Front cover - IBM Redbooks

5.3.4 Security proxies
In most cases, forward proxies are also configured to be caching proxies. This is
so often true that IBM incorporates it into the name of it’s Edge Server
component: IBM Caching Proxy. Figure 5-1 depicts a typical forward caching
proxy.
.
Figure 5-1 A caching proxy acting as a forward proxy
1 - Client
2 - Caching proxy
3 - Cache
4 - Router/gateway
5 - Internet
6 - Web server
On top of their essential simple proxy functionality, proxies can also be
configured to enforce security policies. Such security proxies can handle, or
proxy, both authentication and authorization requests. In these cases, the
authentication of the client user, and the client’s authorization to access specific
content, are verified by the proxy server itself. The security credentials are then
sent to the back end servers by the proxy with the request, and the back end
server must be configured to trust the credentials provided by the proxy.
There are many different products and offerings, and as many topologies to
choose from, but from a proxy-function point of view, security is an extra function
that the proxy can do.
In most cases, security functionality can be added to a standard proxy as a
security plug-in (for example, IBM Tivoli WebSeal Plug-In for IBM WebSphere
Edge Server). There are also stand-alone products, like IBM Tivoli Access
Manager for e-Business, which serve only as security proxies.
See 4.1.6, “Enterprise access management and identity management systems”
on page 130 for some additional discussion of such security proxies.
Chapter 5. Proxies 169