IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Providing
access
control
to
dynamic
URLs
The
current
Web
environment
gives
users
immediate
access
to
rapidly
changing
information.
Many
Web
applications
dynamically
generate
Uniform
Resource
Locators
(URLs)
in
response
to
each
user
request.
These
dynamic
URLs
may
exist
only
for
a
short
time.
Despite
their
temporary
nature,
dynamic
URLs
still
need
strong
protection
from
unwanted
use
or
access.
Dynamic
URL
components
Some
sophisticated
Web
application
tools
use
standard
Web
browsers
to
communicate
with
application
servers
through
the
CGI
interface
of
a
Web
server.
All
these
tools
use
dynamic
URLs
and
hidden
form
elements
to
communicate
the
requested
operation
(with
its
parameter
value)
to
the
application
server.
A
dynamic
URL
augments
the
standard
URL
address
with
information
about
the
specific
operation
and
its
parameter
values.
The
query
string
portion
of
the
URL
provides
operations,
parameters,
and
values
to
the
Web
application
interface.
Mapping
ACL
and
POP
objects
to
dynamic
URLs
WebSEAL
uses
the
protected
object
space
model,
access
control
lists
(ACL),
and
protected
object
policies
(POP)
to
secure
dynamically
generated
URLs,
such
as
those
generated
by
database
requests.
Each
request
to
WebSEAL
is
resolved
to
a
specific
object
as
the
first
step
in
the
authorization
process.
An
ACL/POP
applied
to
the
object
dictates
the
required
protection
on
any
dynamic
URL
mapped
to
that
object.
Because
dynamic
URLs
exist
only
temporarily,
it
is
not
possible
to
have
entries
for
them
in
a
pre-configured
authorization
policy
database.
Tivoli
Access
Manager
solves
this
problem
by
providing
a
mechanism
where
many
dynamic
URLs
can
be
mapped
to
a
single
static
protected
object.
Mappings
from
objects
to
patterns
are
kept
in
a
plain
text
configuration
file:
/opt/pdweb/www/lib/dynurl.conf
The
location
of
this
file
(relative
to
the
server-root)
is
defined
by
the
dynurl-map
parameter
in
the
[server]
stanza
of
the
WebSEAL
configuration
file:
[server]
dynurl-map
=
lib/dynurl.conf
You
must
create
this
file;
the
file
does
not
exist
by
default.
The
existence
of
this
file
(with
entries)
enables
the
dynamic
URL
capability.
http://www.ibm.com/sales/web/fortecgi.cgi?name=catalog&product=shirt&color=red
Protocol Web
Server
Directory Path
to CGI Program
Operation, Parameters,
and Values for Web
Application Interface
CGI
Program
File
Base URL Query String
Figure
21.
Passing
data
to
a
CGI
gateway
using
a
URL
Chapter
12.
Application
integration
347