IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

WebSEAL
junctions
overview
You
can
create
the
following
WebSEAL
junction
types:
v
WebSEAL
to
back-end
server
over
TCP
connection
v
WebSEAL
to
back-end
server
over
SSL
connection
v
WebSEAL
to
back-end
server
over
TCP
connection
via
HTTP
proxy
server
v
WebSEAL
to
back-end
server
over
SSL
connection
via
HTTPS
proxy
server
v
WebSEAL
to
WebSEAL
over
SSL
connection
You
must
address
the
following
two
concerns
when
creating
any
junction:
1.
Decide
where
to
junction
(mount)
the
Web
application
server(s)
in
the
WebSEAL
object
space.
2.
Choose
the
type
of
junction.
Junction
database
location
and
format
WebSEAL
junction
information
is
now
stored
in
XML-formatted
database
files.
The
location
of
the
junction
database
directory
is
defined
in
the
[junction]
stanza
of
the
WebSEAL
configuration
file.
The
directory
is
relative
to
the
WebSEAL
server
root
(server-root
parameter
in
the
[server]
stanza):
[junction]
junction-db
=
jct
v
Each
junction
is
defined
in
a
separate
file
with
a
.xml
extension.
v
Use
pdadmin
utility
to
create
and
manage
junctions
and
options.
v
The
XML
format
allows
you
to
manually
create,
edit,
duplicate,
and
backup
junction
files.
Applying
coarse-grained
access
control:
summary
1.
Use
the
pdadmin
utility
or
the
Web
Portal
Manager
to
create
a
junction
between
WebSEAL
and
the
back-end
server.
2.
Place
an
appropriate
ACL
policy
on
the
junction
point
to
provide
coarse-grained
control
to
the
back-end
server.
Applying
fine-grained
access
control:
summary
1.
Use
the
pdadmin
utility
or
the
Web
Portal
Manager
to
create
a
junction
between
WebSEAL
and
the
back-end
server.
WebSEAL
cannot
automatically
″see″
and
understand
a
third-party
file
system.
You
must
inform
WebSEAL
of
the
third-party
object
space
using
a
special
application,
called
query_contents,
that
inventories
the
third-party
Web
space
and
reports
the
structure
and
contents
to
WebSEAL.
2.
Copy
the
query_contents
program
to
the
third-party
server.
3.
Apply
ACL
policy
to
appropriate
objects
in
the
unified
object
space.
Guidelines
for
creating
WebSEAL
junctions
The
following
guidelines
summarize
the
″rules″
for
junctions:
v
You
can
add
a
junction
anywhere
in
the
primary
WebSEAL
object
space
v
You
can
junction
multiple
replica
back-end
servers
at
the
same
mount
point
Multiple
replica
back-end
servers
mounted
to
the
same
junction
point
must
be
of
the
same
type—TCP
or
SSL
v
ACL
policies
are
inherited
across
junctions
to
third-party
servers
276
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide