IBM WebSphere V5.0 Security - CGISecurity

Testing the junctionsThe following tests will help to make sure that the junctions are set correctly. Thefirst tests will be performed on the appsrv02 server.1. Point a browser to http://appsrv02/itsobank and the ITSOBank welcomewindow is displayed. Click any of the functions of the application, they areavailable without challenge for identity.2. Point a new browser session to https://wsl01/junction2/itsobank/ andafter the normal certificate warnings (accept the certificate), a BasicAuthentication challenge is presented which can be answered with any of theusers created earlier to show the ITSOBank Welcome window. Allfunctionality is again available as it is only the junction which is protected.The next two steps will access the application on the appsrv01 server.1. Point a browser to http://appsrv01/itsobank and you are again presentedwith the welcome window. However, attempting to use either function requiresa valid Access Manager identity to be authorized.2. Point a new browser to http://wsl01/junction1/itsobank; this results in a BasicAuthentication challenge before the ITSOBank welcome window is shown. Itis not until you attempt to access one of the protected funtions that you arechallenged again for a valid identity. The welcome window which is notprotected by the application is in effect a static resource which can beindependently protected by WebSEAL.Protecting WebSphere URIsAccess Manager can secure WebSphere servlets and JSPs but not EJBs orindividual methods, only URIs. If the application you wish to secure is of a simpleenough design then this may be all you need.This sample will use the index.jsp page provided with the ITSOBank sampleapplication. The index.jsp is available for everyone, the resource is not protected,access is granted for the Everyone special subject to be exact. This sample willuse Tivoli Access Manager WebSEAL to protect this resource and only giveaccess to the user accountant01 in the accountantgrp group. You can try toaccess the index.jsp at http:///itsobank/index.jsp.1. Start the pdadmin tool to administer Tivoli Access Manager, and login with thesec_master user.2. Create a junction to the Web space.pdadmin> server task Webseald-wsl01 create -f -t tcp -h appsrv01 -p 9080/itsobankURItest3. Create a new ACL for the index.jsp resource.acl create itsobankURItestACL428 IBM WebSphere V5.0 Security Handbook