IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

IBM
Tivoli
Access
Manager
WebSEAL:
IBM
Tivoli
Access
Manager
WebSEAL
is
the
resource
manager
responsible
for
managing
and
protecting
Web-based
information
and
resources.
WebSEAL
is
a
high
performance,
multi-threaded
Web
server
that
applies
fine-grained
security
policy
to
the
Tivoli
Access
Manager
protected
Web
object
space.
WebSEAL
can
provide
single
sign-on
solutions
and
incorporate
back-end
Web
application
server
resources
into
its
security
policy.
WebSEAL
normally
acts
as
a
reverse
Web
proxy
by
receiving
HTTP/HTTPS
requests
from
a
Web
browser
and
delivering
content
from
its
own
Web
server
or
from
junctioned
back-end
Web
application
servers.
Requests
passing
through
WebSEAL
are
evaluated
by
the
Tivoli
Access
Manager
authorization
service
to
determine
whether
the
user
is
authorized
to
access
the
requested
resource.
WebSEAL
provides
the
following
features:
v
Supports
multiple
authentication
methods
Both
built-in
and
plug-in
architectures
allow
flexibility
in
supporting
a
variety
of
authentication
mechanisms.
v
Accepts
HTTP
and
HTTPS
requests
v
Integrates
and
protects
back-end
server
resources
through
WebSEAL
junction
technology
v
Manages
fine-grained
access
control
for
the
local
and
back-end
server
Web
space
Supported
resources
include
URLs,
URL-based
regular
expressions,
CGI
programs,
HTML
files,
Java
servlets,
and
Java
class
files.
v
Performs
as
a
reverse
Web
proxy
WebSEAL
appears
as
a
Web
server
to
clients
and
appears
as
a
Web
browser
to
the
junctioned
back-end
servers
it
is
protecting.
v
Provides
single
sign-on
capabilities
Understanding
the
Tivoli
Access
Manager
security
model
The
security
policy
for
a
Tivoli
Access
Manager
secure
domain
is
maintained
and
governed
by
two
key
security
structures:
v
User
registry
The
user
registry
(such
as
LDAP,
Lotus
Domino,
or
Microsoft
Active
Directory)
contains
all
users
and
groups
who
are
allowed
to
participate
in
the
Tivoli
Access
Manager
secure
domain.
v
Master
authorization
(policy)
database
The
authorization
database
contains
a
representation
of
all
resources
in
the
domain
(the
protected
object
space).
The
security
administrator
can
dictate
any
level
of
security
by
applying
rules,
known
as
access
control
list
(ACL)
policies
and
protected
object
policies
(POP),
to
those
resources
requiring
protection
The
process
of
authentication
proves
the
identity
of
a
user
to
WebSEAL.
A
user
can
participate
in
the
secure
domain
as
authenticated
or
unauthenticated.
Only
users
with
an
entry
in
the
user
registry
can
become
authenticated
users.
Using
ACLs
and
POPs,
the
security
administrator
can
make
certain
public
resources
available
to
unauthenticated
users.
Other
resources
can
be
made
available
only
to
certain
authenticated
users.
2
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide