IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
access
control
list
(ACL)
An
access
control
list
policy,
or
ACL
policy,
is
the
set
of
rules
(permissions)
that
specifies
the
conditions
necessary
to
perform
certain
operations
on
that
resource.
ACL
policy
definitions
are
important
components
of
the
security
policy
established
for
the
secure
domain.
ACL
policies,
like
all
policies,
are
used
to
stamp
an
organization’s
security
requirements
onto
the
resources
represented
in
the
protected
object
space.
An
ACL
policy
specifically
controls:
1.
What
operations
can
be
performed
on
the
resource
2.
Who
can
perform
these
operations
An
ACL
policy
is
made
up
of
one
or
more
entries
that
include
user
and
group
designations
and
their
specific
permissions
or
rights.
An
ACL
can
also
contain
rules
that
apply
to
unauthenticated
users.
Protected
object
policies
(POP)
ACL
policies
provide
the
authorization
service
with
information
to
make
a
″yes″
or
″no″
answer
on
a
request
to
access
a
protected
object
and
perform
some
operation
on
that
object.
POP
policies
contain
additional
conditions
on
the
request
that
are
passed
back
to
Tivoli
Access
Manager
Base
and
the
resource
manager
(such
as
WebSEAL)
along
with
the
″yes″
ACL
policy
decision
from
the
authorization
service.
It
is
the
responsibility
of
Tivoli
Access
Manager
and
the
resource
manager
to
enforce
the
POP
conditions.
The
following
tables
list
the
available
attributes
for
a
POP:
Enforced
by
Tivoli
Access
Manager
Base
POP
Attribute
Description
Name
Name
of
the
policy.
This
becomes
the
in
the
pdadmin
pop
commands.
Description
Descriptive
text
for
the
policy.
This
appears
in
the
pop
show
command.
Warning
Mode
Provides
administrators
a
means
to
test
ACL
and
POP
policies.
Audit
Level
Specifies
type
of
auditing:
all,
none,
successful
access,
denied
access,
errors.
Time-of-Day
Access
Day
and
time
restrictions
for
successful
access
to
the
protected
object.
Enforced
by
Resource
Manager
(such
as
WebSEAL)
POP
Attribute
Description
Quality
of
Protection
Specifies
degree
of
data
protection:
none,
integrity,
privacy.
IP
Endpoint
Authentication
Method
Policy
Specifies
authentication
requirements
for
access
from
members
of
external
networks.
Document
Cache
Control
Specify
caching
instructions
for
the
handling
of
specific
documents.
4
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide