IBM WebSphere V5.0 Security - CGISecurity

The Policy Server replicates this database to all the local authorization servers,
including WebSEAL, throughout the domain, publishing updates as required. The
Policy Server also maintains location information about the other Access
Manager and non-Access Manager servers operating in the secure domain.
There can be only one Policy Server active within a domain.
Access Manager provides C and Java authorization APIs which can be used
programmatically within other applications and clients. Client calls for
authorization decisions, through the Access Manager Run-time service, which
must be on every server participating in the secure domain, are always referred
to an Authorization Server. Programatically made calls can be local or remote;
they will be passed to an Authorization Server. When running local node API, the
application communicates to the security server (Access Manager), no
authorization server is required.
Authorization servers are the decision-making servers that determines a client's
ability to access a protected resource based on the security policy. Each server
has a local replica of the policy database. There must be at least one within a
Secure Domain.
Web Portal Manager, a WebSphere-hosted application is provided to enter and
modify the contents of the policy store and the user registry. There is also a
command line utility, pdadmin, which extends the available commands available
to include the creation and registration of authentication blades such as
WebSEAL which will be described a little later.
Access Manager can be configured to integrate with many of the WebSphere
branded products and ships with explicit plug-ins for the following products:
►
►
►
WebSphere Application Server.
WebSphere Edge Server
BEA Robotic Application Server
► Web Server Plug-in, which supports IIS 5.0 for a Windows 2000
Server/Advanced Server environment, iPlanet 6.0 for Solaris Operating
Environment 7 (sparc) and IHS 1.3.19 for an AIX 5L environment.
The list of point products and components shipped in the Tivoli Access Manager
V3.9 package can be found in Table 12-1 on page 377.
376 IBM WebSphere V5.0 Security Handbook