22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

566 Lotus Security Handbook<br />

this time, WebSphere Portal Server supports only two external security<br />

managers: Tivoli Access Manager or Netegrity SiteMinder.<br />

By default, portal resources are created with their security controlled internally by<br />

WebSphere Portal Server. For example, when a page is created in Work with<br />

pages, its initial ACL state for the creator is MANAGE and DELEGATE in the<br />

internal ACL database table. If an external security manager is configured and<br />

the page creator has appropriate permissions, the page creator can then use the<br />

Access Control List portlet to move control of that resource to an external<br />

security store. Permission to update the external store is granted by the external<br />

store by a mapping for a specific resource, EXTERNAL_ACL with MANAGE and<br />

DELEGATE permissions. Objects may also be moved back to internal control.<br />

However, any access rights assigned externally are reset and only the user who<br />

moved the objects has MANAGE and DELEGATE permissions.<br />

When an object is moved to an external security manager, the access control for<br />

that object is administered only through the external security manager interface.<br />

The Access Control List portlet can no longer be used to administer security for<br />

the object. However, the Access Control List portlet can move the object back to<br />

internal control if the right permissions, specifically MANAGE and DELEGATE,<br />

exist in external security manager. Only the Access Control List portlet can return<br />

an object to internal control.<br />

In addition, the decision to use an external security manager must be made with<br />

the understanding that the external security manager software's ACL semantics<br />

override normal portal semantics. For example, when granting anonymous user<br />

permissions on an externally controlled portlet using Tivoli Access Manager, the<br />

ACL for that portlet must be set to include the Tivoli Access Manager<br />

unauthenticated user group.<br />

See the WebSphere Portal Server documentation for information on configuring<br />

WebSphere Portal Server resources to be moved to external control.<br />

Permission mappings<br />

Portal objects, when moved externally, are represented in the name space of the<br />

external security manager. Permissions are mapped into the external security<br />

manager permission model. See the WebSphere Portal Server documentation<br />

for more information on permission mapping for TAM and SiteMinder<br />

Setting up SSL<br />

As mentioned many times throughout this redbook, Secure Sockets Layer (SSL)<br />

provides a secure connection between a client and server. With SSL enabled,<br />

data transfers are encrypted for security. This section describes the overall tasks<br />

required to set up SSL on the portal server. Some of these tasks are performed<br />

for WebSphere Application Server and the Web server. The steps are

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!