IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Creating
custom
protocol
plug-ins
Overview
The
attribute
retrieval
service
uses
a
special
XML
construct,
known
as
a
container,
to
retrieve
and
convey
authorization
decision
information.
An
ADI
request
is
always
made
in
the
form
of
a
container
name.
When
a
request
for
ADI
(as
a
container
name)
is
received
by
the
attribute
retrieval
service,
the
container
name
is
compared
against
all
container
names
described
in
the
Container
Descriptor
Table
(ContainerDescriptorTable.xml).
If
a
match
is
found,
the
process
of
retrieving
the
ADI
can
continue.
Information
in
the
container
description
reveals
what
ADI
is
required,
where
the
ADI
can
be
found,
and
what
protocol
must
be
used
to
communicate
with
the
external
provider
of
the
ADI.
The
ADI,
enclosed
within
opening
and
closing
container
name
XML
tags,
is
known
as
a
container.
The
attribute
retrieval
service
generates
a
client
that
uses
the
necessary
protocol
to
retrieve
the
ADI
from
the
external
provider.
If
the
ADI
must
be
retrieved
using
a
protocol
that
is
not
provided
by
the
current
release
of
the
attribute
retrieval
service
(included
with
Tivoli
Access
Manager
WebSEAL),
then
a
custom
protocol
plug-in
must
be
created.
Creating
the
protocol
plug-in
Custom
protocols
are
written
as
Java
classes
that
extend
the
public
class
FixedProviderProtocol,
and
must
implement
the
following
three
abstract
methods:
v
public
ProtocolInitStatus
initialize()
v
public
ProtocolRunStatus
run()
v
public
ProtocolShutdownStatus
shutdown()
The
initialize()
method
is
called
once,
to
initialize
the
protocol
during
the
execution
of
the
″initialize″
method
of
the
attribute
retrieval
service.
For
example,
this
method
can
be
responsible
for
establishing
a
connection
to
a
remote
database
or
profiling
service.
The
run()
method
is
called
(by
the
″getEntitlement″
method
of
the
attribute
retrieval
service)
each
time
a
request
is
made
for
a
container
that
must
be
retrieved
by
this
protocol.
This
method
must
retrieve
the
requested
container
(or
containers)
specified
by
the
_container_descriptors
member
variable
of
the
client
class’
HashMap.
This
container
can
be
obtained
using
the
elements()
method
of
the
client
class.
The
client
class’
addContainer()
method
is
then
used
to
add
the
retrieved
container
(or
containers)
to
the
client
class’
_session.
How,
and
from
where,
the
protocol
acquires
the
container
is
specific
to
the
individual
protocol.
The
shutdown()
method
is
called
once
to
shutdown
the
protocol
during
the
execution
of
the
″shutdown″
method
of
the
attribute
retrieval
service.
For
example,
this
method
can
be
responsible
for
closing
the
connections
to
remote
databases
or
profiling
services
that
were
opened
during
the
″initialize″
method
.
The
following
resources
are
available
to
assist
in
creating
a
custom
protocol
plug-in:
v
Attribute
retrieval
service
class
documentation
/opt/pdwebars/amwebars_class_doc.zip
v
Example
protocol
plug-in
modules
(Java)
Chapter
14.
Attribute
retrieval
service
reference
375