IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

When
a
user
successfully
authenticates
to
WebSEAL,
a
set
of
identification
information—known
as
a
credential—is
created
for
that
user.
The
credential
contains
the
user
identity,
any
group
memberships,
and
any
special
(″extended″)
security
attributes.
The
Tivoli
Access
Manager
authorization
service
enforces
security
policies
by
comparing
a
user’s
authentication
credentials
with
the
policy
permissions
assigned
to
the
requested
resource.
The
resulting
recommendation
is
passed
to
the
resource
manager
(for
example,
WebSEAL),
which
completes
the
response
to
the
original
request.
The
user
credential
is
essential
for
full
participation
in
the
secure
domain.
The
protected
object
space
The
protected
object
space
is
a
hierarchical
portrayal
of
resources
belonging
to
a
Tivoli
Access
Manager
secure
domain.
The
virtual
objects
that
appear
in
the
hierarchical
object
space
represent
the
actual
physical
network
resources.
v
System
resource
–
the
actual
physical
file
or
application.
v
Protected
object
–
the
logical
representation
of
an
actual
system
resource
used
by
the
authorization
service,
the
Web
Portal
Manager,
and
other
Tivoli
Access
Manager
management
utilities.
Policy
templates
can
be
attached
to
objects
in
the
object
space
to
provide
protection
of
the
resource.
The
authorization
service
makes
authorization
decisions
based
these
templates.
The
following
object
space
categories
are
used
by
Tivoli
Access
Manager:
v
Web
objects
Web
objects
represent
any
resource
that
can
be
addressed
by
an
HTTP
URL.
This
includes
static
Web
pages
and
dynamic
URLs
that
are
converted
to
database
queries
or
some
other
type
of
application.
The
WebSEAL
server
is
responsible
for
protecting
Web
objects.
v
Tivoli
Access
Manager
management
objects
Management
objects
represent
the
management
activities
that
can
be
performed
through
the
Web
Portal
Manager.
The
objects
represent
the
tasks
necessary
to
define
users
and
set
security
policy.
Tivoli
Access
Manager
supports
delegation
of
management
activities
and
can
restrict
an
administrator’s
ability
to
set
security
policy
to
a
subset
of
the
object
space.
v
User-defined
objects
User-defined
objects
represent
customer-defined
tasks
or
network
resources
protected
by
applications
that
access
the
authorization
service
through
the
Tivoli
Access
Manager
authorization
API.
Defining
and
applying
ACL
and
POP
policies
Security
administrators
protect
Tivoli
Access
Manager
system
resources
by
defining
rules,
known
as
ACL
and
POP
policies,
and
applying
these
policies
to
the
object
representations
of
those
resources
in
the
protected
object
space.
The
Tivoli
Access
Manager
authorization
service
performs
authorization
decisions
based
on
the
policies
applied
to
these
objects.
When
a
requested
operation
on
a
protected
object
is
permitted,
the
application
responsible
for
the
resource
implements
this
operation.
One
policy
can
dictate
the
protection
parameters
of
many
objects.
Any
change
to
the
rule
will
affect
all
objects
to
which
the
template
is
attached.
Chapter
1.
IBM
Tivoli
Access
Manager
WebSEAL
overview
3