22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

560 Lotus Security Handbook<br />

WebSphere Application Server generates an LTPA token for that user and stores<br />

it as a cookie for subsequent authentication during the user's session.<br />

The WebSphere Application Server packages TAIs for Tivoli Access Manager<br />

and Tivoli Policy Director. The WebSphere Portal Server packages a TAI for<br />

SiteMinder, so either TAI can be integrated as an alternate authentication service<br />

for Portal Server.<br />

TAIs are used for authentication purposes only. In this scenario, the<br />

authentication proxy determines the challenge mechanism, and Portal Server<br />

relies on the authentication proxy to relay success or failure of the user identifier<br />

via the TAI or via the LTPA token. WebSphere Application Server sees all<br />

requests as authenticated, but WebSphere Application Server and Portal Server<br />

still perform a user and group lookup. Even if the authentication proxy has<br />

successfully authenticated the user, WebSphere Application Server and<br />

WebSphere Portal Server deny access if they are not able to achieve a<br />

successful query of the user’s credentials in the registry.<br />

TAIs can also be written to allow other custom authentication services to interact<br />

with WebSphere Application Server. If you choose to use a security configuration<br />

other than SiteMinder or Tivoli Access Manager, you must provide and<br />

implement a TAI to communicate with the authentication proxy.<br />

User repositories and authentication<br />

The WebSphere Portal server supports either an internal Portal Server database,<br />

an LDAP directory, or a custom registry to be used as the authentication registry<br />

(for user ID and password). The WebSphere Application Server must use a<br />

CustomRegistry to access a database or a custom registry. In the LDAP or<br />

custom registry configurations, the WebSphere Portal Server shares the same<br />

authentication registry as the WebSphere Application Server, while having a<br />

separate database for user profiles and preferences.<br />

The user profile and preference information is referred to as user repository<br />

information to differentiate it from user registry information. Some profile<br />

information may also be stored in the same physical store as the user registry.<br />

For example, an LDAP directory may contain much more information about each<br />

user than just the name and password. The Member Services component in<br />

Portal Server, which handles such profile information, can be configured for<br />

different layouts of data in the user registry and database.<br />

When a user logs in, WebSphere Application Server performs an authentication.<br />

This authentication may be performed against an external user registry such as<br />

an existing LDAP directory, or to a Portal-specific user registry that is supported<br />

via the WebSphere Portal Server, which provides the Customer User Registry<br />

(CUR) feature. However, the Member Services component also checks the

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!