IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Retrieving
ADI
from
the
WebSEAL
client
request
In
a
WebSEAL
environment,
authorization
rules
can
be
written
to
require
authorization
decision
information
(ADI)
contained
in
the
client
HTTP/HTTPS
request.
ADI
can
be
contained
in
the
request
header,
the
request
query
string,
and
the
request
POST
body.
Authorization
decision
information
is
referred
to
by
an
XML
container
name
in
authorization
rules.
A
special
WebSEAL-specific
prefix
in
the
container
name
is
used
to
alert
the
authorization
rules
evaluation
process
that
WebSEAL
can
interpret
this
parameter
correctly
and
return
a
value.
Prefixes
can
be
specific
to
any
resource
manager.
Accordingly,
the
resource
manager
must
be
designed
to
respond
appropriately
to
a
request
for
ADI.
The
following
container
names
contain
prefixes
that
are
appropriate
for
WebSEAL:
v
AMWS_hd_name
Request
header
container
name.
The
value
of
the
HTTP
header
called
name
in
the
HTTP
request
is
returned
to
the
authorization
rules
evaluator
as
ADI.
v
AMWS_qs_name
Request
query
string
container
name.
The
value
of
name
in
the
request
query
string
is
returned
to
the
authorization
rules
evaluator
as
ADI.
v
AMWS_pb_name
Request
POST
body
container
name.
The
value
of
name
in
the
request
POST
body
is
returned
to
the
authorization
rules
evaluator
as
ADI.
The
following
process
flow
helps
illustrate
how
prefixes
enable
the
extraction
of
ADI
from
client
requests:
1.
An
authorization
rule
is
written
that
requires
ADI
from
the
client
request
(for
example,
a
specific
HTTP
header
in
the
request).
In
this
example,
the
AMWS_hd_
prefix
is
used
in
the
container
name
specified
in
the
rule.
The
prefix
must
be
specified
by
the
resource-manager-provided-adi
parameter
in
the
[aznapi-configuration]
stanza
of
the
WebSEAL
configuration
file.
The
authorization
service
incorporates
this
configuration
information
during
its
initialization.
This
WebSEAL-specific
prefix
alerts
the
authorization
evaluation
process
that
the
required
ADI
is
available
in
the
client
request
and
that
WebSEAL
knows
how
to
find,
extract,
and
return
this
ADI.
2.
The
authorization
rules
evaluation
process
tries
to
evaluate,
for
example,
the
AMWS_hd_host
container
name
in
a
rule.
The
AMWS_hd_
prefix
alerts
the
authorization
evaluation
process
that
WebSEAL
can
interpret
this
container
name
correctly
and
return
a
value.
3.
The
AMWS_hd_host
container
name
is
sent
to
WebSEAL.
WebSEAL
is
designed
to
recognize
and
interpret
the
AMWS_hd_
prefix.
4.
WebSEAL
responds
to
the
AMWS_hd_host
container
name
by
looking
for
the
″host″
header
in
the
client
request
and
extracting
the
value
associated
with
that
header.
5.
WebSEAL
returns
the
″host″
header
value
(as
an
XML
container)
to
the
authorization
rules
evaluation
process.
6.
The
authorization
rules
evaluation
process
uses
the
value
as
ADI
in
its
evaluation
of
the
rule.
Chapter
13.
Authorization
decision
information
retrieval
359