IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
Authenticated
clients
access
using
HTTP
or
HTTPS
v
Administrator
determines
the
need
for
encryption
v
Authenticated
credential
used
for
access
control
to
resources;
clients
must
have
account
defined
in
user
registry
v
WebSEAL
configuration
is
complex
and
all
options
must
be
considered
carefully
to
determine
impact
of
security
policy
Understanding
WebSEAL
authentication
Authentication
is
the
method
of
identifying
an
individual
process
or
entity
attempting
to
login
to
a
secure
domain.
When
both
server
and
client
require
authentication,
the
exchange
is
known
as
mutual
authentication.
WebSEAL
can
enforce
a
high
degree
of
security
in
a
secure
domain
by
requiring
each
client
to
provide
proof
of
its
identity.
The
following
conditions
apply
to
WebSEAL
authentication:
v
WebSEAL
supports
a
standard
set
of
authentication
methods.
You
can
customize
WebSEAL
to
support
other
authentication
methods.
v
The
WebSEAL
server
process
is
independent
of
the
authentication
method.
v
WebSEAL
requires
a
client
identity.
From
this
identity,
WebSEAL
builds
an
authenticated
(or
unauthenticated)
credential
that
can
be
used
by
the
Tivoli
Access
Manager
authorization
service
to
permit
or
deny
access
to
resources.
This
flexible
approach
to
authentication
allows
security
policy
to
be
based
on
business
requirements
and
not
physical
network
topology.
The
goals
of
authentication
Although
WebSEAL
is
independent
of
the
authentication
process,
WebSEAL
requires
the
results
of
authentication—the
client
identity.
The
authentication
process
results
in
the
following
actions:
1.
The
authentication
method
results
in
a
client
identity
Client
authentication
is
successful
only
if
the
user
has
an
account
defined
in
the
Tivoli
Access
Manager
user
registry
or
is
processed
successfully
by
a
Cross-domain
Authentication
Service
(CDAS).
Otherwise
the
user
is
designated
as
unauthenticated.
Method-specific
identity
information,
such
as
passwords,
tokens,
and
certificates,
represent
physical
identity
properties
of
the
user.
This
information
can
be
used
to
establish
a
secure
session
with
the
server.
2.
WebSEAL
uses
the
identity
to
acquire
credentials
for
that
client
WebSEAL
matches
the
client
identity
with
a
registered
Tivoli
Access
Manager
user.
WebSEAL
then
builds
the
credentials
appropriate
to
this
user.
This
is
known
as
credentials
acquisition.
The
credential
represents
a
user’s
privileges
in
the
secure
domain,
describes
the
user
in
a
specific
context,
and
is
valid
only
for
the
lifetime
of
that
session.
Credential
data
includes
the
user
name,
any
group
memberships,
and
any
special
″extended″
security
attributes.
If
a
user
is
not
a
member
of
the
user
registry
(″anonymous″),
WebSEAL
builds
an
unauthenticated
credential
for
that
user.
Remember
that
an
ACL
can
contain
special
rules
governing
unauthenticated
users.
These
credentials
are
available
to
the
authorization
service
that
permits
or
denies
access
to
requested
objects
in
the
WebSEAL
protected
object
space.
8
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide