IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>WebSEAL</strong><br />
provides<br />
an<br />
external<br />
authentication<br />
API<br />
interface<br />
that<br />
can<br />
be<br />
used<br />
to<br />
develop<br />
external<br />
authentication<br />
services.<br />
These<br />
services<br />
are<br />
commonly<br />
called<br />
CDASs<br />
(cross-domain<br />
authentication<br />
service).<br />
You<br />
can<br />
use<br />
the<br />
<strong>WebSEAL</strong><br />
external<br />
authentication<br />
API<br />
to<br />
develop<br />
your<br />
own<br />
external<br />
authentication<br />
service.<br />
This<br />
can<br />
be<br />
used<br />
when<br />
the<br />
need<br />
to<br />
obtain<br />
user<br />
authentication<br />
in<strong>for</strong>mation<br />
extends<br />
beyond<br />
entitlement<br />
in<strong>for</strong>mation.<br />
The<br />
use<br />
of<br />
a<br />
credential<br />
extended<br />
attributes<br />
CDAS<br />
is<br />
recommended<br />
when<br />
an<br />
application<br />
needs<br />
to<br />
access<br />
in<strong>for</strong>mation<br />
available<br />
only<br />
at<br />
authentication<br />
time,<br />
or<br />
when<br />
the<br />
application<br />
needs<br />
to<br />
map<br />
a<br />
user<br />
ID<br />
used<br />
at<br />
authentication<br />
to<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
ID.<br />
For<br />
more<br />
in<strong>for</strong>mation,<br />
see<br />
the<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong><br />
Web<br />
Security<br />
Developer<br />
Reference.<br />
Registry<br />
attribute<br />
entitlement<br />
service<br />
configuration<br />
Complete<br />
the<br />
instructions<br />
in<br />
the<br />
following<br />
sections:<br />
v<br />
“Step<br />
1<br />
—<br />
Determine<br />
the<br />
attributes<br />
to<br />
be<br />
added<br />
to<br />
the<br />
credential”<br />
v<br />
“Step<br />
2<br />
—<br />
Define<br />
your<br />
use<br />
of<br />
the<br />
entitlement<br />
service”<br />
v<br />
“Step<br />
3<br />
—<br />
Specify<br />
the<br />
attributes<br />
to<br />
be<br />
added<br />
to<br />
the<br />
credential”<br />
on<br />
page<br />
217<br />
Step<br />
1<br />
—<br />
Determine<br />
the<br />
attributes<br />
to<br />
be<br />
added<br />
to<br />
the<br />
credential<br />
Each<br />
user<br />
attribute<br />
that<br />
you<br />
want<br />
to<br />
add<br />
to<br />
the<br />
user<br />
credential<br />
must<br />
be<br />
defined<br />
in<br />
a<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
configuration<br />
file.<br />
Typically,<br />
this<br />
is<br />
done<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file.<br />
Go<br />
to<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
registry<br />
(<strong>for</strong><br />
example,<br />
an<br />
LDAP<br />
user<br />
registry).<br />
Make<br />
a<br />
list<br />
of<br />
the<br />
names<br />
of<br />
each<br />
user<br />
registry<br />
entry<br />
that<br />
you<br />
want<br />
the<br />
credential<br />
attributes<br />
entitlement<br />
service<br />
to<br />
extract<br />
from<br />
the<br />
registry<br />
and<br />
place<br />
into<br />
the<br />
user<br />
credential.<br />
You<br />
will<br />
need<br />
the<br />
user<br />
DN<br />
and<br />
group<br />
DN<br />
also.<br />
Step<br />
2<br />
—<br />
Define<br />
your<br />
use<br />
of<br />
the<br />
entitlement<br />
service<br />
1.<br />
Open<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file<br />
<strong>for</strong><br />
editing.<br />
Declare<br />
a<br />
service<br />
ID<br />
and<br />
library<br />
name<br />
<strong>for</strong><br />
the<br />
registry<br />
attribute<br />
entitlement<br />
service.<br />
The<br />
service<br />
ID<br />
is<br />
an<br />
arbitrary<br />
string<br />
that<br />
you<br />
can<br />
choose.<br />
For<br />
example,<br />
TAM_CRED_ATTRS_SVC.<br />
[aznapi-entitlement-services]<br />
TAM_CRED_ATTRS_SVC<br />
=<br />
azn_ent_cred_attrs<br />
Note<br />
that<br />
<strong>WebSEAL</strong><br />
automatically<br />
takes<br />
the<br />
value<br />
azn_ent_cred_attrs<br />
and<br />
finds<br />
the<br />
corresponding<br />
shared<br />
library.<br />
For<br />
example,<br />
on<br />
Solaris,<br />
libazn_ent_cred_attrs.so<br />
2.<br />
Add<br />
an<br />
authorization<br />
API<br />
service<br />
definition<br />
entry<br />
to<br />
specify<br />
your<br />
usage<br />
of<br />
the<br />
entitlement<br />
service.<br />
Add<br />
the<br />
entry<br />
in<br />
the<br />
[aznapi-configuration]stanza.<br />
The<br />
entry<br />
must<br />
use<br />
the<br />
keyword<br />
cred-attribute-entitlement-services.<br />
The<br />
value<br />
<strong>for</strong><br />
this<br />
entry<br />
must<br />
be<br />
the<br />
service<br />
ID<br />
you<br />
selected<br />
previously,<br />
such<br />
as<br />
TAM_CRED_ATTRS_SVC.<br />
For<br />
example:<br />
[aznapi-configuration<br />
]<br />
cred-attribute-entitlement-services<br />
=<br />
TAM_CRED_ATTRS_SVC<br />
Note:<br />
For<br />
more<br />
in<strong>for</strong>mation<br />
on<br />
configuration<br />
of<br />
credential<br />
attribute<br />
entitlement<br />
services,<br />
see<br />
the<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong><br />
Authorization<br />
C<br />
API<br />
Developer<br />
Reference<br />
and<br />
review<br />
the<br />
sample<br />
configuration<br />
file,<br />
aznapi.conf.<br />
This<br />
configuration<br />
file<br />
is<br />
included<br />
in<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
authorization<br />
application<br />
development<br />
kit<br />
(PDAuthADK).<br />
216<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide