IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

You
implement
security
policy
by
applying
the
appropriate
security
mechanisms
to
the
objects
requiring
protection.
Security
mechanisms
include:
v
Access
control
list
(ACL)
policies
ACL
policies
identify
user
types
that
can
be
considered
for
access
and
specify
the
operations
permitted
on
the
object.
v
Protected
object
policies
(POP)
A
POP
specifies
additional
conditions
governing
the
access
to
the
protected
object,
such
as
privacy,
integrity,
auditing,
and
time-of-day
access.
v
Extended
attributes
Extended
attributes
are
additional
values
placed
on
an
object,
ACL,
or
POP
that
can
be
read
and
interpreted
by
third-party
applications
(such
as
an
external
authorization
service).
The
core
component
of
Tivoli
Access
Manager
is
the
Tivoli
Access
Manager
authorization
service—which
permits
or
denies
access
to
protected
objects
(resources)
based
on
the
user’s
credentials
and
the
access
controls
placed
on
the
objects.
To
successfully
implement
the
security
policy,
you
must
logically
organize
the
different
content
types
(as
described
in
“Identifying
content
types
and
levels
of
protection”
on
page
7)
and
apply
the
appropriate
ACL
and
POP
policies.
Access
control
management
can
be
very
complex
and
is
made
much
easier
by
careful
categorization
of
the
content
types.
Identifying
content
types
and
levels
of
protection
As
the
security
administrator
of
your
Web
space,
you
must
correctly
identify
the
types
of
content
available
to
a
variety
of
user
types.
Some
content
must
be
highly
protected
and
available
only
to
specific
users;
other
content
is
for
general
public
view.
Each
security
scenario
demands
different
protection
requirements
and
the
associated
WebSEAL
configuration.
It
is
your
responsibility
to:
v
Know
your
Web
content
v
Identify
the
types
of
users
requiring
access
to
this
content
v
Understand
the
strengths
and
weaknesses
of
the
available
WebSEAL
configuration
options
for
securing
this
content
Protection
of
Web
content
falls
into
three
broad
categories:
1.
Public
content
–
access
requires
no
protection
v
Unauthenticated
clients
access
using
HTTP
v
Unauthenticated
credential
used
for
access
control
to
resources
v
Basic
WebSEAL
configuration
requirements
2.
Public
content
–
access
requires
privacy
(encryption)
v
Unauthenticated
clients
access
using
HTTPS
v
Encryption
required
to
protect
sensitive
data
required
by
application
server
(such
as
credit
card
numbers
and
user
account
information)
v
Unauthenticated
credential
used
for
access
control
to
resources
v
WebSEAL
configuration
needs
to
stipulate
privacy
3.
Private
content
–
access
requires
authentication
Chapter
1.
IBM
Tivoli
Access
Manager
WebSEAL
overview
7