22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

7.2.2 Access control<br />

290 Lotus Security Handbook<br />

000000E0: 6A69 684A 5567 594D 4335 6266 3335 3256 'ijJhgUMY5Cfb53V2'<br />

000000F0: 6263 7034 4657 6851 6A35 7152 7636 3641 'cb4pWFQh5jRq6vA6'<br />

00000100: 6339 4662 4441 5A58 7248 744D 414A 3D '9cbFADXZHrMtJA='<br />

06/09/2003 05:53:39.56 PM [03071:00010-106510] SSO API> -LDAP Realm =<br />

itsosec-ldap.cam.itso.ibm.com\:389<br />

06/09/2003 05:53:39.56 PM [03071:00010-106510] SSO API> -Username =<br />

UID=DHinkle/OU=Production/o=redbooks/c=us<br />

06/09/2003 05:53:39.56 PM [03071:00010-106510] SSO API> -Expiration Ticks =<br />

1055218378666 [06/10/2003 12:12:58 AM].<br />

06/09/2003 05:53:39.56 PM [03071:00010-106510] WebAuth> LOOKUP in view $Users<br />

(user='UID=DHinkle/OU=Production/o=redbooks/c=us')<br />

In this example, note that Domino does not validate the digital signature of the<br />

issuing server when it determines it is a WebSphere-style LTPA token. It is only<br />

concerned with three aspects of the LTPA token it receives:<br />

► The fact that the token could be decrypted using the shared secret key<br />

► User name (LDAP distinguished name)<br />

► Expiration date/time<br />

Generally, WebSphere servers do not have public/private keys available to<br />

Domino, so without a common PKI in place, there is no way for Domino to<br />

validate a WebSphere server’s digital signature.<br />

The primary security consideration for using LTPA in a WebSphere-Domino<br />

mixed environment is protecting the shared secret key. If the secret key becomes<br />

compromised, it is possible for someone knowledgeable to generate counterfeit<br />

tokens. Despite every possible measure to protect the secret key, it is still<br />

theoretically vulnerable to offline attacks if enough tokens are obtained through<br />

sampling (via network sniffing) whereby someone can determine the key through<br />

brute force cracking. For this reason, the secret key should be regenerated<br />

periodically, such as every three months, on a WebSphere server, then<br />

re-imported into the other servers.<br />

Access control using LTPA is based around the user name contained within the<br />

token. The name will be the distinguished name (DN) from the LDAP directory<br />

used for credentials. If the DN in the token does not match an access control<br />

entry (for example, a Domino database ACL entry), the user is considered<br />

authorized if the LTPA token was validated, but the user will not have access to<br />

the requested resource.<br />

Domino 6, and specifically 6.0.2 and above, provide extremely useful features<br />

that allow the DN contained in an LTPA token to be mapped to a different name

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!