IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
v<br />
Authenticated<br />
clients<br />
access<br />
using<br />
HTTP<br />
or<br />
HTTPS<br />
v<br />
Administrator<br />
determines<br />
the<br />
need<br />
<strong>for</strong><br />
encryption<br />
v<br />
Authenticated<br />
credential<br />
used<br />
<strong>for</strong><br />
access<br />
control<br />
to<br />
resources;<br />
clients<br />
must<br />
have<br />
account<br />
defined<br />
in<br />
user<br />
registry<br />
v<br />
<strong>WebSEAL</strong><br />
configuration<br />
is<br />
complex<br />
and<br />
all<br />
options<br />
must<br />
be<br />
considered<br />
carefully<br />
to<br />
determine<br />
impact<br />
of<br />
security<br />
policy<br />
Understanding<br />
<strong>WebSEAL</strong><br />
authentication<br />
Authentication<br />
is<br />
the<br />
method<br />
of<br />
identifying<br />
an<br />
individual<br />
process<br />
or<br />
entity<br />
attempting<br />
to<br />
login<br />
to<br />
a<br />
secure<br />
domain.<br />
When<br />
both<br />
server<br />
and<br />
client<br />
require<br />
authentication,<br />
the<br />
exchange<br />
is<br />
known<br />
as<br />
mutual<br />
authentication.<br />
<strong>WebSEAL</strong><br />
can<br />
en<strong>for</strong>ce<br />
a<br />
high<br />
degree<br />
of<br />
security<br />
in<br />
a<br />
secure<br />
domain<br />
by<br />
requiring<br />
each<br />
client<br />
to<br />
provide<br />
proof<br />
of<br />
its<br />
identity.<br />
The<br />
following<br />
conditions<br />
apply<br />
to<br />
<strong>WebSEAL</strong><br />
authentication:<br />
v<br />
<strong>WebSEAL</strong><br />
supports<br />
a<br />
standard<br />
set<br />
of<br />
authentication<br />
methods.<br />
You<br />
can<br />
customize<br />
<strong>WebSEAL</strong><br />
to<br />
support<br />
other<br />
authentication<br />
methods.<br />
v<br />
The<br />
<strong>WebSEAL</strong><br />
server<br />
process<br />
is<br />
independent<br />
of<br />
the<br />
authentication<br />
method.<br />
v<br />
<strong>WebSEAL</strong><br />
requires<br />
a<br />
client<br />
identity.<br />
From<br />
this<br />
identity,<br />
<strong>WebSEAL</strong><br />
builds<br />
an<br />
authenticated<br />
(or<br />
unauthenticated)<br />
credential<br />
that<br />
can<br />
be<br />
used<br />
by<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
authorization<br />
service<br />
to<br />
permit<br />
or<br />
deny<br />
access<br />
to<br />
resources.<br />
This<br />
flexible<br />
approach<br />
to<br />
authentication<br />
allows<br />
security<br />
policy<br />
to<br />
be<br />
based<br />
on<br />
<strong>business</strong><br />
requirements<br />
and<br />
not<br />
physical<br />
network<br />
topology.<br />
The<br />
goals<br />
of<br />
authentication<br />
Although<br />
<strong>WebSEAL</strong><br />
is<br />
independent<br />
of<br />
the<br />
authentication<br />
process,<br />
<strong>WebSEAL</strong><br />
requires<br />
the<br />
results<br />
of<br />
authentication—the<br />
client<br />
identity.<br />
The<br />
authentication<br />
process<br />
results<br />
in<br />
the<br />
following<br />
actions:<br />
1.<br />
The<br />
authentication<br />
method<br />
results<br />
in<br />
a<br />
client<br />
identity<br />
Client<br />
authentication<br />
is<br />
successful<br />
only<br />
if<br />
the<br />
user<br />
has<br />
an<br />
account<br />
defined<br />
in<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
registry<br />
or<br />
is<br />
processed<br />
successfully<br />
by<br />
a<br />
Cross-domain<br />
Authentication<br />
Service<br />
(CDAS).<br />
Otherwise<br />
the<br />
user<br />
is<br />
designated<br />
as<br />
unauthenticated.<br />
Method-specific<br />
identity<br />
in<strong>for</strong>mation,<br />
such<br />
as<br />
passwords,<br />
tokens,<br />
and<br />
certificates,<br />
represent<br />
physical<br />
identity<br />
properties<br />
of<br />
the<br />
user.<br />
This<br />
in<strong>for</strong>mation<br />
can<br />
be<br />
used<br />
to<br />
establish<br />
a<br />
secure<br />
session<br />
with<br />
the<br />
server.<br />
2.<br />
<strong>WebSEAL</strong><br />
uses<br />
the<br />
identity<br />
to<br />
acquire<br />
credentials<br />
<strong>for</strong><br />
that<br />
client<br />
<strong>WebSEAL</strong><br />
matches<br />
the<br />
client<br />
identity<br />
with<br />
a<br />
registered<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user.<br />
<strong>WebSEAL</strong><br />
then<br />
builds<br />
the<br />
credentials<br />
appropriate<br />
to<br />
this<br />
user.<br />
This<br />
is<br />
known<br />
as<br />
credentials<br />
acquisition.<br />
The<br />
credential<br />
represents<br />
a<br />
user’s<br />
privileges<br />
in<br />
the<br />
secure<br />
domain,<br />
describes<br />
the<br />
user<br />
in<br />
a<br />
specific<br />
context,<br />
and<br />
is<br />
valid<br />
only<br />
<strong>for</strong><br />
the<br />
lifetime<br />
of<br />
that<br />
session.<br />
Credential<br />
data<br />
includes<br />
the<br />
user<br />
name,<br />
any<br />
group<br />
memberships,<br />
and<br />
any<br />
special<br />
″extended″<br />
security<br />
attributes.<br />
If<br />
a<br />
user<br />
is<br />
not<br />
a<br />
member<br />
of<br />
the<br />
user<br />
registry<br />
(″anonymous″),<br />
<strong>WebSEAL</strong><br />
builds<br />
an<br />
unauthenticated<br />
credential<br />
<strong>for</strong><br />
that<br />
user.<br />
Remember<br />
that<br />
an<br />
ACL<br />
can<br />
contain<br />
special<br />
rules<br />
governing<br />
unauthenticated<br />
users.<br />
These<br />
credentials<br />
are<br />
available<br />
to<br />
the<br />
authorization<br />
service<br />
that<br />
permits<br />
or<br />
denies<br />
access<br />
to<br />
requested<br />
objects<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
protected<br />
object<br />
space.<br />
8<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide