IBM BS029ML Self Help Guide - Page 111

WebSEAL, a component in Tivoli Access Manager, acts as a reverse proxy server that intercepts all Web requests coming into the portal Web site. When a protected resource is accessed and the user has not been authenticated, WebSEAL challenges the user by consulting with its authorization server (policy server) and the user registry, so the reverse proxy is able to verify the user's identity and pass the user's identity info through iv-user and iv-creds in the HTTP header to WebSphere Application Server. The application server's Trust Association Interceptor then trusts the authentication by retrieving and verifying the user information from the same user registry, and then creates an LTPA token for single sign-on. Two important considerations: Before you can configure the integration with TAM, the security of WebSphere Portal must be configured and single sign-on must be working correctly with the LTPA token. The same user registry must be configured for WebSphere Application Server and TAM. 4.2 Security configurations and customizations Here we discuss some basic configurations and customization scenarios. 4.2.1 The default security configuration WebSphere Portal Version 6 is installed with the security enabled against WMM UR with the WMM database as the user registry. With this setting, the portal is functional right after installation and this configuration is suitable for a simple environment, like unit testing or development. As we specified in 4.1, "Planning and considerations" on page 86, the administrators should seriously consider reconfiguring security with a commercially available LDAP server. If the system will be put into production and performance is a major concern, we do not recommend the database solution and you should reconfigure security as early as possible, so that the impact of the user registry migration can be kept to a minimum. The portal configuration tasks are designed to configure portal security to a default configuration according to the entries in the file wpconfig.properties. It does not deal with more specific customized environments. In these cases, manual modification to the configuration files may be required. The configuration changes we are dealing within these cases are mainly within WMM files and WebSphere Administration Console. WMM requires an external identifier (extId) to be defined and mapped to a unique LDAP server attribute. WMM supports four different member types: Person, Group, Organizational Unit, and Organization. Thus, this external identifier must be mapped to an attribute that all four member types have; otherwise, WMM will fail. Since WebSphere Portal only uses two member types, Person and Group, in most cases, you can disable the support for OrganizationalUnit (OU) and Organization (O) in wmm.xml, wmmLDAPServerAttributes.xml, and wmmAttributes.xml, by simply eliminating the tags or parameters that are related to OU and O. Extending or restricting user populations to include or exclude LDAP branches can be done by adding or deleting search bases, broadening or narrowing the search bases, or adding search filters within the WMM configuration. When you extend the user search bases, you need to be cautious that you do not give access to your portal to some users that are not supposed to have.access to the portal. Chapter 4. WebSphere Portal security 97