IBM WebSphere V5.0 Security - CGISecurity

Testing the junctions
The following tests will help to make sure that the junctions are set correctly. The
first tests will be performed on the appsrv02 server.
1. Point a browser to http://appsrv02/itsobank and the ITSOBank welcome
window is displayed. Click any of the functions of the application, they are
available without challenge for identity.
2. Point a new browser session to https://wsl01/junction2/itsobank/ and
after the normal certificate warnings (accept the certificate), a Basic
Authentication challenge is presented which can be answered with any of the
users created earlier to show the ITSOBank Welcome window. All
functionality is again available as it is only the junction which is protected.
The next two steps will access the application on the appsrv01 server.
1. Point a browser to http://appsrv01/itsobank and you are again presented
with the welcome window. However, attempting to use either function requires
a valid Access Manager identity to be authorized.
2. Point a new browser to http://wsl01/junction1/itsobank; this results in a Basic
Authentication challenge before the ITSOBank welcome window is shown. It
is not until you attempt to access one of the protected funtions that you are
challenged again for a valid identity. The welcome window which is not
protected by the application is in effect a static resource which can be
independently protected by WebSEAL.
Protecting WebSphere URIs
Access Manager can secure WebSphere servlets and JSPs but not EJBs or
individual methods, only URIs. If the application you wish to secure is of a simple
enough design then this may be all you need.
This sample will use the index.jsp page provided with the ITSOBank sample
application. The index.jsp is available for everyone, the resource is not protected,
access is granted for the Everyone special subject to be exact. This sample will
use Tivoli Access Manager WebSEAL to protect this resource and only give
access to the user accountant01 in the accountantgrp group. You can try to
access the index.jsp at http:///itsobank/index.jsp.
1. Start the pdadmin tool to administer Tivoli Access Manager, and login with the
sec_master user.
2. Create a junction to the Web space.
pdadmin> server task Webseald-wsl01 create -f -t tcp -h appsrv01 -p 9080
/itsobankURItest
3. Create a new ACL for the index.jsp resource.
acl create itsobankURItestACL
428 IBM WebSphere V5.0 Security Handbook