IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
security
policy
To
provide
suitable
security
to
Web
resources,
while
retaining
an
easy-to-use
system,
the
business
has
established
the
following
security
goals:
v
Travel
agent
staff
have
complete
control
over
all
bookings.
v
Authenticated
customers
can
make
and
change
their
own
bookings,
but
cannot
interfere
with
the
travel
data
of
other
authenticated
customers.
v
Administration
staff
have
complete
access
to
all
of
the
administration
information.
v
Travel
Kingdom
staff
other
than
the
Administration
department
can
change
their
own
resume
information
and
view
partial
information
of
other
members
of
staff.
Dynamic
URL
to
object
space
mappings
To
achieve
the
security
goals
described
above,
the
mappings
from
dynamic
URLs
to
ACL
object
entries
need
to
be
configured
as
shown
in
the
following
table.
Remember
that
the
ordering
of
these
mappings
is
an
important
part
of
achieving
the
security
goals
discussed
earlier.
Object
Space
Entry
URL
Pattern
/ows/tr/browse
/ows/db-apps/owa/tr.browse\?dest=*&date=??/??/????
/ows/tr/auth
/ows/db-apps/owa/tr.book\?dest=*&depart=??/??/????&
return=??/??/????
/ows/tr/auth
/ows/db-apps/owa/tr.change
/ows/admin/forall
/ows/db-apps/owa/admin.resume
/ows/admin/forall
/ows/db-apps/owa/admin.browse\?empid=[th]???
/ows/admin/auth
/ows/db-apps/owa/admin.update\?empid=????
Secure
clients
Client
authenticate
to
WebSEAL
over
a
secure,
encrypted
channel.
Customers
who
wish
to
use
the
Web
interface
must
additionally
register
with
the
Travel
Kingdom
Webmaster
to
receive
an
account.
Account
and
group
structure
Four
groups
are
created
on
the
system:
Staff
Members
of
the
Travel
Kingdom
organization.
TKStaff
Travel
Kingdom
travel
agents.
AdminStaff
Members
of
the
Travel
Kingdom
Administration
Department.
Note
that
Administration
staff
members
are
also
in
the
Staff
group.
Customer
Customers
of
Travel
Kingdom
who
want
to
make
their
travel
bookings
across
the
Internet.
Each
user
is
given
an
account
in
the
secure
domain
to
be
individually
identified
by
the
WebSEAL
server.
The
user’s
identity
is
also
passed
to
the
Oracle
Web
Servers
to
provide
a
single
sign-on
solution
to
all
of
the
Web
resources.
Access
control
The
following
table
lists
the
access
controls
resulting
from
application
of
the
preceding
information:
354
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide