IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Credentials
can
be
used
by
any
Tivoli
Access
Manager
service
that
requires
information
about
the
client.
Credentials
allow
Tivoli
Access
Manager
to
securely
perform
a
multitude
of
services
such
as
authorization,
auditing,
and
delegation.
Tivoli
Access
Manager
distinguishes
the
authentication
of
the
user
from
the
acquisition
of
credentials.
A
user’s
identity
is
always
constant.
However,
credentials—which
define
the
groups
or
roles
in
which
a
user
participates—are
variable.
Context-specific
credentials
can
change
over
time.
For
example,
when
a
person
is
promoted,
credentials
must
reflect
the
new
responsibility
level.
See
Chapter
6,
“Authentication,”
on
page
129
for
further
information
about
support
for
specific
authentication
methods.
Authenticated
and
unauthenticated
access
to
resources
In
a
Tivoli
Access
Manager
secure
domain
environment,
the
identity
of
a
user
is
proven
to
WebSEAL
through
the
process
of
authentication.
In
general,
a
user
can
participate
in
the
secure
domain
as
authenticated
or
unauthenticated.
In
either
case,
the
Tivoli
Access
Manager
authorization
service
requires
a
user
credential
to
make
authorization
decisions
on
requests
for
resources
in
the
secure
domain.
WebSEAL
handles
authenticated
user
credentials
differently
from
unauthenticated
user
credentials.
The
credential
for
an
unauthenticated
user
is
simply
a
generic
passport
that
allows
the
user
to
participate
in
the
secure
domain
and
access
resources
that
are
available
to
unauthenticated
users.
The
credential
for
an
authenticated
user
is
a
unique
passport
that
describes
a
specific
user
who
belongs
to
the
Tivoli
Access
Manager
user
registry
(or
is
processed
successfully
by
a
CDAS).
The
authenticated
user
credential
contains
the
user
identity,
any
group
memberships,
and
any
special
(″extended″)
security
attributes.
The
process
flow
for
authenticated
users:
v
A
user
makes
a
request
for
a
resource
protected
by
WebSEAL.
The
protection
on
the
resource
requires
that
the
user
be
authenticated.
WebSEAL
prompts
the
user
to
log
in.
v
Successful
authentication
can
occur
only
if
the
user
is
a
member
of
the
Tivoli
Access
Manager
user
registry
or
is
handled
by
a
CDAS
operation.
v
A
WebSEAL
session
ID
is
created
for
the
user.
v
A
credential
for
this
user
is
built
from
information
contained
in
the
registry
about
this
user
(such
as
group
memberships).
v
The
session
ID
and
credential,
plus
other
data,
is
stored
as
an
entry
in
the
WebSEAL
session/credentials
cache.
v
As
WebSEAL
processes
this
request
(and
future
requests
during
this
session),
it
keeps
the
credential
information
available.
v
Whenever
an
authorization
check
is
required,
the
Tivoli
Access
Manager
authorization
service
uses
the
credential
information
during
the
decision-making
process.
v
When
the
user
logs
off,
the
cache
entry
for
that
user
is
removed
and
the
session
is
terminated.
The
process
flow
for
unauthenticated
users:
Chapter
1.
IBM
Tivoli
Access
Manager
WebSEAL
overview
9