the
user
credential.
You
will
need
the
user
DN
and
group
DN
also.
Step
2
—
Define
your
use
of
the
entitlement
service
1.
Open
the
WebSEAL
configuration
file
for
editing.
Declare
a
service
ID
and
library
name
for
the
registry
attribute
entitlement
service.
The
service
ID
is
an
arbitrary
string
that
you
can
choose.
For
example,
TAM_CRED_ATTRS_SVC.
[aznapi-entitlement-services]
TAM_CRED_ATTRS_SVC
=
azn_ent_cred_attrs
Note
that
WebSEAL
automatically
takes
the
value
azn_ent_cred_attrs
and
finds
the
corresponding
shared
library.
For
example,
on
Solaris,
libazn_ent_cred_attrs.so
2.
Add
an
authorization
API
service
definition
entry
to
specify
your
usage
of
the
entitlement
service.
Add
the
entry
in
the
[aznapi-configuration]stanza.
The
entry
must
use
the
keyword
cred-attribute-entitlement-services.
The
value
for
this
entry
must
be
the
service
ID
you
selected
previously,
such
as
TAM_CRED_ATTRS_SVC.
For
example:
[aznapi-configuration
]
cred-attribute-entitlement-services
=
TAM_CRED_ATTRS_SVC
Note:
For
more
information
on
configuration
of
credential
attribute
entitlement
services,
see
the
IBM
Tivoli
Access
Manager
for
e-business
Authorization
C
API
Developer
Reference
and
review
the
sample
configuration
file,
aznapi.conf.
This
configuration
file
is
included
in
the
Tivoli
Access
Manager
authorization
application
development
kit
(PDAuthADK).
216
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide