IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Step
3
—
Specify
the
attributes
to
be
added
to
the
credential
The
attributes
to
be
added
to
the
credential
are
configured
in
several
stanzas.
Add
this
information
to
the
WebSEAL
configuration
file.
Note:
Alternatively,
you
can
define
the
attributes
in
a
separate
file,
to
be
called
by
the
entitlement
service.
For
more
information,
see
the
IBM
Tivoli
Access
Manager
for
e-business
Authorization
C
API
Developer
Reference.
Review
the
following
example
entry.
[TAM_CRED_ATTRS_SVC]
eperson
=
azn_cred_registry_id
group
=
cn=enterprise,
o=tivoli
[TAM_CRED_ATTRS_SVC:eperson]
tagvalue_credattrs_lastname
=
sn
tagvalue_credattrs_employeetype
=
employeetype
tagvalue_credattrs_address
=
homepostaladdress
tagvalue_credattrs_email
=
mail
[TAM_CRED_ATTRS_SVC:group]
tagvalue_credattrs_businesscategory
=
businesscategory
The
stanza
name
[TAM_CRED_ATTRS_SVC]
is
the
Service
ID.
Inside
this
stanza
are
sources
of
attributes
to
be
retrieved.
The
source
names,
such
as
user
and
group
are
used
to
identify
the
source
location
in
the
registry.
You
need
to
define
these.
The
values
for
these
sources
are
registry
identifiers
that
exist
in
the
registry.
The
values
can
be
existing
credential
attribute
names.
If
this
is
the
case,
the
service
automatically
finds
and
uses
the
respective
values.
Configure
the
registry
attributes
for
each
of
the
sources
under
the
service
stanza
in
a
separate
stanza.
The
syntax
of
the
separate
stanza
is
the
service
ID
library
name
followed
by
a
colon
(:)
and
then
the
source
name.
This
connection
is
necessary
because
more
than
one
service
can
be
configured
in
the
same
file.
The
configuration
file
entries
contain
mappings
of
user
registry
attributes
to
user-defined
credential
attributes.
For
example,
in
an
LDAP
user
registry,
the
DN
for
a
user
could
be
cn=joeuser,
o=tivoli
For
this
user,
the
LDAP
user
registry
entries
could
be:
sn=Smith
employeetype=bankteller
homepostaladdress="3004
Mission
St
Santa
Cruz
CA
95060"
email=joeuser@bigco.com
For
the
group
cn=enterprise,o=tivoli,
the
LDAP
group
registry
entry
could
be:
businesscategory=finance
Using
the
example
configuration
entries
shown
above,
the
attribute
list
returned
would
have
the
following
entries
Attribute
name
Attribute
value
credattrs_lastname
Smith
credattrs_employeetype
bankteller
credattrs_address
3004
Mission
St
Santa
Cruz
CA
95060
Chapter
7.
Advanced
WebSEAL
authentication
217