IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Dynamic
ADI
retrieval
Rules
can
be
written
requiring
ADI
that
cannot
be
found
in
any
of
the
information
that
the
Tivoli
Access
Manager
authorization
service
has
access
to.
In
these
cases,
it
is
necessary
to
retrieve
the
ADI
from
an
outside
source.
This
retrieval
can
be
performed
in
real-time
by
a
dynamic
ADI
entitlement
retrieval
service.
The
attribute
retrieval
service,
currently
provided
with
WebSEAL,
is
one
type
of
entitlement
retrieval
service.
The
attribute
retrieval
service
provides
communication
and
format
translation
services
between
the
WebSEAL
entitlement
service
library
and
an
external
provider
of
authorization
decision
information.
The
process
flow
for
the
attribute
retrieval
service
is
described
below:
1.
The
client
makes
a
request
for
resource
protected
by
an
authorization
rule.
2.
The
authorization
rules
evaluator—part
of
the
authorization
service—determines
that
specific
authorization
decision
information
(ADI)
is
required
to
complete
the
evaluation
of
the
rule.
The
ADI
requested
is
not
available
from
the
user
credential,
the
authorization
service,
or
WebSEAL.
3.
The
task
of
ADI
retrieval
is
sent
to
the
attribute
retrieval
service
through
the
entitlements
service
library.
This
service
formats
the
request
for
ADI
as
a
SOAP
request.
The
SOAP
request
is
sent
over
HTTP
to
the
Web
Service
Description
Language
(WSDL)
interface
of
the
attribute
retrieval
service.
4.
The
attribute
retrieval
service
formats
the
request
appropriately
for
the
external
provider
of
ADI.
5.
The
external
provider
of
ADI
returns
the
appropriate
ADI.
6.
The
ADI
is
formatted
in
another
SOAP
container
and
returned
to
the
WebSEAL
entitlements
service.
Now
the
authorization
rules
evaluator
has
the
necessary
information
to
evaluate
the
rule
and
make
a
decision
to
accept
or
deny
the
original
client
request.
364
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide