IBM WebSphere V5.0 Security - CGISecurity

Without an Access Manager authentication blade such as WebSEAL, a Web
server with an Access Manager plug-in or WebSphere Edge Server with the
Access Manager plug-in, the WebSphere container would request authentication
of the user from the user registry directly. The authorization process would then
be identical, however.
The advantages of externalizing the control of the security model have been
discussed earlier. The specific advantage of the integrated Access Manager
module is that J2EE applications do not require coding changes to take
advantage of the dynamic flexibility, allowing changes to user and group
mappings to roles without stopping and starting an application through the
manipulation of Access Manager ACLs.
The highest prefix to all J2EE roles defined for WebSphere applications is the
Access Manager protected object for “WebAppServer” together with the child
object “deployedResources”. Both these object names are created the first time
the Access Manager application migration tool is run.
/
"WebAppServer"
"deployedResources"
Figure 12-25 Access Manager Protected Object Name Space
Figure 12-25 shows the Access Manager name space to which users and groups
are associated with roles and applications and optionally, down to the cell, host
or server. ACLs can be placed at any point in this name space, determining
which J2EE roles any principal governed by those ACLs has been assigned. The
Access Manager migration tool automatically attaches the ACLs at the
“AppName” level. As with all ACLs in the object space, the permissions must be
continuous and the lower level ACL overrides a higher ACL.
Chapter 12. Tivoli Access Manager 433