Front cover - IBM Redbooks

308 Lotus Security Handbook
LTPA has the advantage of being supported by virtually all IBM Lotus,
WebSphere, and Tivoli Access Manager products. It is dependent on a common,
trusted directory used for user credentials. Domino’s Directory Assistance
feature provides support using credentials maintained outside of the Domino
directory.
X.509 certificates have the advantage of providing a two-factor authentication,
but their drawback is the requirement to implement a Certificate Authority to
issue certificates to each user or pay a third party for the service. Managing
certificates on the client workstations can also be a challenge if users work from
multiple machines.
DSAPI has the advantage of complete flexibility in determining user
authentication, although it is specific to Domino. It requires a great deal of
expertise to develop complex filters.
HTTP headers have the advantage of relative ease of implementation; however,
they present a high degree of security risk if the channel between the front-end
HTTP server and the back-end Domino server is not completely secure. They are
most commonly implemented in conjunction with an Enterprise Access
Management system that centrally controls all Web resource access.
Finally, when deciding upon one SSO method over another, the user should
consider whether they are:
1) Trying to integrate with an existing custom-built or non-IBM SSO solution. In
this case a DSAPI or HTTP header-based solution will most likely fit the bill.
2) Trying to implement a “application specific” SSO solution, or integrate with
other existing IBM applications. In this case, and LTPA-based solution will make
the most sense.
3) Trying to implement a enterprise-wide SSO solution covering all systems and
infrastructures. In this case, an enterprise access management solution – as part
of an overall identity management solution – would be the correct route to take.
The IBM Tivoli “identity management” product family should be carefully
reviewed and considered to satisfy these needs.