IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Credentials<br />
can<br />
be<br />
used<br />
by<br />
any<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
service<br />
that<br />
requires<br />
in<strong>for</strong>mation<br />
about<br />
the<br />
client.<br />
Credentials<br />
allow<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
to<br />
securely<br />
per<strong>for</strong>m<br />
a<br />
multitude<br />
of<br />
services<br />
such<br />
as<br />
authorization,<br />
auditing,<br />
and<br />
delegation.<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
distinguishes<br />
the<br />
authentication<br />
of<br />
the<br />
user<br />
from<br />
the<br />
acquisition<br />
of<br />
credentials.<br />
A<br />
user’s<br />
identity<br />
is<br />
always<br />
constant.<br />
However,<br />
credentials—which<br />
define<br />
the<br />
groups<br />
or<br />
roles<br />
in<br />
which<br />
a<br />
user<br />
participates—are<br />
variable.<br />
Context-specific<br />
credentials<br />
can<br />
change<br />
over<br />
time.<br />
For<br />
example,<br />
when<br />
a<br />
person<br />
is<br />
promoted,<br />
credentials<br />
must<br />
reflect<br />
the<br />
new<br />
responsibility<br />
level.<br />
See<br />
Chapter<br />
6,<br />
“Authentication,”<br />
on<br />
page<br />
129<br />
<strong>for</strong><br />
further<br />
in<strong>for</strong>mation<br />
about<br />
support<br />
<strong>for</strong><br />
specific<br />
authentication<br />
methods.<br />
Authenticated<br />
and<br />
unauthenticated<br />
access<br />
to<br />
resources<br />
In<br />
a<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
secure<br />
domain<br />
environment,<br />
the<br />
identity<br />
of<br />
a<br />
user<br />
is<br />
proven<br />
to<br />
<strong>WebSEAL</strong><br />
through<br />
the<br />
process<br />
of<br />
authentication.<br />
In<br />
general,<br />
a<br />
user<br />
can<br />
participate<br />
in<br />
the<br />
secure<br />
domain<br />
as<br />
authenticated<br />
or<br />
unauthenticated.<br />
In<br />
either<br />
case,<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
authorization<br />
service<br />
requires<br />
a<br />
user<br />
credential<br />
to<br />
make<br />
authorization<br />
decisions<br />
on<br />
requests<br />
<strong>for</strong><br />
resources<br />
in<br />
the<br />
secure<br />
domain.<br />
<strong>WebSEAL</strong><br />
handles<br />
authenticated<br />
user<br />
credentials<br />
differently<br />
from<br />
unauthenticated<br />
user<br />
credentials.<br />
The<br />
credential<br />
<strong>for</strong><br />
an<br />
unauthenticated<br />
user<br />
is<br />
simply<br />
a<br />
generic<br />
passport<br />
that<br />
allows<br />
the<br />
user<br />
to<br />
participate<br />
in<br />
the<br />
secure<br />
domain<br />
and<br />
access<br />
resources<br />
that<br />
are<br />
available<br />
to<br />
unauthenticated<br />
users.<br />
The<br />
credential<br />
<strong>for</strong><br />
an<br />
authenticated<br />
user<br />
is<br />
a<br />
unique<br />
passport<br />
that<br />
describes<br />
a<br />
specific<br />
user<br />
who<br />
belongs<br />
to<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
registry<br />
(or<br />
is<br />
processed<br />
successfully<br />
by<br />
a<br />
CDAS).<br />
The<br />
authenticated<br />
user<br />
credential<br />
contains<br />
the<br />
user<br />
identity,<br />
any<br />
group<br />
memberships,<br />
and<br />
any<br />
special<br />
(″extended″)<br />
security<br />
attributes.<br />
The<br />
process<br />
flow<br />
<strong>for</strong><br />
authenticated<br />
users:<br />
v<br />
A<br />
user<br />
makes<br />
a<br />
request<br />
<strong>for</strong><br />
a<br />
resource<br />
protected<br />
by<br />
<strong>WebSEAL</strong>.<br />
The<br />
protection<br />
on<br />
the<br />
resource<br />
requires<br />
that<br />
the<br />
user<br />
be<br />
authenticated.<br />
<strong>WebSEAL</strong><br />
prompts<br />
the<br />
user<br />
to<br />
log<br />
in.<br />
v<br />
Successful<br />
authentication<br />
can<br />
occur<br />
only<br />
if<br />
the<br />
user<br />
is<br />
a<br />
member<br />
of<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
user<br />
registry<br />
or<br />
is<br />
handled<br />
by<br />
a<br />
CDAS<br />
operation.<br />
v<br />
A<br />
<strong>WebSEAL</strong><br />
session<br />
ID<br />
is<br />
created<br />
<strong>for</strong><br />
the<br />
user.<br />
v<br />
A<br />
credential<br />
<strong>for</strong><br />
this<br />
user<br />
is<br />
built<br />
from<br />
in<strong>for</strong>mation<br />
contained<br />
in<br />
the<br />
registry<br />
about<br />
this<br />
user<br />
(such<br />
as<br />
group<br />
memberships).<br />
v<br />
The<br />
session<br />
ID<br />
and<br />
credential,<br />
plus<br />
other<br />
data,<br />
is<br />
stored<br />
as<br />
an<br />
entry<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
session/credentials<br />
cache.<br />
v<br />
As<br />
<strong>WebSEAL</strong><br />
processes<br />
this<br />
request<br />
(and<br />
future<br />
requests<br />
during<br />
this<br />
session),<br />
it<br />
keeps<br />
the<br />
credential<br />
in<strong>for</strong>mation<br />
available.<br />
v<br />
Whenever<br />
an<br />
authorization<br />
check<br />
is<br />
required,<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
authorization<br />
service<br />
uses<br />
the<br />
credential<br />
in<strong>for</strong>mation<br />
during<br />
the<br />
decision-making<br />
process.<br />
v<br />
When<br />
the<br />
user<br />
logs<br />
off,<br />
the<br />
cache<br />
entry<br />
<strong>for</strong><br />
that<br />
user<br />
is<br />
removed<br />
and<br />
the<br />
session<br />
is<br />
terminated.<br />
The<br />
process<br />
flow<br />
<strong>for</strong><br />
unauthenticated<br />
users:<br />
Chapter<br />
1.<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>WebSEAL</strong><br />
overview<br />
9