IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
resource-manager-provided-adi
parameter
in
the
[aznapi-configuration]
stanza
of
the
WebSEAL
configuration
file
specifies—to
the
authorization
rules
evaluation
process—
the
prefixes
that
can
be
used
in
container
names
specified
by
authorization
rules.
To
specify
multiple
prefixes,
use
multiple
entries
of
the
resource-manager-provided-adi
parameter:
[aznapi-configuration]
resource-manager-provided-adi
=
AMWS_qs_
resource-manager-provided-adi
=
AMWS_pb_
resource-manager-provided-adi
=
AMWS_hd_
The
permission-info-returned
parameter
in
the
[aznapi-configuration]
stanza
of
the
WebSEAL
configuration
file
appears
by
default.
This
parameter
specifies
the
permission
information
returned
to
the
resource
manager
(for
example,
WebSEAL)
from
the
authorization
service.
The
following
example
is
entered
as
one
line,
with
a
single
space
separating
the
two
permission
types:
[aznapi-configuration]
permission-info-returned
=
azn_perminfo_rules_adi_request
azn_perminfo_reason_rule_failed
The
azn_perminfo_rules_adi_request
setting
allows
the
authorization
service
to
request
ADI
from
the
current
WebSEAL
client
request.
The
azn_perminfo_reason_rule_failed
setting
specifies
that
rule
failure
reasons
be
returned
to
the
resource
manager
(this
setting
is
required
for
–R
junctions—see
“Supplying
a
failure
reason
across
a
junction”
on
page
363).
Example:
Retrieving
ADI
from
the
request
header
The
following
example
authorization
rule
requires
the
name
of
the
client
machine’s
host
name.
The
client
request
is
set
up
to
include
the
host
name
value
in
the
″host″
header
of
the
request.
The
use
of
the
AMWS_hd_
prefix
in
the
rule
alerts
the
authorization
evaluation
process
that
the
required
ADI
is
available
in
the
client
request
and
that
WebSEAL
knows
how
to
find,
extract,
and
return
this
ADI.
!TRUE!
WebSEAL
is
designed
to
know
how
to
handle
the
extraction
of
ADI
information
from
the
request:
[aznapi-configuration]
resource-manager-provided-adi
=
AMWS_hd_
WebSEAL
understands
this
information
can
be
found
in
the
request
header
name
″host″.
WebSEAL
extracts
the
value
contained
in
the
″host″
header
and
returns
it
to
the
authorization
evaluation
process.
The
example
authorization
rule
is
evaluated
to
be
true
if
the
value
provided
in
the
request’s
″host″
header
is
″machineA″.
In
a
similar
manner,
information
required
to
evaluate
an
authorization
rule
can
come
from
the
request
POST
body
or
the
query
string
of
the
request.
Example:
Retrieving
ADI
from
the
request
query
string
The
following
example
authorization
rule
requires
the
name
of
the
client’s
zip
code
as
passed
in
the
query
string
of
a
GET
request
(as
submitted
in
response
to
a
form).
The
client
request
is
set
up
to
include
the
zip
code
value
in
the
″zip″
field
of
the
request
query
string.
https://www.service.com/location?zip=99999
360
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide