IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Building
a
custom
personalization
service
A
Web
portal,
or
launch
page,
is
an
integrated
Web
site
service
that
dynamically
produces
a
customized
list
of
Web
resources
available
to
a
specific
user.
Resources
can
include
corporate
content,
support
services,
and
learning
tools.
The
portal
output
represents
a
personalized
list
of
resources
based
on
the
access
permissions
for
the
particular
user.
The
launch
page
displays
only
those
resources
that
have
the
correct
access
permissions
for
that
user.
You
can
use
WebSEAL
configuration
options
and
the
authorization
API
entitlements
service
to
build
a
custom
portal
solution
in
a
Tivoli
Access
Manager
environment.
The
process
flow
for
building
a
custom
WebSEAL
portal
service
includes
the
following
tasks:
1.
Secure
policies
are
formulated
and
attached
at
the
appropriate
points
in
the
protected
object
resource.
2.
Appropriate
explicit
ACLs
are
attached
to
each
of
these
resource
objects.
3.
The
WebSEAL
configuration
file
is
edited
to
include
the
URL
to
the
portal
service,
the
path
of
the
object
space
containing
the
portal
resources,
and
the
permission
bit
required
by
the
user
for
access
to
these
resources.
4.
For
each
user
request
to
the
portal
URL,
WebSEAL
uses
the
Authorization
Entitlement
Service
to
search
this
object
space
and
produce
a
list
of
resources
that
meet
the
authorization
conditions
for
that
user.
5.
WebSEAL
places
this
information
in
a
PD_PORTAL
HTTP
header
that
is
sent
to
the
back-end
(junctioned)
portal
server.
6.
The
custom
portal
service
(such
as
a
CGI
or
servlet)
located
on
the
back-end
server
reads
the
PD_PORTAL
header
contents
and,
for
example,
maps
the
contents
to
descriptions
and
URL
links
that
are
displayed
to
the
user
on
a
Web
page.
This
information
represents
the
personalized
list
of
resources
available
to
the
user
based
on
access
control
permissions.
Configuring
WebSEAL
for
a
personalization
service
1.
Create
a
new
WebSEAL
junction
to
the
personalization
service.
For
example:
pdadmin>
server
task
server_name
create
-t
tcp
-h
portalhost.abc.com
\
/portal-jct
2.
Edit
the
WebSEAL
configuration
file
to
add
a
new
[portal-map]
stanza:
[portal-map]
3.
The
entry
in
this
stanza
identifies
the
server-relative
URL
of
the
portal
service
program
and
the
region
of
the
object
space
that
is
searched
for
available
protected
portal
resources,
followed
by
the
permission
required
for
access.
This
is
the
list
that
is
placed
in
the
PD_PORTAL
header.
[portal-map]
URL
=
object_space_region:permission
4.
After
adding
the
stanza
and
the
appropriate
mapping
entries,
WebSEAL
(webseald)
must
be
re-started.
Personalization
service
example
v
Create
a
junction
to
the
portal
server:
pdadmin>
server
task
web1-webseald-cruz
-t
ssl
-h
PORTAL1
/portal
v
Define
the
region
of
the
WebSEAL
protected
object
space
that
contains
resources
available
to
the
personalization
service:
Chapter
12.
Application
integration
341