22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

572 Lotus Security Handbook<br />

Using Tivoli Access Manager to manage users<br />

WebSphere Portal provides three ways of creating new users. Two are within the<br />

portal runtime:<br />

► Self registration allows anonymous users to create their own user account for<br />

the portal<br />

► The User/Group Manager Portlet allows Portal Administrators to create new<br />

user accounts.<br />

► Prior to installation, the LDIF file containing the administrative users is<br />

imported directly into the LDAP Directory.<br />

When using Tivoli Access Manager as the External Security Manager, creation of<br />

users through WebSphere Portal or through LDIF import may cause two<br />

problems:<br />

► It may be against a company's guidelines to allow a new user account to be<br />

created without proper authorization or without going through the proper<br />

process.<br />

► Users and groups created in WebSphere Portal Server cannot be<br />

authenticated by the Tivoli Access Manager login module (see<br />

portallogin.config) at login time, and thus, the user's login attempt will fail.<br />

To solve the second problem, it is possible to simply import the user into Tivoli<br />

Access Manager by entering the following at a TAM command line:<br />

pdadmin> user import wpsadmin uid=wpsadmin,cn=users,dc=yourco,dc=com<br />

pdadmin> user modify wpsadmin account-valid yes<br />

Often, users are created in a Tivoli Access Manager environment through some<br />

provisioning process that is outside of WebSphere Portal. In this case, portal<br />

user creation functions should be disabled in this environment. See the<br />

WebSphere Portal Server documentation for information on how to ensure that<br />

users are not created through WebSphere Portal interfaces.<br />

Changing the login page<br />

By default, when unauthenticated users attempt to access /wps/myportal, they<br />

get redirected to the login screen located at /wps/portal/.scr/Login to provide<br />

username and password. When using WEBSEAL to authenticate using a TAI,<br />

you no longer need to use the Portal Server login screen. Instead the login icon<br />

should point to the /wps/myportal page.<br />

WebSphere Portal Server offers centralized administration of users and user<br />

groups, which makes it easier to better define portal users and manage user<br />

access rights. Users can register and manage their own account information, or<br />

an administrator can provision and manage users. Group memberships give the<br />

required permissions to access an object or perform a request.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!