WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Further advantages of using Tivoli Access Manager
We already reviewed the enterprise level advantages of using Tivoli Access
Manager. Using Tivoli Access Manager at the application server level has the
following further advantages:
► Supports accounts and password policies
► Supports dynamic changes to the authorization table without having to restart
applications
► Provides tight integration with WebSphere Application Server
Security, networking, and topology considerations
Because the LDAP server contains, and the Access Manager server manages,
sensitive data in terms of authentication, authorization, and privacy, the servers
belong to the data layer of the network. It is suggested to enable Secure Sockets
Layer (SSL) configuration options between the databases so data is encrypted.
Legal considerations (privacy and data protection): Be aware that there
might be some legal or regulatory issues that surround storing of certain data
types, such as personally identifiable data in the European Union, on IT
systems. Ensure that you have consulted your legal department before
deploying such information on your systems. These considerations vary by
geography and industry.
2.2 Tivoli Directory Server
In today's highly connected world, directory servers are the foundation of
authentication systems for internal, and more commonly, external user
populations in the corporate infrastructure.
IBM Tivoli Directory Server provides a high-performance Lightweight Directory
Access Protocol (LDAP) identity infrastructure capable of handling millions of
entries. It is built to serve as the identity data foundation for your Web
applications and identity management initiatives.
2.2.1 Lightweight Directory Access Protocol
A directory is a data structure that enables the look up of names and associated
attributes arranged in a hierarchical tree structure. In the context of enterprise
application servers, this enables applications to look up a user principal and
determine what attributes the user has and of which groups the user is a
member. Decisions about authentication and authorization can then be made
using this information.
Chapter 2. Integration with other products 33