IBM WebSphere V5.0 Security - CGISecurity

WebSEAL JunctionsWebSEAL’s connections with the back-end Web servers have constantly beenreferred to as “junctions”. This Tivoli proprietary technology requires a furtherdescription in order to better understand the scenarios above.All WebSEAL junctions are TCP/IP connections between a front-end WebSEALserver and a back-end Web server which may be another WebSEAL server andmay go via another proxy server. Only the HTTP and HTTPS protocols aresupported and WebSEAL to WebSEAL must be over an SSL connection.A junction is where the back-end server Web space is connected to theWebSEAL server at a specially designated mount point in the Access ManagerWeb space created in the Policy Server database by appropriate use of thepdadmin command. In order to produce representations of resources on somethird party back-end servers within the Access Manager object space, thesejunctions may require configuration such that the querry_contents.cgi programbe loaded and accessible to be run by the Policy Server on the back-end servers,themselves. This utility ships with Access Manager.The junction is then a logical Web object space, normally on another Web server,rather than the physical file and directory structure of the proxied Web server.Junctions define an object space that reflects organizational structure rather thanthe physical machine and directory structure commonly encountered on standardWeb servers. A browser client never knows the physical location of a Webresource as WebSEAL translates requested URL addresses into the physicaladdresses that a back-end server expects without ever exposing them to theclient. Web objects can be moved from server to server without affecting the waythe client accesses those objects.WebSEAL attempts to pass the request to the back-end server by referencingthe object in Access Manager’s protected object space. If it encounters an ACLor Policy of Protection, POP on that object which requires authentication beforethe request can be authorized, then the client will be challenged. WebSEAL isconfigurable for several different challenge mechanism including the default ofBasic Authentication, forms based logon from a junctioned application andcomes with an Application Developers Kit with which to build customized CrossDomain Authentication Services.WebSEAL junctions can also be configured to enable the creation of SingleSign-On solutions allowing users to access resources, somewhat regardless ofwhat security domain controls those resources, following their initialauthentication logging on to through WebSEAL. The GSO, Global Sign Onjunction option allows for a third party user registry to be referenced to supplythat junction with the appropriate user ID and password. Other options involvemanipulation and perhaps additions to the underlying Access Manager schemaChapter 12. Tivoli Access Manager 415