IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Object
Space
Entry
URL
Template
/ows/sales/bksale
/ows/db-apps/owa/book.sales*
/ows/sales/general
/ows/db-apps/owa/*
Note
that
if
the
mapping
entries
were
in
the
reverse
order,
all
stored
procedures
in
the
/ows/db-apps/owa
directory
would
map
to
the
/ows/sales/general
object.
This
could
lead
to
possible
breaches
of
security,
due
to
this
incorrect
object
space
resolution.
When
you
map
a
URL
regular
expression
to
an
object
space
entry,
the
URL
format
should
take
on
the
format
as
produced
from
the
GET
method
—
regardless
of
whether
the
POST
or
GET
method
is
being
used.
In
the
GET
method
of
data
transmission,
the
dynamic
data
(such
as
the
data
supplied
by
a
user
in
a
form)
is
appended
to
the
URL.
In
the
POST
method
of
data
transmission,
the
dynamic
data
is
included
in
the
body
of
the
request.
ACL
and
POP
Evaluation
As
soon
as
the
dynamic
URL
has
been
resolved
to
an
object
space
entry,
the
standard
ACL/POP
inheritance
model
is
used
to
determine
if
the
request
should
be
processed
or
forbidden
(due
to
insufficient
privilege).
Configuring
limitations
on
POST
requests
The
content
of
a
POST
request
is
contained
in
the
body
of
the
request.
In
addition,
a
POST
request
contains
the
browser-determined
length
of
this
content
and
lists
the
value
in
bytes.
request-body-max-read
The
request-body-max-read
parameter
in
the
[server]
stanza
of
the
WebSEAL
configuration
file
limits
the
impact
of
large
POST
requests
on
WebSEAL
by
specifying
the
maximum
number
of
bytes
to
read
in
as
content
from
the
body
of
POST
requests.
The
content
read
in
by
WebSEAL
is
subject
to
authorization
checks,
as
described
earlier
in
this
section.
The
request-body-max-read
parameter
value
is
considered
when
the
POST
request
is
used
for
dynamic
URL
processing
or
Forms
authentication.
The
default
value
is
4096
bytes:
[server]
request-body-max-read
=
4096
Note
that
this
parameter
does
not
limit
the
maximum
POST
content
size
(which
is
unlimited).
The
parameter
protects
WebSEAL
from
processing
a
POST
request
of
unreasonable
size.
For
more
information
on
modifying
request-body-max-read,
see
“Modifying
request-body-max-read”
on
page
202.
dynurl-allow-large-posts
Although
the
request-body-max-read
parameter
limits
the
amount
of
POST
content
read
and
processed
by
WebSEAL,
it
does
not
prevent
the
request,
in
its
entirety,
from
being
passed
through
to
the
application
server.
In
this
scenario,
350
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide