ibm websphere application serverpublib.boulder.ibm.com/tividd/td/itame/sc32-1368... · ibm tivoli...

158
IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Upload: others

Post on 06-Aug-2020

7 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

IBM Tivoli Access Manager for e-business

IBM WebSphere ApplicationServer�� ���

�� 5.1

SA30-2209-00

���

Page 2: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00
Page 3: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

IBM Tivoli Access Manager for e-business

IBM WebSphere ApplicationServer�� ���

�� 5.1

SA30-2209-00

���

Page 4: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�!

� ��� � ��� ���� ��� ���� ��, 123 ���� �� B ������� �����

� 1 �(2003� 11�)

� ���� � ���� ��� ���� �� �, IBM Tivoli Access Manager(�� �� 5724-C08)� �� 5, ��� 1, ��

�� 0 � �� �� ���� ����� �����.

© Copyright International Business Machines Corporation 2002, 2003. All rights reserved.

Page 5: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��

�� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

��� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

�� ��� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

�� �� ���. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

��� �� ��� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

�� ��� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

����� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

� �� ��� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

���� �� �� � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

� 1 � �� � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

WebSphere Application Server� Tivoli Access Manager �� . . . . . . . . . . . . . . . . . 2

Java 2 Enterprise Edition � �� �� . . . . . . . . . . . . . . . . . . . . . . . . . 4

�� ���� � �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

�� WebSphere ��� �� ��� policy �� . . . . . . . . . . . . . . . . . . . . . . . 9

� 2 � �� ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

����� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

�� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

WebSphere Application Server �� 5.1 �� . . . . . . . . . . . . . . . . . . . . . . 14

��� � ��� ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

�� �� ����� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

WebSphere Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Tivoli Access Manager �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

JRE(Java Runtime Environment). . . . . . . . . . . . . . . . . . . . . . . . . . . 16

�� ����� ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

�� ����� ����� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

�� �� ���� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

�� ���� ���� Tivoli Access Manager for WebSphere �� . . . . . . . . . . . . . . 23

Solaris� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

AIX� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

HP-UX� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Linux� ��. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Windows� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

� 3 � �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

© Copyright IBM Corp. 2002, 2003 iii

Page 6: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

1�: WebSphere Application Server� � Tivoli Access Manager �� � . . . . . . . . . . 32

2�: WebSphere �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

3�: Access Manager Java Runtime Environment �� . . . . . . . . . . . . . . . . . . . 36

4�: �� ��� ��. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5a�: WebSphere �� ��� ���� -- WebSphere �� 4.0.6 . . . . . . . . . . . . . . 39

5b�: WebSphere �� ��� ���� -- WebSphere �� 5.0.2 . . . . . . . . . . . . . . 41

WebSphere Application Server �� 5.1 ��� Tivoli Access Manager for WebSphere �� . . . . . . 45

1�: WebSphere Application Server� � Tivoli Access Manager �� �� � . . . . . . . . 45

2�: WebSphere Application Server �� 5.1�� �� �� . . . . . . . . . . . . . . . . . 45

3�: Access Manager Java Runtime Environment �� . . . . . . . . . . . . . . . . . . . 46

4�: Tivoli Access Manager for WebSphere �� . . . . . . . . . . . . . . . . . . . . . 46

5�: �� policy ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

�� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

A-1�: Access Manager Java Runtime Environment �� . . . . . . . . . . . . . . . . . . 48

A-2�: �� ��� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

� 4 � �� �� ������ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

�� �� ������ �� . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

���� ���� ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

��� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

�� � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

�� ACL� ��� ���� �� . . . . . . . . . . . . . . . . . . . . . . . . . 60

��� ��� ���� Windows ��� ����� ��� . . . . . . . . . . . . . . . 60

Web Portal Manager� ���� ACL� ��� � �� . . . . . . . . . . . . . . . . . . 60

[...] ��� pdwas-admin� ����� �� . . . . . . . . . . . . . . . . . . . . . . 60

� ��� ���� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . 60

���� ���� ���� � �� ��� �� . . . . . . . . . . . . . . . . . 61

� 5 � �� ��� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

WebSphere Advanced Edition Single Server �� 4.0.6 . . . . . . . . . . . . . . . . . . . 63

Tivoli Access Manager �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

��� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

�� � �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

� � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

� �� policy ����� ��� . . . . . . . . . . . . . . . . . . . . . . . . . 66

�� Authorization Server �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

�� ��� ��� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

GSO ����(��) �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

� ����� ��� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Tivoli Access Manager for WebSphere �� . . . . . . . . . . . . . . . . . . . . . . . 75

WebSEAL� ���� WebSphere Application Server� �� �� � . . . . . . . . . . . . . . . 77

1�� -- Tivoli Access Manager�� ���� �� �� � . . . . . . . . . . . . . . . 77

2�� -- WebSEAL �� WebSphere Application Server� � . . . . . . . . . . . . . . . 77

3a�� -- WebSphere Application Server �� 4.0.6� TAI ���� SSO ��. . . . . . . . . . 78

3b�� -- WebSphere Application Server �� 5.0.2� TAI ���� SSO �� . . . . . . . . . 79

4�� -- WebSEAL�� SSO � �� . . . . . . . . . . . . . . . . . . . . . . . . 80

iv IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 7: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

5�� -- WebSEAL �� ��� . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

��� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

�� � ���� � WebSphere ��� � �� �� �� -- WebSphere Application Server ��

4.0.6 ��. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

�� � � WebSphere ��� � �� �� �� -- WebSphere Application Server �� 4.0.6 �� . . 81

Tivoli Access Manager for WebSphere � �. . . . . . . . . . . . . . . . . . . . . . 82

� 6 � ���: �� �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

���: Tivoli Access Manager for WebSphere Application Server �� 4.0.6� . . . . . . . . . . . 83

��� ���� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

1�: LDAP �� ������ �� �� . . . . . . . . . . . . . . . . . . . . . . . 85

2�: Tivoli Access Manager for WebSphere �� . . . . . . . . . . . . . . . . . . . . . 86

3�: WebSphere ������ �� �� . . . . . . . . . . . . . . . . . . . . . . . 86

4�: WebSphere Application Server� � Tivoli Access Manager �� �� � . . . . . . . . 88

5�: WebSphere �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6�: ����� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

7�: ��� ����� �� ���. . . . . . . . . . . . . . . . . . . . . . . . . 90

8�: ����� Tivoli Access Manager� ���� . . . . . . . . . . . . . . . . . 91

9�: ��� ����� �� ���. . . . . . . . . . . . . . . . . . . . . . . . . 93

10�: � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

11�: ��� ����� �� ��� . . . . . . . . . . . . . . . . . . . . . . . . 94

���: Tivoli Access Manager for WebSphere Application Server �� 5.0.2� . . . . . . . . . . . 94

��� ���� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

1�: LDAP �� ������ �� �� . . . . . . . . . . . . . . . . . . . . . . . 95

2�: Tivoli Access Manager for WebSphere �� . . . . . . . . . . . . . . . . . . . . . 97

3�: WebSphere ������ �� �� . . . . . . . . . . . . . . . . . . . . . . . 97

4�: WebSphere Application Server� � Tivoli Access Manager �� �� � . . . . . . . . 99

5�: WebSphere �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

6�: ���� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

7�: ��� ������ �� ��� . . . . . . . . . . . . . . . . . . . . . . . . 101

8�: ������ Tivoli Access Manager� ���� . . . . . . . . . . . . . . . . . 102

9�: ��� ����� �� ��� . . . . . . . . . . . . . . . . . . . . . . . . 104

10�: � �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

11�: ��� ����� �� ��� . . . . . . . . . . . . . . . . . . . . . . . . 104

� 7 � �� ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Solaris�� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Windows�� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

AIX�� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

HP-UX�� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Linux�� � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

�� A. �� �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

pdwascfg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

migrateEAR4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

migrateEAR5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

�� B. ���� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

�� v

Page 8: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

�� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

�� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

vi IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 9: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��

IBM® Tivoli® Access Manager for WebSphere Application Server(Tivoli Access

Manager for WebSphere) ���� � �� ����. � ��� Tivoli Access

Manager� ��� ���� IBM® WebSphere™ Application Server��� ��

����� �����.

IBM® Tivoli® Access Manager(Tivoli Access Manager)� IBM Tivoli Access

Manager ����� ����� ���� � ��� �� ��������. � �

�� IBM Tivoli Access Manager ����� ���� ���� � �� �

�� �� �����. �� ��� � �� �� ��� e-business ��

��� �� ���� � ���� �� policy �� ����� ���� �

�� �� �� �� �����.

�: IBM Tivoli Access Manager� �� Tivoli SecureWay® Policy Director� �

�� �����. Tivoli SecureWay Policy Director ����� � ���� �

�� �� �� ���� Policy Server� ����.

IBM Tivoli Access Manager for WebSphere Application Server Integration Guide

�� ��, �� � �� ����� �� ����. �� � �� WebSphere ��

��� �� ��� �� policy ��� �� ���� �����.

� �� ���

� �� �� �� ���� ���.

v �� ��

v ���� ��� ��

v IT ��

��� ��� � � � ��� ���.

v HTTP, TCP/IP, FTP � telnet� �� ��� ����

v WebSphere Application Server ��� � ���� �� � ��

v � � � �� ��� �� ��

SSL(Secure Sockets Layer) ��� ���� ��, SSL ����, �(�� �

���), �� ��, �� � �� � CA(Certificate Authority)� � � �

��� ���.

© Copyright IBM Corp. 2002, 2003 vii

Page 10: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� �� ��

� �� �� ��� ���� ����.

v � 1 �, ″�� � ��”

WebSphere Application Server� � ��� ���� Tivoli Access Manager

����� �� �� �����.

v � 2 �, “�� ����”

Tivoli Access Manager for WebSphere ���� ��� � �����.

v � 3 �, ″�� ��″

Tivoli Access Manager for WebSphere ���� ��� � �����.

v � 4 �, “�� � ����”

Tivoli Access Manager for WebSphere ���� ���� ���� Java

2 Enterprise Edition �� �� Tivoli Access Manager �� � ����

������ ��� � �����.

v � 5 �, “�� ���″

Tivoli Access Manager for WebSphere ���� �� ��� ���� ��

� � �����.

v � 6 �, “���: �� �� ��”

WebSphere Application Server ����� �� ��� ���� ��� �

�����. �� Tivoli Access Manager� �� �� ����� �

�� ��� ����� ��� � �����.

v � 7 �, “� ����”

Tivoli Access Manager for WebSphere ��� ��� � �����.

�� ��

�� �� ��� ��� ����� Tivoli Access Manager ��� �, �� ��

� � � � �� �� ��� ������. ��� �� ��� � ��� �� ��

�� �� ����� ������.

IBM Tivoli Access Manager for e-business �� �� �� �� ��� ���

� �� � ����.

http://www.ibm.com/software/tivoli/products/access-mgr-e-bus/

Tivoli Access Manager ��� �� ��� �� ���� ����.

v ix ���� ���� ���

v ix ���� ��� ���

viii IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 11: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v � �� ���

v x ���� ��� ����

v xi ���� ��� �� ����

��� ��

v IBM Tivoli Access Manager for e-business Read This First(GA30-2205-00)

Tivoli Access Manager �� � � ��� �� �� �����.

v IBM Tivoli Access Manager for e-business ���� ��(GA30-2206-00)

����� ����, �� � �� �� � �� ����� �� � �� �

����.

�� ��

v IBM Tivoli Access Manager �� �� ���(SA30-2207-00)

Web Portal Manager ����� ��� Tivoli Access Manager �� ���

��� �� � �� ��� � �����. � �� IBM Tivoli Access Manager

for e-business �� �� ���� ������, IBM Tivoli Access Manager

for Business Integration � IBM Tivoli Access Manager for Operating Systems

� �� �� Tivoli Access Manager ��� �� ���� �� ����.

v IBM Tivoli Access Manager Base Administration Guide(SC32-1360-00)

Tivoli Access Manager ��� ��� �� �� � ��� � �����.

pdadmin ��� ���� Web Portal Manager ������� ��� ���

� �� �����.

� �� ��

v IBM Tivoli Access Manager for e-business �� �� ���(SA30-2208-00)

Tivoli Access Manager �� ����� � �� ����� �� ��, ��

� � ����� �����. � �� IBM Tivoli Access Manager �� ��

���� � �����.

v IBM Tivoli Access Manager Upgrade Guide(SC32-1369-00)

Tivoli SecureWay Policy Director �� 3.8 �� Tivoli Access Manager� �

� ��� Tivoli Access Manager �� 5.1� ������� ��� �����.

v IBM Tivoli Access Manager for e-business WebSEAL Administration

Guide(SC32-1359-00)

WebSEAL� ���� �� ���� �� ���� �� �� ����

�, �� �� � �� �� �� �����.

v IBM Tivoli Access Manager for e-business IBM WebSphere Application Server

�� ���(SA30-2209-00)

�� ix

Page 12: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Tivoli Access Manager IBM WebSphere® Application Server� ��� ��

��, � � �� ����� �����.

v IBM Tivoli Access Manager for e-business IBM WebSphere Edge Server ��

���(SA30-2211-00)

Tivoli Access Manager IBM WebSphere Edge Server ����� ���

�� ��, � � �� ����� �����.

v IBM Tivoli Access Manager for e-business Plug-in for Web Servers Integration

Guide(SC32-1365-00)

��� ��� ���� ��� ��� �� ��, �� �� � �� �

� �� �����.

v IBM Tivoli Access Manager for e-business BEA WebLogic Server �� ���

(SA30-2210-00)

Tivoli Access Manager BEA WebLogic Server� ��� �� ��, � �

�� ����� �����.

v IBM Tivoli Access Manager for e-business IBM Tivoli Identity Manager

Provisioning Fast Start Guide(SC32-1364-00)

Tivoli Access Manager � Tivoli Identity Manager ��� ��� ���� �

� ��� Provisioning Fast Start ��� �� � �� ��� �����.

��� ���

v IBM Tivoli Access Manager for e-business Authorization C API Developer

Reference(SC32-1355-00)

Tivoli Access Manager � �� C API � Tivoli Access Manager ���

�� ����� ���� Tivoli Access Manager ��� ����� �

��� ��� ���� �� � �����.

v IBM Tivoli Access Manager for e-business Authorization Java Classes Developer

Reference(SC32-1350-00)

� �� API� Java™ � ��� ���� ����� Tivoli Access

Manager ��� ���� ��� � �� �� �����.

v IBM Tivoli Access Manager for e-business Administration C API Developer

Reference(SC32-1357-00)

�� API ���� ����� Tivoli Access Manager �� ��� ��

�� ��� � �� �� �����. � ����� �� API� C ��� �

�����.

v IBM Tivoli Access Manager for e-business Administration Java Classes Developer

Reference(SC32-1356-00)

x IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 13: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� �� API� Java � ��� ���� ����� Tivoli Access Manager

�� ��� ��� � �� �� �� �� �� �����.

v IBM Tivoli Access Manager for e-business Web Security Developer

Reference(SC32-1358-00)

CDAS(Cross-Domain Authentication Service), CDMF(Cross-Domain Mapping

Framework) � Password Strength � � �� �� � ���� �� ��

���.

�� �� ���

v IBM Tivoli Access Manager for e-business Command Reference (SC32-1354-00)

Tivoli Access Manager� �� ���� ��� ���� � ����� �� �

� �����.

v IBM Tivoli Access Manager Error Message Reference(SC32-1353-00)

Tivoli Access Manager�� ���� ���� ��� � �� �����.

v IBM Tivoli Access Manager for e-business Problem Determination

Guide(SC32-1352-00)

Tivoli Access Manager� �� ��� �� �� �����.

v IBM Tivoli Access Manager for e-business Performance Tuning

Guide(SC32-1351-00)

�� ������ ��� IBM Tivoli Directory Server� �� Tivoli Access

Manager� ���� ��� �� �� �� �� �����.

�� ��

� ���� Tivoli Access Manager ��� �� ��� ��� �����.

Tivoli Software Library��� white papers, datasheets, demonstrations, redbooks

� announcement letters� �� � � Tivoli �� �����. �� ����

� Tivoli Software Library ��� � ����.

http://www.ibm.com/software/tivoli/library/

Tivoli Software Glossary�� Tivoli ������ ��� �� ��� ���� �

���. Tivoli Software Glossary� �� ���� ��� � � ����. Tivoli

Software Library(http://www.ibm.com/software/tivoli/library/)� �� Glossary ��

�����.

IBM Global Security KitTivoli Access Manager� IBM Global Security Kit(GSKit) �� 7.0� �� ��

� �� ��� �����. GSKit� �� ��� �� IBM Tivoli Access

Manager Base CD� IBM Tivoli Access Manager Web Security CD, IBM Tivoli

�� xi

Page 14: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Access Manager Web Administration Interfaces CD � IBM Tivoli Access Manager

Directory Server CD� ���� ����.

GSKit ��� �����, ��-��� � � �� ��� � �

��� iKeyman �� ���� gsk7ikm� �����. �� ��� Tivoli

Information Center ���� �� IBM Tivoli Access Manager �� ��� �

� ��� � � ����.

v IBM Global Security Kit Secure Sockets Layer and iKeyman User’s

Guide(SC32-1363-00)

Tivoli Access Manager ���� SSL ��� ����� ���� ���� ��

��� �� �� �� �� �����.

IBM Tivoli Directory ServerIBM Tivoli Directory Server, �� 5.2� ���� � ��� IBM Tivoli Access

Manager Directory Server CD� ���� ����.

�: IBM Tivoli Directory Server� ��� ��� ���� ������ ����

�� ��� �����.

v IBM Directory Server(�� 4.1 � �� 5.1)

v IBM SecureWay Directory Server(�� 3.2.2)

IBM Directory Server �� 4.1, IBM Directory Server �� 5.1 � IBM Tivoli

Directory Server �� 5.2� �� IBM Tivoli Access Manager �� 5.1� � �

����.

IBM Tivoli Directory Server� �� �� ��� ���� �� � ����.

http://www.ibm.com/software/network/directory/library/

IBM DB2 Universal DatabaseIBM DB2® Universal Database™ Enterprise Server Edition, �� 8.1� IBM Tivoli

Access Manager Directory Server CD�� ���� IBM Tivoli Directory Server

������ �� �����. IBM Tivoli Directory Server, z/OS™ �� OS/390®

LDAP �� Tivoli Access Manager� �� ������ ��� �� DB2� �

� �����.

DB2� �� �� ��� ���� �� � ����.

http://www.ibm.com/software/data/db2/

IBM WebSphere Application ServerIBM WebSphere Application Server, Advanced Single Server Edition 5.0� ��

�� � ��� IBM Tivoli Access Manager Web Administration Interfaces CD

xii IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 15: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� ����. WebSphere Application Server� Tivoli Access Manager

���� � ���� Web Portal Manager ������ IBM Tivoli Directory Server

���� � ���� �� �� � � ��� � ��� ���. Tivoli Access

Manager�� IBM WebSphere Application Server ��� 2� ����, �� IBM

Tivoli Access Manager WebSphere Fix Pack CD�� �����.

IBM WebSphere Application Server� �� �� ��� ���� �� � ���

�.

http://www.ibm.com/software/webservers/appserv/infocenter.html

IBM Tivoli Access Manager for Business IntegrationIBM Tivoli Access Manager for Business Integration� ��� ��� � �� �

���, IBM MQSeries® �� 5.2 �� �� IBM WebSphere® MQ �� 5.3

��� �����. IBM Tivoli Access Manager for Business Integration� ��

� ����� ��� ���� WebSphere MQSeries ����� ��

���� ���� �� ��� ��� � ��� ���. WebSEAL � IBM

Tivoli Access Manager for Operating Systems, IBM Tivoli Access Manager for

Business Integration��, IBM Tivoli Access Manager� ��� ���� � �

� � �����.

IBM Tivoli Access Manager for Business Integration� �� �� ��� ���

� �� � ����.

http://www.ibm.com/software/tivoli/products/access-mgr-bus-integration/

IBM Tivoli Access Manager for Business Integration �� 5.1� �� �� ��

� Tivoli Information Center ���� ����.

v IBM Tivoli Access Manager for Business Integration �� ���(SA30-1825-01)

v IBM Tivoli Access Manager for Business Integration ��� �� ���

(GA30-2064-00)

v IBM Tivoli Access Manager for Business Integration ���� ��(GA30-1827-01)

v IBM Tivoli Access Manager for Business Integration Read This

First(GA30-2063-00)

IBM Tivoli Access Manager for WebSphere Business

Integration BrokerIBM Tivoli Access Manager for Business Integration� ��� ��� � �� IBM

Tivoli Access Manager for WebSphere Business Integration Broker� WebSphere

Business Integration Message Broker, �� 5.0 � WebSphere Business Integration

Event Broker, �� 5.0� �� �� �� �����. IBM Tivoli Access

Manager for WebSphere Business Integration Broker� Tivoli Access Manager�

�� xiii

Page 16: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

���� � � � �� �� �, ���� ��� � � �� ��� ��

��� JMS ��/� ����� ���� � � ���.

IBM Tivoli Access Manager for WebSphere Integration Broker� �� �� ��

� ���� �� � ����.

http://www.ibm.com/software/tivoli/products/access-mgr-bus-integration/

IBM Tivoli Access Manager for WebSphere Integration Broker, �� 5.1� ��

�� �� ��� Tivoli Information Center ����� ��� � ����.

v IBM Tivoli Access Manager for WebSphere Business Integration Brokers

Administration Guide(SC32-1347-00)

v IBM Tivoli Access Manager for WebSphere Business Integration Brokers ��

�� ��(GA30-2194-00)

v IBM Tivoli Access Manager for Business Integration Read This First

(GA30-2063-00)

IBM Tivoli Access Manager for Operating SystemsIBM Tivoli Access Manager for Operating Systems� ��� ��� � �� ��

��, �� ����� ���� �� ��� UNIX ����� � �� policy �

� ��� �����. IBM Tivoli Access Manager for Operating Systems�

WebSEAL � IBM Tivoli Access Manager for Business Integration�� IBM Tivoli

Access Manager� ��� ���� � �� � �����.

IBM Tivoli Access Manager for Operating Systems� �� �� ��� ����

�� � ����.

http://www.ibm.com/software/tivoli/products/access-mgr-operating-sys/

IBM Tivoli Access Manager for Operating Systems �� 5.1� �� ��� Tivoli

Information Center ���� ����.

v IBM Tivoli Access Manager for Operating Systems �� ���(SA30-1841-01)

v IBM Tivoli Access Manager for Operating Systems �� ���(SA30-1840-01)

v IBM Tivoli Access Manager for Operating Systems ��� �� ���

(SA30-1842-01)

v IBM Tivoli Access Manager for Operating Systems ���� ��(GA30-1843-01)

v IBM Tivoli Access Manager for Operating Systems Read Me(GA30-1844-01)

IBM Tivoli Identity ManagerIBM Tivoli Identity Manager �� 4.5� ��� �� ��� ����, � ���

� ��(�: �� ID � �) ���� ��� ����(�, ����,

xiv IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 17: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� �� � ��� �� ��� �� �� �)� � ����. Tivoli Identity

Manager� Tivoli Access Manager Agent � Tivoli Access Manager� ��

� � ����. Agent � � �� �� ��� IBM �� ������.

IBM Tivoli Identity Manager� �� �� ��� ���� �� � ����.

http://www.ibm.com/software/tivoli/products/identity-mgr/

��� �� ���

�� ��� �� ��� �� Tivoli software library� PDF �� HTML ���

� �� ����.

http://www.ibm.com/software/tivoli/library

�� ��� �� ������ Product manuals �� �����. Tivoli software

information center� �� �� ��� �� �����.

�� ��� ���� ��, �� ���, �� ���, �� ��� � �� �

�� �����.

�: PDF �� ��� ��, Adobe Acrobat �� �� �(�� → �� ���

�)�� ���� ��� �� ������.

�� ��� ��

�� ��� ��� � ��� �� �� � ��� ��� �� ��� �

���� ��� ��� � ��� �� ��. � ����� �� ��� ����

������ �� � ��� � ����. �� �� �� �� ����

��� �� ������ �� ��� � � � ����.

����� �� ��

Tivoli ��� ��� �� ��, IBM Tivoli Software Support� ��� � ���

�. �� ����� Tivoli support �� � IBM Tivoli Software Support

������.

http://www.ibm.com/software/support/

��� ��� ��, �� ����� IBM Software Support Guide� ��� �

�� ���� ����� ��� ������.

http://techsupport.services.ibm.com/guides/handbook.html

� ��� ���� ���� �� IBM Software Support� ���� �� � ��

� �� �� �����.

v �� � ���

�� xv

Page 18: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v ��� �� ��� ���� � � �� ��

v ��� ��� �� ��� � ��

� �� ��� ��

� ���� �� ��� ��, ���� ��� ��� � � ��� ����

�.

��� ��

� ���� ��� �� �� ��� �����.

�� ��� �� ��� �� � ��� �� ��, ��, ���, �,

Java ��� �� � ���� �� ����.

����

��, �� ��, ���� ��� ��� ����� ����.

������

��� �� ��� ����, �, ��, ���, �� ��, ��� ��

�, ��� �� ��� � ��� �� �� �� ������� �

���.

����� �� �� � ��

� ���� ���� � � �� �� ��� UNIX ��� �����. Windows

��� ��� ���, �� ��� $variable� %variable%� � , ���� ��

� ���(/) ���(\)� ����. Windows ����� bash � ��� �

�, UNIX ��� ������.

xvi IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 19: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 1 � �� � ��

IBM Tivoli Access Manager for WebSphere Application Server(Tivoli Access

Manager for WebSphere)� IBM Tivoli Access Manager(Tivoli Access Manager)

���� IBM WebSphere Application Server ����� �� ���� �

� �� �� ��� policy �� �����.

Tivoli Access Manager for WebSphere� WebSphere Application Server � �

WebSphere Application Server� ���� �� � ��� � �� policy� �

� ��� �� ���� Tivoli Access Manager� ��� ��� ���.

Tivoli Access Manager ���� �� ID, �� ��� � � ��� ��

� �����. �� Tivoli Access Manager� ��� �� ����� �����

Tivoli Access Manager Web Portal Manager ���� Java™ 2 Enterprise

Edition(J2EE)� ���� �� J2EE ���� �� � ��� � �� �

� �� ����� �����.

WebSphere Application Server� J2EE �� ��� � API �����. Tivoli

Access Manager for WebSphere� J2EE �� ��� ���� WebSphere �

���� �����. Tivoli Access Manager for WebSphere� ���� �

� �� �� ���� � � � �����.

Tivoli Access Manager for WebSphere� WebSphere ����� ���� Tivoli

Access Manager �� ����� ���� �� ��� ��� � � ���.

Tivoli Access Manager for WebSphere ���� �� �� ���� ��� �

��.

Tivoli Access Manager� � ��� Tivoli Access Manager �� ���� ��

�� �� Tivoli Access Manager �� ���� ��� ���. ���� ���

��� �����.

Tivoli Access Manager� ���� ��� ���� � ������ �� ��

��� �� �� ��� � �� � ���� �� policy �� ����.

Tivoli Access Manager� ��� �� policy �� �����. �� Tivoli Access

Manager� �, �, ��� �� � � �� ��� �����. Tivoli Access

Manager � ��� �� ����� �� ���� � ��� � ���

� ���� � ������ ��� � ����.

Tivoli Access Manager� ��� �����.

© Copyright IBM Corp. 2002, 2003 1

Page 20: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v � �����

Tivoli Access Manager� ���� � ���� ����� . � �

WebSphere� Tivoli Access Manager for WebSphere ���� �� � �

�� ����� �� ������.

v � �����

� J2EE 2 � ��� � ����� Tivoli Access Manager � ���

� �� Tivoli Access Manager �� � ���(third-party) ����� �

�� �� �� �� � � �����.

�� ��� ��� � ��� �� �� Tivoli Access Manager� �

�� � � ����. �� ��� �� �� �� ������.

v IBM Tivoli Access Manager �� �� ���

� ���� Tivoli Access Manager �� ���� ��, �� � ���� ��

� � �����. ��� �� �� ���� ���� ��� ���� �

� ���� ��� ��� � ����. � � ����� �� ���� ��

������� � � �����.

v IBM Tivoli Access Manager Base Administration Guide

� �� �� �� ���� �� Tivoli Access Manager �� ��� ��

�����. � ���� ��� �� ��� ��� Tivoli Access Manager ��

���� ��� � �����. �� �� policy , �� ��� ��

�� ��, �� � �� ��� ��� �� ��� ��� ���� ���

�� �� ����� ��� ����.

WebSphere Application Server� Tivoli Access Manager ��

Tivoli Access Manager for WebSphere� IBM WebSphere Application Server�

�� �� ����� ��� Tivoli Access Manager �� ��� ���

��. �� ��� ��� �� ���� �����.

����(��)� �� �� ���� �, WebSphere� �� ��� ����

�.

v ����� ����.

v ����� �� ������ ��� ��� ��( ��), WebSphere �

���� �� ����� � �� ���� ��� , �� ����� ��

�� ��� �� ���� � Tivoli Access Manager for WebSphere ��

���.

v ���� ��� ����� �� �� �� ��� ��(��� ��),

WebSphere ����� Tivoli Access Manager ���� ��� � ��� �

�� �����.

2 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 21: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� 1��� ��� �� ��� ��� �� ��.

1. J2EE ��� ��� WebSphere ����� ��� �, �� �����

� ��� �� �� ���� ��, WebSphere� �� ���

�. � ��, �� 1�� WebSphere Advanced Edition, Multiple Server ��

� IBM Directory �� ������ � ����. �� �����

Tivoli Access Manager� �����(WebSphere Advanced Edition Single Server

� ��, ��� �� ��� � ����).

2. ��� �� ��� �� �� �� ��� �� ��, WebSphere ��

��� J2EE ���� �� ������ �� ���� ��� � ��

�� �����.

3. WebSphere ����� �� Tivoli Access Manager � � ���� Tivoli

Access Manager Authorization Server��� � ��� ����(“��” �

� “�”).

�� WebSphere ����� �� ���� ��(�� ��) Authorization

Server� �����. � ���� ���� � ��, ��� �� � �� �

�� 1. WebSphere Application Server� �� ��� Tivoli Access Manager

� 1 � �� � �� 3

Page 22: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ��� � ����. Tivoli Access Manager policy ������� ��

�� ��� � policy� ���� �� ��, Authorization Server� � �

�� �� � � �� ��� � ����.

4. Authorization Server� �� �� ������� Tivoli Access Manager �

� �� �����(WebSphere Advanced Edition Single Server� ����

�� ��, �� ������ WebSphere� �����). �� �� Authorization

Server� Tivoli Access Manager �� ��� �� �� ��� ��� ��

� � ��� �� �����. �� ��� �� ��� �� 1� �� �

� policy ������ ����.

5. Tivoli Access Manager Authorization Server� WebSphere ����� ���

��� �����.

6. WebSphere Application Server� �� ��� �� �� �� ��� ��

�� ����.

Java 2 Enterprise Edition �� �� ��

Java 2 Enterprise Edition(J2EE) ��� ���� ��� ���� � ����

���� ID �����. ���� ���� �������. �� J2EE� ��

� ��� �� �����.

��� �� �����. �� ��� �� �� ����� �� ���

��� ��� �����. �� �� �� ��� � �� ��� ���

� ���� � ��� �����.

1. �� ��� ��

��

���

getBalance deposit closeAccount

Teller � �� � ��

Cashier � ��

Supervisor � ��

�� ��� �� ����, �� �� ��� ��� � ����. �� �� �

�� ���� �� ��� � �� � ��� �� ��� ��� � ���

�����.

2. ���� �� ��� �� ��� �� �

����/��

��

Teller Cashier Supervisor

TellerGroup ��

CashierGroup ��

SupervisorGroup

4 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 23: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

2. ���� �� ��� �� ��� �� � (��)

Frank(����� � �� �

�� ���� ��� ��)

�� ��

�� �� ���� Frank� getBalance � closeAccount ��� ��� � �

��, � ����� Cashier �� Supervisor �� ���� ����� deposit �

�� ��� � ����.

��� ���� � �� ��

���� ��� ��� Tivoli Access Manager for WebSphere ���� �

���� ���� Tivoli Access Manager �� ��� �� ��� ����.

���� ����� J2EE ���� �� �������� � � ���� �

� �� �����.

���� ��� � ��� �� �� �� ��� ���, �� ���

WebSphere ����� �����.

v Principal

�� �� ID

v RoleName

�� ��

v AppName

����� ��

v CellName

����� �� ��� ��� �� ��

v HostName

CellName� �� �� ��� ���� ��

v ServerName

HostName� ��� ��� ��

� ��� �� ������ �� �� ��� ���� ����. �����,

Tivoli Access Manager� ��� ��� RoleName � AppName� �� ����

�. CellName, HostName, ServerName� ��� ��� ��� � ��� �

����. �� ��� ���� ��� �����.

Tivoli Access Manager ACL(Access Control List)� ����� ��� J2EE �

��� �� �����. ���� ����� ACL� �� ��� �� �

�� �� AppName� �����.

��� �� 2��� ��� �� ��� ��� �� ��.

� 1 � �� � �� 5

Page 24: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

1. ���� ��� ��� Tivoli Access Manager for WebSphere ����

����� J2EE ���� �� ������ ����� �� ����

� � �� �� ��� � ��� �� �� �����.

2. ���� ����� �� Tivoli Access Manager ���� ���� �

Tivoli Access Manager Policy Server� �����.

3. Policy Server� �� ��� �� ��� ��� ���� ����� �

��� �� �����. �� ������ ����� � �� �� ���

� ��� ��� ��, � ���� ��� ACL� ��� ���� �� �

�� �����.

6 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 25: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Tivoli Access Manager �� ��� �� ��� �� ��� ��� �� ��

�� ACL� ��� � �� �� �� �� ����. � � ACL� ��

�� ��� � ��� �����.

�� 3��� �� ���� �� ��� �� ��� ACL� ���� ��� �

� ��. �� WebSphere ����� �� ��� �� ��� WebAppServer

� �� �� �� �� ���� �����. WebAppServer �����

�� 2. Tivoli Access Manager �� ��� ��� � ��

� 1 � �� � �� 7

Page 26: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

deployedResources� �� �� ���� ����. � � � ��� ���

WebSphere ����� ��� �� J2EE �� �� �� ���� ����

�.

�� �� ��� �� ���� � ��� RoleName� ��� �����. �

��� � ���� AppName ����� ���� �� ����. AppName

�� ��� ���� �� �� ��� �� ��� ���� � ��� �

�� � � �� ����. � ��� CellName, HostName �

ServerName� ����.

�� �� 3�� ACL 1� user1 ��� ���� �� ��� ��� �� ��

��� ��� RoleName� �����. user2 � group1� ���� ����.

Tivoli Access Manager �� ���� �� ��� �� �� ��� RoleName

�� ��� ���� � � ��� ��� �����. ����� � � ���

�����. ��� �� 3�� AppName/CellName/HostName/ServerName� ���

� ���� ��� ��� �����.

�� policy��� ACL �� �� �� ��� ���� ��� ��� ��� �

�� ��� ��� �� ��� ����. � ��, Tivoli Access Manager ��

� �� ��� ��� �� �� � ACL� �����. � �� ��� � ACL

� ��� ���� �� ���� �����. � � � ACL� ��� ��� �

�� �����.

� ��, ����� �� � �� �� ���� �� �� ���� ��� �

user1� RoleName �� ���� ��� �� policy�� ��� � ����. �

�� 3. ACL� �� ��� �� ��� ���� ��

8 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 27: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

policy �� ���� � ��� �� 3� �� �� ACL 2� �� ���

� ACL� �����. � � ACL� user1, user2 � grp1� ��� ����.

��� ��� ��� � �� ���� ServerName ���� � ACL�

�����.

�� 3��� ServerName� ACL 2 �� �� ��. ACL 2� ��� ����

����� �� ������. � ��� ServerName ���� HostName �� �

�� ��, ACL 2� ��� ServerName ����� �����. �� ���� �

��� �� �� �� ServerName ���� ACL 1� ���� ��� RoleName

� ���� �� ��� ��� �� �����

�� ��� �� ��� �� ACL� ��� �� �� ��� IBM Tivoli Access

Manager Base Administration Guide ������.

�� WebSphere ��� �� ��� policy ��

Tivoli Access Manager� �� policy �� ����� �����. Tivoli Access

Manager� � �� WebSphere Application Server� �� �� policy ���

� ����. �� Tivoli Access Manager� �� ��� ���� WebSphere�

�� ������� ��� �����.

J2EE ����� �� ������ ��� ����� � �� �� ���

� ��� Tivoli Access Manager� ����� ��� ��� Tivoli Access

Manager� ��� ��� Tivoli Access Manager �� �� ���� �� ��

� ���� ����� ��� � ����. Tivoli Access Manager Web Portal

Manager ���� ����� � �� �� ��� � ��� ��� �� �

� ����� ������. �� �� �� ��� ����� WebSphere �� �

�����. WebSphere �� �� � �� ����� Tivoli Access Manager

�� ���� � � ��� �� ������.

�� policy ����� �� Tivoli Access Manager �� ������.

v Tivoli Access Manager Web Portal Manager

Web Portal Manager� Tivoli Access Manager �� ����. � �� Tivoli

Access Manager �� ��� �� ��� ��� Tivoli Access Manager ��

, �� � � �� �� ��� �� ����� �����. ACL �

� ��� �� ��� � ����. �� �� ���� �� ������

� �� � �� �� ��� � ����.

v pdadmin

pdadmin ����� Tivoli Access Manager �� �� �� �� ��� ��

�������. � � ��� ���� ���� ��, ���, � � ACL

� ��� Tivoli Access Manager �� ��� �� ��� �� ��� ���

� 1 � �� � �� 9

Page 28: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ����. �� pdadmin� �� ������ �� �� � �� ��� �

�� � ����. ��� ���� �� ��� ��� � ���� ���

� �� ��� �� � ����.

�� ��� IBM Tivoli Access Manager Base Administration Guide ��

����.

v Tivoli Access Manager �� API

Tivoli Access Manager� pdadmin � Web Portal Manager� ���� �� �

��� ��� ����� �����. ���� ��� C �� Java API

���� ����� �� �� ��� ��� � ����.

�� ��� IBM Tivoli Access Manager for e-business Administration C API

Developer Reference �� IBM Tivoli Access Manager for e-business

Administration Java Classes Developer Reference ������.

�� 4. Tivoli Access Manager� �� �� �� ����� �����.

10 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 29: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� 4��� �� WebSphere ��� � Tivoli Access Manager� �� ��

�� ��. Web Portal Manager� ��� A� WebSphere Application Server�

�� �������. pdadmin ����� WebSphere ���� �� ��� B�

����.

Web Portal Manager � pdadmin� ��� D� Policy Server ���� �� policy

�����.

Tivoli Access Manager Authorization Server� WebSphere ���� ��� ��

�� ��� � ����. �� 4�� ��� E� WebSphere Application Server

����. � ���� � �� ��� WebSphere ����� ��� Tivoli

Access Manager for WebSphere � � ����. WebSphere ����� ��� F

� Tivoli Access Manager Authorization Server��� � ��� �����.

�� Authorization Server� ��� G� �� �� WebSphere Application Server

� �� ���� ��� �� ����. Tivoli Access Manager ��� ��� �

�� ���� �� � ��� ��� ����(��� E � ��� F� �� �

�). Authorization Server WebSphere Application Server� �� �� � ��

�� � ��� �����. � ��� ����.

Tivoli Access Manager policy ������ ��� D�� ��� F� ��� G

� �� �����. � ��� ��� ���� �� �� ��� �����.

�� �� 4��� Tivoli Access Manager ��� WebSphere ��� ��� C�

LDAP �� ����� ���� �� ��. �� 4��� WebSphere Advanced

Edition(multiserver)� ��� �� �����. WebSphere Advanced Edition

Single Server ��� � �� ������ ���� ����.

� 1 � �� � �� 11

Page 30: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

12 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 31: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 2 � �� ����

� �� �� ��� ���� ����.

v ������ ���

v ��� ���

v 14 ���� ���� � ��� �����

v 15 ���� ��� �� ������

v 17 ���� ��� ����� �����

v 18 ���� ��� ����� ������

v 23 ���� ��� ���� ���� Tivoli Access Manager for WebSphere

���

����� ��

Tivoli Access Manager for WebSphere� WebSphere Application Server� ��

� � �� ���� ��� ����(��) �� ��� �� � ��� �

���.

Tivoli Access Manager for WebSphere� ����� � �� �� ��� �

��� Java 2 Enterprise Edition(J2EE) �� ������� Tivoli Access Manager

�� �� ���� � ��� � �� ���� ����� �����. �

����� ���� ��� WebSphere Enterprise Archive(EAR) ��� ��

� ����� � ����.

Tivoli Access Manager for WebSphere�� �� ������ �� ����.

v Tivoli Access Manager for WebSphere Java ���

v Java ���� pdwascfg �� ����

v ���� ���� migrateEAR4 � migrateEAR5

v ���� ���� � Java ��� ��� ���� ��� �� �

�� ���

Tivoli Access Manager for WebSphere� �� ���� WebSphere Application

Server � ��� �����.

v WebSphere Application Server �� 4.0.6

– IBM AIX 5.1 � 5.2

© Copyright IBM Corp. 2002, 2003 13

Page 32: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

– Sun Solaris 8

– HP-UX 11i

– Microsoft Windows 2000 Server � Advanced Server(��� � 3)

– SuSE SLES8 on IA32

v WebSphere Application Server �� 5.0.2

– IBM AIX 5.1 � 5.2

– Sun Solaris 8 � 9

– HP-UX 11i

– Microsoft Windows 2000 Server � Advanced Servers(��� � 3)

– Windows 2003 Standard Server � Enterprise Server

– SuSE SLES8 on IA32 � zSeries

WebSphere Application Server �� 5.1 ��

WebSphere Application Server �� 5.1� Tivoli Access Manager for WebSphere

� �� ���� �����. WebSphere Application Server �� 5.1 ���

Tivoli Access Manager for WebSphere ��� ��� ����.

WebSphere Application Server �� 5.1� ���� �� 13 ���� � 2 � ��

� ������ ��� ��� 45 ���� �WebSphere Application Server ��

5.1 ��� Tivoli Access Manager for WebSphere ���� ����� ��� ��

�.

��� � ��� ����

Tivoli Access Manager for WebSphere� ��� � ��� ����� ��� ��

��.

v 6MB RAM, 128MB(��)

�� WebSphere Application Server � �� Tivoli Access Manager �����

��� ��� ��� ��� ��� ���. �� Tivoli Access Manager ��

��� ��� ��� � ��� ���� ��� Tivoli Access Manager ��

��� �� �����. �� ��� IBM Tivoli Access Manager �� �� �

�� ������.

v 2MB ��� ��, 4MB(��)

�� WebSphere Application Server � �� Tivoli Access Manager �����

��� ��� �� ��� ��� ��� �����.

v �� �� 5MB ��� ��.

����� ����� ��� �� ��� �����.

14 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 33: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� �� �����

Tivoli Access Manager for WebSphere WebSphere Application Server ���

����� �� �� ��� �� �� ������ �����.

v �WebSphere Application Server�

v 15 ���� �Tivoli Access Manager ���

v 16 ���� �JRE(Java Runtime Environment)�

WebSphere Application Server

Tivoli Access Manager for WebSphere ���� �� ��� ���� ��

WebSphere Application Server �� � �� ��� ���.

v IBM WebSphere Application Server, Advanced Edition, �� 4.0.6

��

IBM WebSphere Application Server, Advanced Edition Single Server, �� 4.0.6

v IBM WebSphere Application Server, �� 5.0.2

v IBM WebSphere Application Server, �� 5.1

Tivoli Access Manager� ��� �� ����� ����� WebSphere

Application Server, Advanced Edition, �� 4.0.6 � 5.0.2 �� WebSphere

Application Server �� 5.1� ��� ���. WebSphere �� � ��� Tivoli

Access Manager� ��� ���.

�: �� ����� �� � ��� ��� WebSphere Application Server,

Advanced Edition Single Server �� 4.0.6�� ���� ����. � ���

��� �� ��� �����. �� ��� 63 ���� �WebSphere Advanced

Edition Single Server �� 4.0.6�� ������.

IBM WebSphere Application Server ��� �� ��� �� ���� ���

�.

http://www-4.ibm.com/software/webservers/appserv/doc/v40/ae/infocenter/was/nav_pdf.html

IBM WebSphere Application Server �� ���� ��, IBM WebSphere

Application Server � �� ��� ������. � �� ��� �� ���

������.

Tivoli Access Manager ��

Tivoli Access Manager for WebSphere� �� ��� Tivoli Access Manager �

��� �� ���� ��� , Tivoli Access Manager �� ���� ��� �

��. �����, �� ���� � ���� �����.

� 2 � �� ���� 15

Page 34: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ���� �� ����

Tivoli Access Manager for WebSphere��� WebSphere Application Server�

��� �� ���� Access Manager Java Runtime Environment ����� ��

��� ���. �� Tivoli Access Manager for WebSphere ���� � ��

� Tivoli Access Manager ��� � �����.

Tivoli Access Manager for WebSphere��� WebSphere Application Server�

��� �� ���� �� Tivoli Access Manager ����� ��� ����.

�� ���� ��� ����

�� ���� Tivoli Access Manager ���� ��� ��� ���, WebSphere

Application Server� �� ���� Tivoli Access Manager authorization server

���� ��� ��� � ����. � Authorization Server ����� Tivoli

Access Manager ��� ��� �����. Authorization Server WebSphere �

��� ��� ��, Tivoli Access Manager ��� ��� � ���� ��� �

��. � ����� �� Tivoli Access Manager �� ��� ��� �����.

Tivoli Access Manager �� ���

Tivoli Access Manager for WebSphere� Tivoli Access Manager �� ����

���� � ��� ���. ���� ��� Tivoli Access Manager Policy Server

� ��� � ��� ���. �� ��� ��� �� ��� Tivoli Access

Manager Authorization Server� �� ���� ���� �� ����. ��� IBM

WebSphere Application Server ��� �, Tivoli Access Manager for WebSphere

���� �� �� ���� ��� ���.

�� ���� ����� Policy Server �� � ��� ���. ����� �

��� WebSphere Application Server� �� ������ ���� ����.

WebSphere Application Server ��� �� �� ����� Authorization Server

�� � ��� � ����.

Access Manager Java Runtime Environment ��� Tivoli Access Manager �

� ��� �� � ��� �� �� ��� IBM Tivoli Access Manager �� �

� ��� ������.

JRE(Java Runtime Environment)

Tivoli Access Manager for WebSphere� �� ����� JRE(Java Runtime

Environment) �� 1.3.1� ���� ��� ���.

JRE(Java Runtime Environment)� IBM WebSphere Application Server ��� �

�� �� � �����. Tivoli Access Manager for WebSphere� �� JRE(Java

Runtime Environment) �����.

16 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 35: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: Tivoli Access Manager for WebSphere��� �� Access Manager Java Runtime

Environment� ��� � ����. Access Manager Java Runtime Environment

� �� 1.3.1 Java ���� �����.

��� ����� ����

Tivoli Access Manager for WebSphere� Tivoli Access Manager �� ����

��� ����. �� ���� Policy Server� �� ����� ���� �

� � �� �� �����.

Tivoli Access Manager for WebSphere� Tivoli Access Manager ��� ����

�� �� ����� ��� �����.

v IBM Directory Server

v Sun ONE Directory Server

v IBM Lotus Domino Server

v � ���� ��� ��� Microsoft Active Directory

v Novell eDirectory

� �� ����� ��� �� ��� �� �� ��� IBM Tivoli Access

Manager �� �� ��� ������.

Sun ONE Directory Server �� 5.1 � 5.2� Tivoli Access Manager �����

����� WebSphere Application Server 4.0.6 �� 5.0.2��� ���� ���

�. ��� ����� WebSphere Application Server� �� �� ����� ��

� ������.

WebSphere Application Server �� 4.0.6

http://www.ibm.com/software/webservers/appserv/ doc/v40/prereqs/ae_v406.htm

WebSphere Application Server �� 5.0.2

http://www.ibm.com/software/webservers/appserv/ doc/v50/prereqs/was_v502.htm

�� ��� �� ������ Tivoli Access Manager for WebSphere� �� �

��� WebSphere Application Server ��� �� ����.

v WebSphere Application Server, Advanced Edition, �� 4.0.6 �� WebSphere

Application Server �� 5.0.2 � 5.1

Tivoli Access Manager for WebSphere ���� �� ��� � �� ��

����� �� ����� ����.

– Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ����� ���.

� 2 � �� ���� 17

Page 36: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

– WebSphere Application Server� ��� �� �� �� � ��� Tivoli

Access Manager �� ����� ������ Tivoli Access Manager �

� � ��� ���. ��� ���� �� �� � �� ��� �� ��

� Tivoli Access Manager ��� Tivoli Access Manager �� �� �

��� �� �����.

pdadmin ��� ���� Tivoli Access Manager �� ������ ��

��� ��� � ����. IBM Directory LDAP ���� Tivoli

Access Manager �� ���� ���� �� �� ��� �� � ���

�.

�� ��� ���� pdadmin �� ��� �� �� ��� IBM

Tivoli Access Manager Base Administration Guide ������.

IBM Directory ��� �� ��� �� �� ��� IBM Tivoli Access

Manager for e-business Performance Tuning Guide ������.

v WebSphere Application Server, Advanced Edition Single Server, �� 4.0.6

WebSphere Advanced Edition Single Server� �� �� ����� ���

� ����. ��, ��� �� ���� ���. ��� ���� � �� �

��� Tivoli Access Manager� ���� �� ������ �� ��� �

�� ���.

�: ��� �� ��� �� �� ����� Tivoli Access Manager� ����

�� ������� ����� ���.

�� ����� �����

��� �� Tivoli Access Manager for WebSphere �� ��� ������ �

����.

v IBM Tivoli Access Manager for WebSphere Application Server, �� 3.9

v IBM Tivoli Access Manager for WebSphere Application Server, �� 4.1

����� ����� �� ���� �� �� �, �� �, Tivoli Access

Manager for WebSphere �� 5.1 �� � ���� ������.

Tivoli Access Manager for WebSphere �������� �� �� �����

�.

1. �� ��� �� �� �����. ��� �� ����� � �

��� �� � ����� �����.

v IBM Tivoli Access Manager for WebSphere Application Server �� �

��, �� 3.9

18 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 37: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v IBM Tivoli Access Manager for e-business WebSphere Application Server

�� ���, �� 4.1

2. �� �� ������ Tivoli Access Manager �� ��� �� ���� �

� 3.9 �� �� 4.1�� �� 5.1� ���������.

Tivoli Access Manager for WebSphere� ��� ���� �� Tivoli Access

Manager �� �� ������. � ���� �� Access Manager Java

Runtime Environment� �����.

Tivoli Access Manager �� ���� ����� ��, ��� ���� ���

��� �� ����.

v Tivoli Access Manager ��� ��

v Tivoli Access Manager Policy Server

v Tivoli Access Manager Authorization Server

�� ���� Policy Server� Authorization Server� �� ��, �� ��� �

� ����� �� �� ���� ������ ���. Policy Server�

Authorization Server �� 5.1� ������� ��, �� ����� Access

Manager Java Runtime Environment �� ������ � ����.

�� ���� Policy Server� Authorization Server� �� ��, �� Tivoli

Access Manager �� �� ���� ������ � ����.

Tivoli Access Manager �� �� � �� ��� ������ �� �� �

�� IBM Tivoli Access Manager �� �� ��� ������. �� ��

���� �� � ��� �� ����� ������.

3. Tivoli Access Manager for WebSphere� �� ��� ������. ��� �

� ���� ��� �� 23 ���� ��� ���� ���� Tivoli Access

Manager for WebSphere ���� �� �����.

�� �, ����� ������.

�� ��� ���� ��

install_amwas �� ��� �� ���� ��� ��� �� �� �����

Tivoli Access Manager for WebSphere ��� ��� ������.

v Access Manager Java Runtime Environment

v Tivoli Access Manager for WebSphere Application Server

�� �� ���� �� UNIX � Windows�� WAS_HOME �� �� ���

UNIX�� PDWAS_HOME �� �� ��� ���.

� 2 � �� ���� 19

Page 38: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

WAS_HOME �� ��� WebSphere Application Server �� ���� �����

���� WebSphere_install_directory/bin�� ��� �� ��� ����

��.

UNIX

setupCmdLine.sh

Windows

setupCmdLine.bat

UNIX ���� PDWAS_HOME �� �� Tivoli Access Manager for WebSphere

��� ��� ������.

PDWAS_HOME=/opt/amwasexport PDWAS_HOME

�� WebSphere Application Server� ��� Java ���� /bin ����� ��

� ��� ��� ������.

install_amwas �� ���� Tivoli Access Manager for WebSphere Application

Server �� � ����� �� �� ������.

1. ���� �� Tivoli Access Manager registry server, Policy Server �

authorization serve ����� ������.

2. ��� � �� ��� �� ���� ��� ������. �� ��� 15 �

��� ��� �� ������ ������.

3. �(���) ��� �� �� � ��� ��� �� �� ���� ��

� �� �� ��� ���.

4. � ���� WebSphere Application Server� �� � ���� ��� ���

���.

5. ��� ��� �� �� �� ������.

v 32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��

v 33 ���� �2�: WebSphere �� ���

v �� �� WebSphere Application Server ��� �� 39 ���� �5a�:

WebSphere �� ��� ���� -- WebSphere �� 4.0.6� �� 41 �

��� �5b�: WebSphere �� ��� ���� -- WebSphere �� 5.0.2�

6. Windows ���� ��, �� �� � �� �� �� �� �� ���

� ������.

7. WebSphere Application Server ������.

20 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 39: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

8. AIX, HP-UX, Linux, Solaris � Windows ��� ��, Tivoli Access Manager

Web Security CD� �� ����� �� install_amwas ���� ����

��.

�: WebSphere Application Server� �� ��� ���� �� ���, -is

javahome �� ���� install_amwas ��� ��� � � �� �

�����. � ��, ��� ����.

install_amwas -is:javahome websphere_install_dir/AppServer/java/jre

�� ��� � ���.

a. �� �� �� �� �� ����. � � � � ��� ���

��.

b. �� �� �� ����. ��� �����.

c. ����� �� �� ���, ��� � ��� ��� � ��� ���

�� � ��� �����.

d. Tivoli Access Manager �� ���� ���� �� ��, ����� �

���� ����. AMJRTE �� ����� ��� �����. AMJRTE

� �� ���� ���, e���� �� ��� �����. ��� ���

AMJRTE �� �� �� ����. �� ���� �� �� ����

��.

�� �� �� ���

Policy Server ��� �� * Policy Server� ��� ��� �����.

(�: pdmgr.tivoli.com)

� �� ��

Policy Server SSL �� * Policy Server� SSL �� ���� �� �����. 7135

JRE ����* WebSphere Application Server� �� � ��� JRE� �

����. -is:javahome �� ���� ��� ��, �

�� ��� javahome ��� ��� ����.

� �� ��

*� �� �� �����.

e. Tivoli Access Manager for WebSphere Application Server �� ����

����� ����� ����. ���� � � ��� �����.

f. �� ��� ����� ����� ����. �� ���� �� ��

����.

3. install_amwas �� �� �� �

�� �� �� ���

�� ACL �� *

Access Manager Application ID �

�� � ��� ��� Tivoli Access

Manager for WebSphere� � ��� �

��� � �����. (�: pdpermadmin).

� �� ��

sec_master � *Tivoli Access Manager sec_master ��

��� �� �� ��

� 2 � �� ���� 21

Page 40: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3. install_amwas �� �� �� � (��)

Policy Server ��� �� *

Policy Server� ��� ��� �����.

� ��, ��� ����.

pdmgr.tivoli.com

Policy Server �� �� *Policy Server� �� ���� �� �

�.7135

Authorization Server ��� ��*

Tivoli Access Manager for WebSphere

�� ��� Authorization Server� ��

� ��. � ��� ��� WebSphere

��� ��� �� ��� ����.

(�: pdacld.tivoli.com).

Authorization Server �� ��*Authorization Server� SSL �� ��

�� �� ��.7136

��� �� �� ��, �� �� �� ��

� ��� WebSphere� �� ��� ��

true� ��

�� �� ���� ��� � ��

false� ��� ���.false

��� WebSphere Application Server

��*.

��� WebSphere Application Server �

����. ��� WAS5 �� WAS4

���.

WAS5

Tivoli Access Manager for WebSphere

Application Server �� ����

Tivoli Access Manager for WebSphere

��� �������. ���� ��

�� ��� ��� ��� �����.

� �� ��

WebSphere Application Server �� ���

�*

WebSphere Application Server� ���

�������. � �����

WAS_HOME �� ��� �� ���

��� ���.

� �� ��

��� JRTE �� �� URLAMJRTE PdPerm.properties� ��

URL ��� �� ��

AMJRTE ��� �� URL

AMJRTE ���� �� URL ���

policy � Authorization Server� ���

� � ����� �����.

� �� ��

*� �� �� �����.

�: Windows ��� ��, Access Manager Runtime Environment� �� �

� �� ����� �� � WebSphere Application Server� �� ���

� ��� JRE� JRE ���� ����� ������. � ��, ��

� ����.

websphere_install_dir\AppServer\java\jre

22 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 41: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ���� ���� Tivoli Access Manager for WebSphere ��

� ���� � ���� � ���� ���� �� ���� Tivoli Access

Manager for WebSphere ���� ��� � �����.

���� ���� ����� ������.

v �Solaris� ���

v 24 ���� �AIX� ���

v 25 ���� �HP-UX� ���

v 27 ���� �Linux� ���

v 28 ���� �Windows� ���

Solaris� ��

Tivoli Access Manager for WebSphere ���� �� ���� �� ���

��. Solaris� ����� �� ����� pkgadd ������.

�: �� Tivoli Access Manager for WebSphere �� � ��� ���� ��

��� �� ��, �� � �� �� � �� ���. 105 ����

�Solaris�� �� ������.

Tivoli Access Manager for WebSphere Solaris� ����� �� ����� �

����.

1. root� �������.

2. Tivoli Access Manager for WebSphere �� ����� ��� �� ����

��.

����� ���� ����� 15 ���� ��� �� ������ ����

��.

3. Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ���� ��� ������.

�: � ��� WebSphere Advanced Edition Single Server� ���� ���

�.

�� ����� ���� ����� 17 ���� ��� ����� �����

� ������.

4. WebSphere Application Server �� � ��� �� ������� Tivoli

Access Manager �� ����� �� ������ ������.

Tivoli Access Manager pdadmin ��� ���� ��� �� ��� �

����. � ��, LDAP �� ���� ��� ��� ����.

pdadmin> user import UserID Distinguished_Name_of_the_user_in_LDAP

� 2 � �� ���� 23

Page 42: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdadmin� �� �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

IBM Directory LDAP ��� ��� ��� �� ��, LDAP �� �� �

� ��� �����. �� ��� IBM Tivoli Access Manager for e-business

Performance Tuning Guide ������.

5. Solaris� IBM Tivoli Access Manager Web Security CD �����.

6. �� �� ������(��� ���).

pkgadd -d /cdrom/cdrom0/solaris -a /cdrom/cdrom0/solaris/pddefault packages

���

v -d /cdrom/cdrom0/solaris -- �� �� �����.

v -a /cdrom/cdrom0/solaris/pddefault -- �� �� ����� �� �

����.

�� packages� ��� ����.

v PDJrte -- Access Manager Java Runtime Environment ��

v PDWAS -- Tivoli Access Manager WebSphere Application Server ��

�: WebSphere Application Server� �� ���� �� ��� ���� �

�� ���.

7. � ��, Tivoli Access Manager for WebSphere ������. ����� 31

���� � 3 � ��� ��� ������.

AIX� ��

Tivoli Access Manager for WebSphere ���� �� ���� �� ���

��.

�: �� Tivoli Access Manager for WebSphere �� � ��� ���� ��

��� �� ��, �� Tivoli Access Manager for WebSphere �� �

� �� � �� ���. 107 ���� �AIX�� �� ������.

Tivoli Access Manager for WebSphere AIX� ����� �� ����� ��

���.

1. root� �������.

2. Tivoli Access Manager for WebSphere �� ����� ��� �� ����

��.

����� ���� ����� 15 ���� ��� �� ������ ����

��.

24 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 43: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3. Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ���� ��� ������.

�: � ��� WebSphere Advanced Edition Single Server� ���� ���

�.

�� ����� ���� ����� 17 ���� ��� ����� �����

� ������.

4. WebSphere Application Server �� � ��� �� ������� Tivoli

Access Manager �� ����� �� ������ ������.

Tivoli Access Manager pdadmin ��� ���� ��� �� ��� �

����. � ��, LDAP �� ���� ��� ��� ����.

pdadmin> user import UserID Distinguished_Name_of_the_user_in_LDAP

pdadmin� �� �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

IBM Directory LDAP ��� ��� ��� �� ��, LDAP �� �� �

� ��� �����. �� ��� IBM Tivoli Access Manager for e-business

Performance Tuning Guide ������.

5. AIX� IBM Tivoli Access Manager Web Security CD CD ����� ���

��.

6. �� �� ������.

installp -acgXd cd_mount_point/usr/sys/inst.images packages

��� cd_mount_point/usr/sys/inst.images� CD� ��� ������

��� ��� ����.

PDJ.rte Access Manager Java Runtime Environment �� �����.

PDWAS Access Manager for WebLogic Application Server �� �����.

�: WebSphere Application Server� �� ���� �� ��� ���� �

�� ���.

7. � ��, Tivoli Access Manager for WebSphere ������. ����� 31

���� � 3 � ��� ��� ������.

HP-UX� ��

Tivoli Access Manager for WebSphere ���� �� ���� �� ���

��. HP-UX� ����� �� ����� swinstall� ������.

� 2 � �� ���� 25

Page 44: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Tivoli Access Manager for WebSphere HP-UX� ����� �� ����� �

����.

1. root� �������.

2. Tivoli Access Manager for WebSphere �� ����� ��� �� ����

��.

����� ���� ����� 15 ���� ��� �� ������ ����

��.

3. Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ���� ��� ������.

�: � ��� WebSphere Advanced Edition Single Server� ���� ���

�.

�� ����� ���� ����� 17 ���� ��� ����� �����

� ������.

4. WebSphere Application Server �� � ��� �� ������� Tivoli

Access Manager �� ����� �� ������ ������.

Tivoli Access Manager pdadmin ��� ���� ��� �� ��� �

����. � ��, LDAP �� ���� ��� ��� ����.

pdadmin> user import UserID Distinguished_Name_of_the_user_in_LDAP

pdadmin� �� �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

IBM Directory LDAP ��� ��� ��� �� ��, LDAP �� �� �

� ��� �����. �� ��� IBM Tivoli Access Manager for e-business

Performance Tuning Guide ������.

5. ��� �� ��� ���� pfs_mountd � � pfsd ����.

pfs_mount ���� CD ������. � ��, ��� ������.

/usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cd-rom

��� /dev/dsk/c0t0d0� CD ������ /cd-rom� �� ������.

6. �� ��� ���� Tivoli Access Manager for WebSphere �� ���

���.

# swinstall -s /cd-rom/hp packages

��� ��� ��� ����.

PDJ.rte Access Manager Java Runtime Environment �� �����.

PDWAS Access Manager for WebSphere Application Server �� �����.

26 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 45: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: WebSphere Application Server� �� ���� �� ��� ���� �

�� ���.

�� ��� ������ ��� ���� ����. �� ���� �� ��

� � ���� �����. CD�� �� ���� �� ���� �����.

�� ��� ������ ��� ���� ����. swinstall ����� ��

���.

7. � ��, Tivoli Access Manager for WebSphere ������. ����� 31

���� � 3 � ��� ��� ������.

Linux� ��

Tivoli Access Manager for WebSphere ���� �� ���� �� ���

��. Linux� ����� �� ����� rpm� ������.

�� Tivoli Access Manager for WebSphere �� � ��� ���� �� ��

� �� ��, �� � �� �� � �� ���. 107 ���� �Linux�

� �� ������.

�: Linux on zSeries ��: � IBM Tivoli Access Manager for Linux on zSeries

CD�� Linux rpm �� �� ��� ��� ���.

Tivoli Access Manager for WebSphere Linux� ����� �� ����� �

����.

1. root� �������.

2. Tivoli Access Manager for WebSphere �� ����� ��� �� ����

��.

����� ���� ����� 15 ���� ��� �� ������ ����

��.

3. Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ���� ��� ������.

�: � ��� WebSphere Advanced Edition Single Server� ���� ���

�.

�� ����� ���� ����� 17 ���� ��� ����� �����

� ������.

4. WebSphere Application Server �� � ��� �� ������� Tivoli

Access Manager �� ����� �� ������ ������.

Tivoli Access Manager pdadmin ��� ���� ��� �� ��� �

����. � ��, LDAP �� ���� ��� ��� ����.

pdadmin> user import UserID Distinguished_Name_of_the_user_in_LDAP

� 2 � �� ���� 27

Page 46: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdadmin� �� �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

IBM Directory LDAP ��� ��� ��� �� ��, LDAP �� �� �

� ��� �����. �� ��� IBM Tivoli Access Manager for e-business

Performance Tuning Guide ������.

5. xSeries �� zSeries� IBM Tivoli Access Manager Web Security CD �

�����.

6. /mnt/cdrom/series ����� ������. ���, /mnt/cdrom� CD�

�� ����� series� xSeries, zSeries, iSeries �� pSeries ���

��.

7. �� �� ������.

rpm -ihv packages

��� packages� �� � �� �����.

Access Manager Java Runtime

Environment ���

Access Manager for WebSphere

Application Server

Linux on xSeries PDJrte-PD-5.1.0-0.i386.rpm PDWAS-PD-5.1.0-0.i386.rpm

Linux on zSeries PDJrte-PD-5.1.0-0.i390.rpm PDWAS-PD-5.1.0-0.i390.rpm

�: WebSphere Application Server� �� ���� �� ��� ���� �

�� ���.

8. � ��, Tivoli Access Manager for WebSphere ������. ����� 31

���� � 3 � ��� ��� ������.

Windows� ��

Tivoli Access Manager for WebSphere ���� �� ���� �� ���

��. Tivoli Access Manager for WebSphere �� ����� InstallShield

setup.exe ������.

�: �� Tivoli Access Manager for WebSphere �� � ��� ���� ��

��� �� ��, �� � �� �� � �� ���. 106 ����

�Windows�� �� ������.

Tivoli Access Manager for WebSphere Windows� �� � ����� �� �

���� �����.

1. Windows �� �� �� ��� Windows ���� �������.

2. Tivoli Access Manager for WebSphere �� ����� ��� �� ���

���.

28 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 47: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

����� ���� ����� 15 ���� ��� �� ������ ����

��.

3. Tivoli Access Manager Policy Server � WebSphere Application Server�

�� �� ����� ����� ���� ��� ������.

�: � ��� WebSphere Advanced Edition Single Server� ���� ���

�.

�� ����� ���� ����� 17 ���� ��� ����� ���

��� ������.

4. WebSphere Application Server �� � ��� �� ������� Tivoli

Access Manager �� ����� �� ������ ������.

Tivoli Access Manager pdadmin ��� ���� ��� �� ��� �

����. � ��, LDAP �� ���� ��� ��� ����.

pdadmin> user import UserID Distinguished_Name_of_the_user_in_LDAP

pdadmin� �� �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

IBM Directory LDAP ��� ��� ��� �� ��, LDAP �� �� �

� ��� �����. �� ��� IBM Tivoli Access Manager for

e-business Performance Tuning Guide ������.

5. Windows� IBM Tivoli Access Manager Web Security for Windows CD CD

����� �����.

6. Access Manager Java Runtime Environment � Access Manager for WebSphere

Application Server �� ������. �� ����� �� �����

� setup.exe �� ������.

\windows\PolicyDirector\Disk Images\Disk1\setup.exe

�� � �� �� ����.

7. ��� ��� � � ��� �����.

8. � �� �� ����. ����� ��� �����.

9. ���� ��� � ��� �� �� �����.

10. �� �� � ��� �����.

v Access Manager Java Runtime Environment

v Access Manager for WebSphere Application Server

11. �� ����� �� ����� �� ��� �� �� ���� �

�� ���� �����. ����� �� ��, ���� �� ���

� ��� ���� ��� ���.

� 2 � �� ���� 29

Page 48: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

12. � � �� ���� ������.

13. � ��, Tivoli Access Manager for WebSphere ������. ����� 31

���� � 3 � ��� ��� ������.

30 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 49: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 3 � �� ��

Tivoli Access Manager for WebSphere� �� ��� � �� Tivoli Access Manager

for WebSphere ���� Tivoli Access Manager �� ���� �����, ���

�� Tivoli Access Manager for WebSphere ���� ������ �� ����.

� Tivoli Access Manager for WebSphere ���� pdwascfg ���� ���

� �� ����� �����. J2EE ����� �� ��� Tivoli Access

Manager policy ������ ������� ���. Tivoli Access Manager

for WebSphere� � ��� � ��� ���� ���� �����. ��

�� policy ���� EAR �� �� J2EE ����� �� ������ �

�� ���.

�� ��� Tivoli Access Manager �� ���� � �� Tivoli Access Manager

for WebSphere ���� ��� ���� ��� � ��� �� ��� ����.

�� ��� �� ��� �� �� �� �����.

v ��� �� ���

v 45 ���� �WebSphere Application Server �� 5.1 ��� Tivoli Access

Manager for WebSphere ���

v 47 ���� ��� �� ���

�� �� ��

� ���� � �� Tivoli Access Manager for WebSphere �� ���� ��

� � �����.

Tivoli Access Manager for WebSphere� �� ���� ��� ���� �� �

��� �����. �� ����� � � �����, Tivoli Access Manager �

� ����� pdadmin � WebSphere �� �����. Tivoli Access Manager

for WebSphere �� Tivoli Access Manager �� ���� �� ��� ����

��� �� ��� �� ����.

�� ����� �� �� ���� ����.

v 32 ���� �1�: WebSphere Application Server� � Tivoli Access Manager

�� ��

v 33 ���� �2�: WebSphere �� ���

v 36 ���� �3�: Access Manager Java Runtime Environment ���

© Copyright IBM Corp. 2002, 2003 31

Page 50: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v 37 ���� �4�: �� ��� ���

v 39 ���� �5a�: WebSphere �� ��� ���� -- WebSphere �� 4.0.6�

v 41 ���� �5b�: WebSphere �� ��� ���� -- WebSphere �� 5.0.2�

�� ����� �� ���� ��� �� ����� ���� ����.

� ��� ��� � ��� ����� ������.

1�: WebSphere Application Server� �� Tivoli Access Manager��� ��

��� �� WebSphere Application Server�� �� ��� ��, Tivoli Access

Manager ��� ���� WebSphere Application Server �� �� ���

���. Tivoli Access Manager ��� ����� pdadmin �� Tivoli Access

Manager Web Portal Manager � �� ���� WebSphere Application Server

� � Tivoli Access Manager �� �� ������. Tivoli Access Manager

��� ������ ��� ������.

1. ����� �� �� sec_master� pdadmin� � ����.

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server �� �� ������. � ��, ���

����.

pdadmin> user import was_admin_user dn_registry_identifier

WebSphere �� �� ��� �� �����.

pdadmin> user modify was_admin_user account-valid yes

�� 5. Tivoli Access Manager for WebSphere� �� �� �� �� ���

32 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 51: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� WebSphere Application Server�� �� ���� �� ��, WebSphere

Application Server �� �� �� ���. Tivoli Access Manager ���

����� pdadmin �� Tivoli Access Manager Web Portal Manager � ��

���� WebSphere Application Server� � Tivoli Access Manager �� ��

�����.

pdadmin� ���� ��� ��� ����.

1. ����� �� �� sec_master� pdadmin� � ����.

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server� �� Tivoli Access Manager �� ��

�����. � ��, �� ��� � �� wsadmin� ����. ��� �

���� ���� ��� ���.

pdadmin> user create wsadmin cn=wsadmin,o=organization,c=countrywsadmin wsadmin myPassword

organization � country LDAP �� ������ �� ��� ���

���.

wsadmin ��� �� �����.

pdadmin> user modify wsadmin account-valid yes

2�: WebSphere �� ��

��� �� WebSphere Application Server ��� �� �� � �� ����

��.

v �WebSphere Application Server �� 4.0.6�� �� ���

v 34 ���� �WebSphere Application Server �� 5.0.2�� �� ���

WebSphere �� 5.1 �� ��� �� �� ��� 45 ���� �WebSphere

Application Server �� 5.1 ��� Tivoli Access Manager for WebSphere ���

� ��� ���� ����.

WebSphere Application Server �� 4.0.6�� �� ��

WebSphere Application Server �� 4.0.6�� ��� ����� ��� ����

��.

1. WebSphere �� �� � ����.

2. ��� � ��, WebSphere �� ���� � ����.

3. �� → �� � ����.

4. �� �� ����. �� �� �� � ����.

5. �� �� ����.

a. LTPA ����. �� LTPA ��� ������.

� 3 � �� �� 33

Page 52: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v �� ��: 120

v ���: ��� ��. � ��, ��� ����.

mydomain.ibm.com

b. LDAP �� ����. LTPA ��� ������.

4. LDAP ��

LDAP �� � �

�� �� ID cn=wsadmin,o=ibm,c=us

�� �� �� myPassword

��� ldapserver.mydomain.ibm.com

���� � SecureWay

�� �� ��(DN) o=ibm,c=us

��� �� ��(DN) cn=root

��� �� myPassword

c. ��� �����.

6. WebSphere �� ��� → �� →��� ��� �� ��� ��� ����

�.

7. �� ��� ����.

WebSphere Application Server �� 5.0.2�� �� ��

WebSphere Application Server �� 5.0.2�� ��� ����� ��� ����

��.

1. WebSphere �� �� � ����.

2. ��� � ��, �� �(http://localhost:9090/admin/)� ����.

3. ��� �������.

4. LDAP ������.

a. �� → ��� ����� → LDAP ����.

b. �� �� ������.

5. LDAP ��

LDAP �� � � Values

�� ��� ID cn=wsadmin,o=ibm,c=us

�� ��� �� myPassword

� IBM_Directory_Server

��� ldapserver.mydomain.ibm.com

�� 389

�� �� ��(DN) o=ibm,c=us

��� �� ��(DN) cn=root

��� �� myPassword

34 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 53: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

5. LDAP �� (��)

�� ��� 120

� �� true

���� �� �� true

SSL �� false

SSL �� cellname/DefaultSSLSettings

c. ��� �����.

5. LTPA �� ������.

a. �� ���� → LTPA ����.

b. LTPA �� � � ���� � ������.

c. LTPA �� ���� �� 120�� ������.

d. �� ��� LTPA �� � � ���� � ������.

e. ��� �����.

f. ��� � ��� �� �� �� �� ��� �� ���(SSO)� �

���.

g. �� ���� ������.

h. �� ��� DNS ��� ��� ������.

i. ��� �����.

6. �� ��� ������.

a. �� → ��� ��� ����.

b. �� �� ������.

6. �� ���

�� �� � �

�� �� true

Java 2 ��� false

��� �� ��� ID �� true

�� ��� 600

�� � true

�� ���� CSI � SAS

�� �� ���� LTPA

�� ��� ����� LDAP

c. ��� �����.

7. ��� �����.

8. �� ��� ����� �� �� �����.

9. WebSphere Application Server �� ��� ��������.

10. WebSphere Application Server �� � ����.

� 3 � �� �� 35

Page 54: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3�: Access Manager Java Runtime Environment ��

Access Manager Java Runtime Environment ���� IBM WebSphere Application

Server� ��� Java ���� �����.

�: Tivoli Access Manager for WebSphere ����� Access Manager Java

Runtime Environment� �����.

Access Manager Java Runtime Environment� Access Manager �� ��� ��

��, ����� pdjrtecfg ��� ���� ��� � ����. Access Manager

�� �� GUI�� Access Manager Java Runtime Environment ����� ��

� ������.

1. �� ��� ���� ������.

v UNIX ��� - /opt/PolicyDirector/bin

v Windows ��� - C:\Program Files\Tivoli\Policy Director\bin

2. �� ��� ������.

pdconfig

Java ���� ��� � �� Access Manager �� ��� ����.

����� Access Manager Java Runtime Environment ����� ��� ��

����.

1. �� �� WAS_HOME� IBM WebSphere Application Server � ����� ��

�� ��� ������.

2. �� ��� ���� ������.

v UNIX ��� - /opt/PolicyDirector/sbin

v Windows ��� - C:\Program Files\Tivoli\Policy Director\sbin

3. �� ��� � �� ���� ������.

v UNIX

pdjrtecfg -action config-java_home $WAS_HOME/java/jre-host policy_server_host

v Windows

pdjrtecfg -action config-java_home %WAS_HOME%\java\jre-host policy_server_host

�: PATH ��� �� ���� java 2� ��� pdjrtecfg � -java_home

pathname� ���� java 2� ��� ����� ������.

36 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 55: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

4�: �� ��� ��

�� �� ������.

1. WebSphere Application Server ������.

2. �� �� ������.

v Tivoli Access Manager for WebSphere ����� �� ID� ���

�� ��� ��. �� ����� ID� pdpermadmin� �����. �

�� ��� �� ������ ���� ����.

v sec_master ��� �

v Policy Server ��� ���� ��� ��� ��

(�: pdmgrserver.mysubnet.ibm.com)

v Authorization Server ��� ���� ��� ��� ��

(�: pdacldserver.mysubnet.ibm.com)

v WebSphere �� � ����

3. WAS_HOME �� ��� WebSphere Application Server �� ���� ���

�� ���� WebSphere_install_directory/bin�� ��� �� ���

������.

UNIX

setupCmdLine.sh

Windows

setupCmdLine.bat

4. UNIX ���� PDWAS_HOME �� ��� Tivoli Access Manager for WebSphere

�� ���� ������. Windows ���� PDWAS_HOME� �� ���

�����.

UNIX

PDWAS_HOME=/opt/amwasexport PDWAS_HOME

5. �� ��� ���� ������.

v UNIX ��� - /opt/amwas/sbin

v Windows ��� - C:\Program Files\Tivoli\amwas\sbin

6. pdwascfg ���� ������. �� ���� ��� �� ����

pdwascfg� ��� �� ������.

�: ��� ����� pdpermadmin�� �� � Tivoli Access Manager �

� ��� ��� ��� �����. � ��, ��� ����.

-remote_acl_user pdpermadmin

� 3 � �� �� 37

Page 56: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� ���� ��� ��� ��, ��� �� WebSphere Application

Server� ��� �� -action configWAS4 �� configWAS5 ��� ��

�� �� ��� � ���� ���� ������.

pdwascfg -action configWASversion_number-remote_acl_user pdpermadmin-sec_master_pwd myPassWord-pdmgrd_host fully_qualified_DN_of_the_policy_server_host-pdacld_host fully_qualified_DN_of_the_authorization_server_host-was_home c:\WebSphere\AppServer

�: �� ��� �� -was_home �� ��� ���� ����. �� ��

WebSphere Application Server �� � ��� �� ��� �� �

�� �����. ����� �� � �� ��� ����.

Windows

WebSphere Application Server �� 4.0.6:

c:\WebSphere\AppServer

WebSphere Application Server �� 5.0.2:

"c:\Program Files\WebSphere\AppServer"

Solaris, Linux, HP-UX

/opt/WebSphere/AppServer

AIX /usr/WebSphere/AppServer

pdwascfg ����� Tivoli Access Manager for WebSphere � ����

� ����� WebSphere Application Server �����.

�:

a. pdwascfg ����� sec_master� �� �� ��� �� ����� �

����.

b. pdwascfg ����� ����� ���� ����� AMWASConfig.log��

�� �� ����.

7. pdwascfg ��� PdPerm �� �� ���� ������.

v Solaris, Linux, HP-UX

/opt/WebSphere/AppServer/java/jre/PdPerm.properties

v AIX

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

v Windows

– WebSphere Application Server �� 4.0.6

C:\WebSphere\AppServer\java\jre\PdPerm.properties

– WebSphere Application Server �� 5.0.2

38 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 57: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

C:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties

�: �� �� ����� WebSphere Application Server� �� �� ����

���� ��� �����. ���� �� ��� ��� ��, �� ��

� ��� ������.

5a�: WebSphere �� ��� ��� -- WebSphere �� 4.0.6

WebSphere 5.0.2 ��� �� ��, � �� ��� 41 ���� �5b�:

WebSphere �� ��� ���� -- WebSphere �� 5.0.2�� ����.

� ����� WebSphere admin.ear �� ����� ��� Tivoli Access

Manager policy ������ ���� �� policy �������.

���� ����� Tivoli Access Manager ��� ��� WebSphere ��

���� ��� ����. � �� ���� ��� WebSphere � � � �

���.

�� �� ������.

1. WebSphere �� �� ��, ������.

2. WAS_HOME �� ��� WebSphere Application Server �� ��� �����

� ������. �� ��� �� �� ����.

v Solaris, Linux HP-UX

WAS_HOME=/opt/WebSphere/AppServer

v AIX

WAS_HOME=/usr/WebSphere/AppServer

v Windows

WAS_HOME=C:\WebSphere\AppServer

3. ���� ����� �� �� ���� ���� � ��� �� �� �

�����.

v ����� EAR �� ��. ���� ���� �� ��� �, �

�� �� �� EAR �� ����� ���.

– Solaris, Linux, HP-UX

/opt/WebSphere/AppServer/config/admin.ear

– AIX

/usr/WebSphere/AppServer/config/admin.ear

– Windows

C:\WebSphere\AppServer\config\admin.ear

v PDPerm.properties �� �� ��. � �� WebSphere Application

Server �� ����� ����. � ���� �� ��� ��� ����.

� 3 � �� �� 39

Page 58: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: � ��� URI(Uniform Resource Identifier)� ���� ���.

– Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

– AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

– Windows

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

v Tivoli Access Manager �� ��� ��. � ��� sec_master�� ���.

v sec_master ��� �.

v WebSphere �� �� ��� ��. � ��� ��� ��/��� ���

��� ���. � ��, ��� ����.

wsadmin

v Tivoli Access Manager Policy Server� WebSphere Application Server� �

� �� ���� LDAP �� ��(DN) ���. �� wsadmin ��

�� � ���� DN ���� ��� ���.

32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��� ��� �� DN� ���� wsadmin� �� ��

��.

cn=wsadmin,o=ibm,c=us

� ��, DN ���� o=ibm,c=us� ����.

� �� migrateEAR4 ����� -d �� ��� ��� ���.

�: pdadmin� ���� �� ���� wsadmin� �� DN� �� �

����.

pdadmin> user show wsadmin

4. ���� ����� ��� ���� ������.

v UNIX ��� - /opt/amwas/bin

v Windows ��� - C:\Program Files\Tivoli\amwas\bin

5. ���� ���� ���� admin.EAR� �� �� ��� ����

����.

�� ���� ���� ��� ���� �� ����� �� ��� � �

��� ���� ������.

UNIX

migrateEAR4 -j /opt/WebSphere/AppServer/config/admin.ear-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

40 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 59: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

AIX�� PdPerm.properties �� �� ��� ��� ����.

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR4 -j c:\WebSphere\AppServer\config\admin.ear-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

���� �� � �� ���� ����. ����� ��� ����� �

���� ������ �� pdwas_migrate.log �� �����. �� policy

� ����� � �������� ����� �� �� �����

�. �� �� ��� ���, ��� �� ���� ��� �� ��

��� � ���� �� �� ������.

����� ��� ��, � URI(Uniform Resource Identifier) -c �

� ����� � � ��� -j �� ����� ������.

���� ���� ����� admin.ear� ���� ���. �����,

���� ���� ���� DTD � ��� �� URL ��� �� ��

��. ��� �� ����� DTD ����� ���� ��� ���. ��

� ���� ���� ���� �� �� ��, DTD� �� ��� �����

�. � ��, �� ������ �� DTD ���� ������.

� : Tivoli Access Manager for WebSphere ���� �� �� � � �

�� ���� ���� ��� ���. ���� ����� EAR

�� � � ��� ���. � ���� �� ����� 53 ���� �

4 � ��� � ������ �� ����.

�� ACL� pdwas-admin �� ��

pdwas-admin ��� �� ACL� ����� �� �� ������.

1. pdadmin� ���� pdwas-admin ��� � ACL� ������. � ���

� ���� �� ��� ������.

pdadmin> acl modify _WebAppServer_deployedResources_AdminRole_admin_ACLset group pdwas-admin T[WebAppServer]i

2. �� ���� � ��� Authorization Server� �� ��, pdadmin� ���

� server replicate ��� ��� �� Authorization Server�� ACL ��

��� �� ����� ������.

5b�: WebSphere �� ��� ��� -- WebSphere �� 5.0.2

WebSphere Application Server 4.0.6� ���� ��, � �� ������.

� 3 � �� �� 41

Page 60: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ����� WebSphere adminconsole.ear �� ����� ��� Tivoli Access

Manager policy ������ ���� �� policy �������.

���� ����� Tivoli Access Manager ��� ��� WebSphere ��

���� ��� ����.

�: Tivoli Access Manager for WebSphere� WebSphere Application Server �

� ���� � ��� ���� ����.

�� �� ������.

1. WebSphere �� �� ��, ������.

2. WAS_HOME �� ��� WebSphere Application Server �� ��� �����

� ������. �� ��� �� �� ����.

v Solaris, Linux, HP-UX

WAS_HOME=/opt/WebSphere/AppServer

v AIX

WAS_HOME=/usr/WebSphere/AppServer

v Windows

WAS_HOME=C:\Program Files\WebSphere\AppServer

3. ���� ����� �� �� ���� ���� � ��� �� �� �

�����.

v ����� EAR �� ��. ���� ���� �� ��� � �

� EAR(admin-authz.xml � naming-authz.xml)� ����� ��

�.

– Solaris, Linux, HP-UX

/opt/WebSphere/AppServer/installedApps/cellname/adminconsole.ear/opt/WebSphere/AppServer/config/cells/cellname/admin-authz.xml/opt/WebSphere/AppServer/config/cells/cellname/naming-authz.xml

– AIX

/usr/WebSphere/AppServer/installedApps/cellname/adminconsole.ear/usr/WebSphere/AppServer/config/cells/cellname/admin-authz.xml/usr/WebSphere/AppServer/config/cells/cellname/naming-authz.xml

– Windows

C:\Program Files\WebSphere\AppServer\installedApps\cellname\adminconsole.earC:\Program Files\WebSphere\AppServer\config\cells\cellname\admin-authz.xmlC:\Program Files\WebSphere\AppServer\config\cells\cellname\naming-authz.xml

v PDPerm.properties �� �� ��. � �� WebSphere Application

Server �� ����� ����. � ���� �� ��� ��� ����.

42 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 61: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: � ��� URI(Uniform Resource Identifier)� ���� ���.

– Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

– AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

– Windows

file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

v Tivoli Access Manager �� ��� ��. � ��� sec_master�� ���.

v sec_master ��� �.

v WebSphere �� �� ��� ��. � ��� ��� �� ��� ��

� ���. � ��, ��� ����.

wsadmin

v Tivoli Access Manager Policy Server� WebSphere Application Server� �

� �� ���� LDAP �� ��(DN) ���. �� wsadmin ��

�� � ���� DN ���� ��� ���.

32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��� ��� �� DN� ���� wsadmin� �� ��

��.

cn=wsadmin,o=ibm,c=us

� ��, DN ���� o=ibm,c=us� ����.

� �� migrateEAR5 ����� -d �� ��� ��� ���.

�: pdadmin� ���� �� ���� wsadmin� �� DN� �� �

����.

pdadmin> user show wsadmin

4. ���� ����� ��� ���� ������.

v UNIX ��� - /opt/amwas/bin

v Windows ��� - C:\Program Files\Tivoli\amwas\bin

5. ���� ���� ���� adminconsole.EAR, admin-authz.xml �

naming-authz.xml �� �� �� ��� ��������.

�� ���� ���� ��� ���� �� ����� �� ��� � �

�� ���� ������.

Solaris, Linux, HP-UX

� 3 � �� �� 43

Page 62: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

migrateEAR5-j /opt/WebSphere/AppServer/installedApps/cellname/adminconsole.ear-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties-e adminconsole

migrateEAR5-j /opt/WebSphere/AppServer/config/cells/cellname/admin-authz.xml-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

migrateEAR5-j /opt/WebSphere/AppServer/config/cells/cellname/naming-authz.xml-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

AIX

migrateEAR5-j /usr/WebSphere/AppServer/installedApps/cellname/adminconsole.ear-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties-e adminconsole

migrateEAR5-j /usr/WebSphere/AppServer/config/cells/cellname/admin-authz.xml-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

migrateEAR5-j /opt/WebSphere/AppServer/config/cells/cellname/naming-authz.xml-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\installedApps\cellname\adminconsole.ear"-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"-e adminconsole

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\config\cells\cellname\admin-authz.xml"-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\config\cells\cellname\naming-authz.xml"-a sec_master -p sec_master_password -w wsadmin -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

���� �� � �� ���� ����. ����� ��� ����� �

���� ������ �� pdwas_migrate.log �� �����. �� policy

� ����� � �������� ����� �� �� �����

44 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 63: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�. �� �� ��� ���, ��� �� ���� ��� �� ��

��� � ���� �� �� ������.

����� ��� ��, � URI(Uniform Resource Indicator) -c �

� ����� � � ��� -j �� ����� ������.

���� ���� ����� adminconsole.ear� ���� ���. �

����, ���� ���� ���� DTD � ��� �� URL ��� �

� ����. ��� �� ����� DTD ����� ���� ��� ��

�. ��� ���� ���� ���� �� �� ��, DTD� �� ��� ��

����. � ��, �� ������ �� DTD ���� ������.

� : Tivoli Access Manager for WebSphere ���� �� �� � � ��

� ���� ���� ��� ���. ���� ����� EAR �

� � � ��� ���. � ���� �� ����� 53 ���� � 4 �

��� � ������ �� ����.

WebSphere Application Server �� 5.1 ��� Tivoli Access Managerfor WebSphere ��

WebSphere Application Server �� 5.1 ��� � �� �� �� Access Manager

Java Runtime Environment �� Tivoli Access Manager for WebSphere ���

��� ����. Access Manager Java Runtime Environment � Tivoli Access

Manager for WebSphere� WebSphere Application Server 5.1 ��� ��� �

����. � � �� ��� WebSphere� �� ��� ����. �� �� ��

��� �� WebSphere Application Server �� 5.1 ���� Tivoli Access Manager

for WebSphere ������.

1�: WebSphere Application Server� �� Tivoli Access Manager�� ��� ��

WebSphere �� ��� �� ��, policy ���� �� �� ��� ��

�� Tivoli Access Manager� �� �� ���.

pdadmin -a sec_master -p sec_master_passwordpdadmin> user create was_admin_uid was_admin_user_dnwas_admin_uid was_admin_uid was_admin_pwdpdadmin> user modify was_admin_uid account-valid true

2�: WebSphere Application Server �� 5.1�� �� ��

Tivoli Access Manager for WebSphere Application Server ���� ��� �

� ��� �� ��� �� WebSphere Application Server ��� �� ���

�� �� ����. �, �� ��� ������.

� 3 � �� �� 45

Page 64: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v Tivoli Access Manager � WebSphere� �� �� ����� ��� �

���. ��� Tivoli Access Manager� �� �� ����� �����

WebSphere ��� ���.

v WebSphere �� ��� LDAP ���� �� �, Tivoli Access Manager for

Account Policies ��� ���� ������.

3�: Access Manager Java Runtime Environment ��

�� �� ��� WebSphere Application Server �� 5.1 InfoCenter ��� ″�

� Tivoli Access Manager ����� WebSphere Application Server ��″ �

� ������.

4�: Tivoli Access Manager for WebSphere ��

�� �� ���� Tivoli Access Manager for WebSphere� WebSphere ��

5.1� ��� ������.

1. WAS_HOME\bin� �� setupcmdline ���� ���� ��� ������.

2. PDWAS_HOME �� �� WAS_HOME �� ��� ��� ������.

Windows�� ��� ��� ����.

set PDWAS_HOME=%WAS_HOME%

3. %WAS_HOME%\bin ����� �� pdwascfg ���� ���� ��� ���

���. �� ��� pdwascfg.bat �����. UNIX ��� �� ��� �

��� pdwascfg.sh� ������.

%WAS_HOME%\bin\pdwascfg.bat -action configWAS5-remote_acl_user remote_ACL_user_name-sec_master_pwd sec_master_pwd -pdmgrd_host TAM_Policy_Server_host-pdacld_host TAM_Authorization_Server_host -was_home WAS_home-amwas_home WAS_home -embedded true -action_type local -verbose true

remote_ACL_user_name� ���� �� ��� ����. � ���

Tivoli Access Manager ���� �� ��� �����. �� ���� ���

� ��� �� ��� �����.

5�: �� policy ���

WebSphere Application Server �� 5.1 �� � policy �� �� Tivoli Access

Manager� ������� ���. ���� ����� %WAS_HOME%\bin �

���� ����.

Windows�� �� �� policy ������� �� ��� ��� ���(�

�� ����).

UNIX

�: AIX�� WebSphere� �� ��� /usr/WebSphere/AppServer���.

46 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 65: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

migrateEAR5-j /opt/WebSphere/AppServer/installedApps/cellname/adminconsole.ear-a sec_master -p sec_master_pwd-w was_admin_uid -e "adminconsole"-d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties-e adminconsole

migrateEAR5-j /opt/WebSphere/AppServer/config/cells/cellname/admin-authz.xml-a sec_master -p sec_master_pwd-w was_admin_uid -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

migrateEAR5-j /opt/WebSphere/AppServer/config/cells/cellname/naming-authz.xml-a sec_master -p sec_master_pwd-w was_admin_uid -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\installedApps\cellname\adminconsole.ear-a sec_master -p sec_master_pwd-w was_admin_uid-d "o=ibm,c=us" -c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"-e adminconsole

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\config\cells\cellname\admin-authz.xml"-a sec_master -p sec_master_pwd-w was_admin_uid -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\config\cells\cellname\naming-authz.xml"-a sec_master -p sec_master_pwd-w was_admin_uid -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

WebSphere Application Server� �� �� � ����� ��� ���

adminconsole.ear �� ������ -e �� �����.

�� �� ��

� ���� �� Tivoli Access Manager for WebSphere �� Tivoli Access

Manager �� ���� ���� ��� � �����.

� ���� �� ��� �����.

v 31 ���� ��� �� ���� ������.

� 3 � �� �� 47

Page 66: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ����� ����, WebSphere Application Server �� 4.0.6� �� �

� ���� admin.ear ��� Tivoli Access Manager�, WebSphere Application

Server �� 5.0.2 �� �� ���� adminconsole.ear ��� Tivoli Access

Manager� �� �� ���������.

v Tivoli Access Manager for WebSphere ��� ��� �� ��� ���� �

� �� ��� ���� ������. �� �� ��� ���� Tivoli Access

Manager for WebSphere ��� ��� �����.

�: 31 ���� ��� �� ��� �� ��� ��� �� ��� � � �� �

���� ���� ���.

� ������� �� EAR ��� �� �� ������ ��� ���

� ����. � �� �� ����� ���� �� ��� �� EAR �� �

���� � ����. EAR �� ����� �� �� ��� 53 ���

� � 4 � ��� � ������ ������.

�� ��� �� ����� ���� ����.

�� ��� �� �� ���� ����.

v �A-1�: Access Manager Java Runtime Environment ���

v 49 ���� �A-2�: �� ��� ���

A-1�: Access Manager Java Runtime Environment ��

Access Manager Java Runtime Environment ���� ���� IBM WebSphere

Application Server� ��� Java ���� ������.

�: Tivoli Access Manager for WebSphere ����� Access Manager Java

Runtime Environment� �����.

Access Manager Java Runtime Environment� Tivoli Access Manager �� ��

GUI ����, ����� pdjrtecfg ��� ���� ��� � ����. Access

Manager �� �� GUI�� Access Manager Java Runtime Environment ��

��� ��� ������.

�� 6. �� Tivoli Access Manager for WebSphere ���� �� �� ���

48 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 67: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

1. �� ��� ���� ������.

v UNIX ��� - /opt/PolicyDirector/bin

v Windows ��� - C:\Program Files\Tivoli\Policy Director\bin

2. �� ��� ������.

pdconfig

Java ���� ��� � �� Access Manager �� ��� ����.

����� Access Manager Java Runtime Environment ���� ����� �

�� ������.

1. �� �� WAS_HOME� IBM WebSphere Application Server � ����� ��

�� ��� ������.

2. �� ��� ���� ������.

v UNIX ��� - /opt/PolicyDirector/sbin

v Windows ��� - C:\Program Files\Tivoli\Policy Director\sbin

3. �� ��� ������.

v UNIX ��� - pdjrtecfg -action config -java_home $WAS_HOME/java/jre

v Windows ��� - pdjrtecfg -action config -java_home

%WAS_HOME%\java\jre

�: PATH ��� �� ���� java 2� ��� pdjrtecfg � -java_home

pathname� ���� java 2� ��� ����� ������.

A-2�: �� ��� ��

�� �� ������.

1. WebSphere Application Server ������.

2. �� �� ������.

v Tivoli Access Manager for WebSphere ����� �� ID� ���

�� ��� ��. �� ����� ID� pdperm2admin� �����. ��

� ��� � � ����.

�: Tivoli Access Manager �� ����� �� ID ���� � ID

�� � ����. ���� ��, ��� ����� �� �� �� Tivoli

Access Manager for WebSphere ���� ��� � �� ID

�� ����.

v sec_master ��� �

v Policy Server ��� ���� ��� ��� ��

(�: pdmgrserver.mysubnet.ibm.com)

� 3 � �� �� 49

Page 68: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v Authorization Server ��� ���� ��� ��� ��

(�: pdacldserver.mysubnet.ibm.com)

3. WAS_HOME �� ��� WebSphere Application Server �� ���� ���

�� ���� WebSphere_install_directory/bin�� ��� �� ���

������.

UNIX

setupCmdLine.sh

Windows

setupCmdLine.bat

4. UNIX ���� PDWAS_HOME �� ��� Tivoli Access Manager for WebSphere

�� ���� ������. Windows ���� PDWAS_HOME� �� �

�� �����.

UNIX

PDWAS_HOME=/opt/amwasexport PDWAS_HOME

5. �� ��� ���� ������.

v UNIX ��� - /opt/amwas/bin

v Windows ��� - C:\Program Files\Tivoli\amwas\sbin

6. ��� ���� �� ��� ��� ��, ��� �� WebSphere

Application Server� ��� �� -action configWAS4 �� configWAS5

��� ���� �� ��� � ���� ���� ������.

pdwascfg -action configWASversion_number-remote_acl_user pdperm2admin-sec_master_pwd myPassWord

-pdmgrd_host pdmgrserver.mysubnet.ibm.com -pdacld_host pdacldserver.mysubnet.ibm.com-was_home c:\WebSphere\AppServer[-amwas_home location_of_the_amwas_installation]

7. pdwascfg ��� PdPerm �� �� ���� ������.

v Solaris, Linux, HP-UX

/opt/WebSphere/AppServer/java/jre/PdPerm.properties

v AIX

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

v Windows

– WebSphere Application Server �� 4.0.6

C:\WebSphere\AppServer\java\jre\PdPerm.properties

– WebSphere Application Server �� 5.0.2

C:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties

50 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 69: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: �� �� ����� WebSphere Application Server� �� �� ����

���� ��� �����. ���� �� ��� ��� ��, �� ��

� ��� ������.

� 3 � �� �� 51

Page 70: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

52 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 71: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 4 � �� �� ������

Tivoli Access Manager for WebSphere� �� � �� Tivoli Access Manager

�� ���� ���� ���� ���� �����. � ��

WebSphere ���� �� ������� �� �� Tivoli Access Manager �

� ��� ���� �������. � ���� ���� ���� ��� �

�����.

� �� �� �� ���� ����.

v ��� �� ������ ���

v 58 ���� ����� ���� �����

v 59 ���� ���� � �

�� �� �������� ��

31 ���� � 3 � ��� ���� ��� �� Tivoli Access Manager for

WebSphere� �� ��� ��� �� ��� ������.

J2EE ���� �� �� Tivoli Access Manager for WebSphere� ���

���� �� �� ������.

1. UNIX ���� root� ������ Windows ���� �� �� �� �

�� ������� ������.

2. ���� ���� ����� ��� ����� �� ������ �

��� ���. �����, ���� ���� ���� DTD � ���

�� URL ��� �� ����. ��� �� ����� DTD ����� �

��� ��� ���. ��� ���� ���� ���� �� �� ��, DTD

� �� ��� ������. � ��, �� ������ �� DTD ���

� ������.

3. WAS_HOME �� ��� WebSphere Application Server �� ���� ���

�� ���� WebSphere_install_directory/bin�� ��� �� ��

� ������.

UNIX

setupCmdLine.sh

Windows

setupCmdLine.bat

© Copyright IBM Corp. 2002, 2003 53

Page 72: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

4. UNIX ���� PDWAS_HOME �� ��� Tivoli Access Manager for

WebSphere �� ���� ������. Windows ����

PDWAS_HOME� �� ��� �����.

UNIX

PDWAS_HOME=/opt/amwasexport PDWAS_HOME

5. ���� ����� �� �� ���� ���� � ��� �� ��

������.

v ����� EAR �� ��. � ��, ��� ����.

– Solaris, Linux, HP-UX

- WebSphere Application Server �� 4.0.6:

/opt/WebSphere/AppServer/installedApps/secureApp.ear

- WebSphere Application Server �� 5.0.2:

/opt/WebSphere/AppServer/installedApps/cellname/secureApp.ear

– AIX

- WebSphere Application Server �� 4.0.6:

/usr/WebSphere/AppServer/installedApps/secureApp.ear

- WebSphere Application Server �� 5.0.2:

/usr/WebSphere/AppServer/installedApps/cellname/secureApp.ear

– Windows

- WebSphere Application Server �� 4.0.6:

c:\WebSphere\AppServer\installedApps\secureApp.ear

- WebSphere Application Server �� 5.0.2:

c:\Program FilesWebSphere\AppServer\installedApps\cellname\secureApp.ear

v PDPerm.properties �� ��. � �� WebSphere Application Server

�� ���� ��� ����. �� ����� � ���� �� �� �

� �� ��.

�: � ��� URI(Uniform Resource Indicator)� ���� ���.

– Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

– AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

– Windows

- WebSphere Application Server �� 4.0.6:

54 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 73: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

- WebSphere Application Server �� 5.0.2:

file:/c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties

v Tivoli Access Manager �� ��� ��. � ��� sec_master�� ��

�.

v sec_master ��� �.

v WebSphere �� �� ��� ��. � ��� Tivoli Access Manager for

WebSphere� �� �� � �� ��� ��� ���. � ��, ��

� ����.

wsadmin

v Tivoli Access Manager Policy Server� WebSphere Application Server�

�� �� ���� LDAP �� ��(DN) ���. �� wsadmin ��

�� � ���� DN ���� ��� ���.

32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��� ��� �� DN� ���� wsadmin� �� �

���.

cn=wsadmin,o=ibm,c=us

� ��, DN ���� o=ibm,c=us� ����.

� �� migrateEAR ����� -d �� ��� ��� ���.

�: pdadmin� ���� �� ���� wsadmin� �� DN� �� �

����.

pdadmin> user show wsadmin

v ����� ��� ����. ���� �� � �� ���

WebSphere �� � ���� ��� ��� � ����. � ���

�� EAR �� ��� ����. � ��� ���� EAR �� �

��� �� ��, ��� �� ���� ����. WebSphere Application

Server �� �� �� ����� ��� ����� -e �� ��

����.

6. �� � ����� EAR �� ��� ������. EAR ��

� ��� � ��� �� ��� ��� ������. �� � ��� �

�� ���� ���, ����� ������.

EAR � ��� �� ����� IBM WebSphere Application Server ��

������.

7. ���� ����� ��� ���� ������.

v UNIX ��� - /opt/amwas/bin

� 4 � �� � ���� 55

Page 74: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v Windows ��� - C:\Program Files\Tivoli\amwas\bin

8. ���� ���� ���� ���� ��� ��������.

�� ���� ���� ��� ���� �� ����� � ���� ��

�� ��� ������.

WebSphere Application Server �� 4.0.6� � :

UNIX

migrateEAR4-j /opt/WebSphere/AppServer/installedApps/your_application.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties[-e application_name]

AIX�� PdPerm.properties �� �� ��� ��� ����.

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR4 -j \WebSphere\AppServer\installedApps\your_application.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties[-e application_name]

56 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 75: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

WebSphere Application Server �� 5.0.2� � :

UNIX

migrateEAR5-j /opt/WebSphere/AppServer/installedApps/cellname/your_application.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties[-e application_name]

AIX�� PdPerm.properties �� �� ��� ��� ����.

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR5-j "c:\Program Files\WebSphere\AppServer\installedApps\cellname\your_application.ear"-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties[-e application_name]

���� �� � �� ���� ����. ����� ��� ����� �

���� ������ �� pdwas_migrate.log �� �����. �� policy

� ����� � �������� ����� �� �� �����

�. �� �� ��� ���, ��� �� ���� ��� �� ��

��� � ���� �� �� ������.

����� ��� ��, � URI(Uniform Resource Indicator) -c �

� ����� � � ��� -j �� ����� ������.

9. Tivoli Access Manager� ������� �� � ��� �� ��

EAR(Enterprise Archive) �� �� �� ������.

� �� ������ �� ��� �� J2EE ����� � ����

���� ��� ��� ����.

�: � EAR �� ���� ���� � �� ������. � �

� EAR � ��� �� ��, ��� ���� ���� ���

��� ����. ���� ����� Tivoli Access Manager ���

� ��� ����� ���.

10. �� �� � �� ����.

v WebSphere Application Server Advanced Edition Single Server ���

� ��, �� �� ������.

v WebSphere Application Server Single Server Edition� ���� �� ��,

����� �����. �� �� ���� ���.

11. WebSphere Single Server Edition� Tivoli Access Manager for WebSphere

��� �� pdadmin� ���� ���� ����� �� ACL� �

� 4 � �� � ���� 57

Page 76: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ��� ��� ���. �� ���� pdadmin �� ��� �

���� ���� ������ ����.

�� 83 ���� � 6 � ����: �� �� ���� ���� �� ���

�� ACL� �� ���� ��� ��� �� ����. Tivoli Access

Manager� ���� ���� �� �� �� ��� ������.

������ ���� ����

���� ����� ����� ��� ����.

v ���� ����� EAR �� �� Tivoli Access Manager �� ��

� ���� ������ ��� �������. ���� ����

� �� ����� ���� ���. EAR �� ����� �, Web

Portal Manager �� pdadmin ���� ���� �� ������.

v ���� ����� EAR �� ��� ��� �� �������.

����� � EAR �� ��� ��� ������.

v EAR �� � ���� ����� � � ��� ��, EAR �� �

�� � � ���� ���� �� �� ����. EAR� ��� �� ��

� ���� ����� � �� ����� � �� ���� ��� �

����.

– � �� �� � ��� ������, �� �� EAR�� �� ��,

�� ��� ���� ��� ����.

– � �� �� � ��� ������, EAR �� ����� ����

����� Tivoli Access Manager� ACL �� ����� ��� �

��. Tivoli Access Manager� ACL �� ��� � �� ��� ����.

EAR �� Tivoli Access Manager �� ��� ���� �����

��, ���� ��� ACL� ���� �� ������. ��� �

�� ACL �� �� �� ���� ��� ��, Tivoli Access Manager�

ACL� ��� �� ���. ��� ���� ���� �� ����

�� ��� ���� �� ���� � ��, ACL� ��� � ���

�.

v pdadmin� ���� �� ������. pdadmin� ���� �� ��� �

����.

v WebSphere Application Server Advanced Edition Single System Edition�

���� ���� ��� �� ���� ����� �� ACL� ��

��� ��� ���. � ����� WebSphere Application Server

Advanced Edition� �� �� ����.

pdadmin� ���� �� ALC� ������. �� ��� ��� �� 91

���� �8�: ����� Tivoli Access Manager� ����� �� �

58 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 77: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� �� � ����� �� ACL� �� ���� ��� �� �

�. � pdadmin ��� � ���� ���� ��� ���.

c:> pdadmin -a sec_master -p myPasswordpdadmin> acl list(Find the ACL that starts with _WebAppServer_deployedResources_GoodGuys_)

pdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_simpleSessionApp_ACLadd user user1 T[WebAppServer]ipdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_simpleSessionApp_ACLadd user user2 T[WebAppServer]ipdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_simpleSessionApp_ACLadd user user3 T[WebAppServer]ipdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_simpleSessionApp_ACLadd user user4 T[WebAppServer]ipdadmin> exit

��� � �

� �� ��� �� ���� ����.

v ��� � ���

v 60 ���� � �� ACL� ��� ���� ���

v 60 ���� ���� ��� ���� Windows ��� ����� ����

v 60 ���� �Web Portal Manager� ���� ACL� ��� � ���

v 60 ���� �[...] ��� pdwas-admin� ����� ���

v 60 ���� �� ��� ���� �� ���

v 61 ���� ����� ���� ���� � �� ��� ���

�� � ��

���� ����� ���� �� ��, WebSphere � Tivoli Access Manager

� ���� �� �� ������.

v Tivoli Access Manager Authorization Server� ��� ������. �� ��

� �� ���� ���� ���� �� ���� � �� �� �����.

Tivoli Access Manager � ����� ��� ��� �� ��� � ��

�� ����� �� ������. �� � ��� WebSphere ��� �� ��

� ������. �� ��� IBM Tivoli Access Manager Base Administration

Guide ������.

v ���� ����� � pdwas_migrate.log �� �����. � �

� ���� ����� ���� ����� ����. ����� ����

����� �� � ���� ��� ��� ��� ��� �����.

��� ���� �� ��� ��� �� ����.

� 4 � �� � ���� 59

Page 78: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� ACL� ���� ���� ��

���: admin.ear �� �� ��� � � ��� ����. �����,

�� ACL� ��� ���� ����.

�: pdadmin� ���� pdwas-admin ��� ACL� ������. �� ��

� � ���� ���� ������.

pdadmin> acl modify _WebAppServer_deployedResources_AdminRole_admin_ACLset group pdwas-admin T[WebAppServer]i

��� �� ���� Windows ��� ���� ���

���: ���� ����� �� �(~)� �� �� � ����� ��

����. � �� Windows ��� � ��� ����� � ��� ��� �

����.

�: � ��� �� �� �(~) ������.

Web Portal Manager� ����� ACL� ��� � ��

���: Web Portal Manager� �� �� ��� ��� �� ���� ACL

� ��� � ����.

��: pdadmin� ���� ACL� ������.

�: ���� ���� ���� ��, �� ������ ��� ��� �

� ��� ������. ���� ��� �� ��� ���.

[...] ���� pdwas-admin� ��� � ��

���: ���� ����� ��� �, �� wsadmin� pdwas-admin ��

� ����� ��� � ���� �� � ����.

�: � � ��� �� ����� �����. � � � ��� �� �

� pdwas-admin ��� ����� ���� ��� � � �� �� ��� �

� �� ��� ���� ��� � ��� �� ����.

�: pdwas-admin ��� ���� WebSphere �� � �� Tivoli Access Manager

Web Portal Manager � ��� � ����.

� ��� ���� �� ���

���: Tivoli Access Manager� Tivoli Access Manager Policy Server� �� �

�� �� SSL ���� �� �����. ���� ���� �� � �� ��

� ��, �� ���� �� � ����.

��� ����� �������� ��� ����.

60 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 79: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: � ���� ���, -tminutes �� ���� �� ���� ���

� ������. ���� ����� ��� 60�� �����. � �� �

API ����� Policy Server ��� �� SSL ���� ��� �� ����.

Tivoli Access Manager �� � ivmgrd.conf� [ssl] �� ��� ��

ssl-v3-timeout ��� ���� SSL ���� �� ��� � ����.

ssl-v3-timeout� ���� 7200�(120�)���. � ���� ����, ����

���� -t ��� ��� SSL ���� �� �� 60���� ���.

�� ��� IBM Tivoli Access Manager Base Administration Guide ����

��.

��� ���� ���� �� ��� ���� ��

���: ��� ������ �� �� �� ��, Tivoli Access Manager for

WebSphere ���� �������� ���� Windows ����� �

��� ����.

��: DOS Windows �� �� ������.

1. DOS �� ����� �� ��� ������.

MSDOS> chcp 1252

2. DOS � ���� �� �� ����.

3. Lucida ��� ����.

Lucida �� ���� �����.

4. ��� ����. ��� ��� �� �� ��� �� �� ���

���.

5. �� ���� ������ ��� � � ����.

� 4 � �� � ���� 61

Page 80: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

62 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 81: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 5 � �� ���

� �� ��� �� ���� ����.

v �WebSphere Advanced Edition Single Server �� 4.0.6�

v 64 ���� �Tivoli Access Manager �� ���

v 64 ���� ���� �� ���

v 69 ���� ��� ��� ��� ���

v 68 ���� ��� Authorization Server ���

v 70 ���� �GSO ����(��) �� ���

v 75 ���� �Tivoli Access Manager for WebSphere ���

v 77 ���� �WebSEAL� ���� WebSphere Application Server� �� ��

��

v 80 ���� ���� � �

v 82 ���� �Tivoli Access Manager for WebSphere � ��

WebSphere Advanced Edition Single Server �� 4.0.6IBM WebSphere Application Server� �� �� ���� Advanced Edition �

�� �����. � ��� WebSphere �� �� ������ �� ��� �

� ���� ����� �������.

� WebSphere Application Server ��� ����� ��� ��������

WebSphere Application Server �� � ��� ���� � � �����.

WebSphere ��� ��� ����� ��� � ����.

Tivoli Access Manager� ��� �� �� ����� ��� �����. Tivoli

Access Manager WebSphere Advanced Edition Single Server� �� ��� �

�, Tivoli Access Manager ��� WebSphere ��� ���� �� ��

��� �� �� ����� ��� �� ���. �, �� ������

�� �� ��� �� ���.

��� ��� ���� Tivoli Access Manager �� ������ � �� �

�, Tivoli Access Manager �� ID� ��� �� ID� ��� ��� �

� ������. Windows ����� � ID� ��� ��� ���� ����.

�� Tivoli Access Manager for WebSphere ���� ���� WebSphere

Advanced Edition Single Server� �� ��� ��, �� ACL� ���

© Copyright IBM Corp. 2002, 2003 63

Page 82: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ���� ���� �� ������. ��� �� ��� ��� �

��. �� ��� 58 ���� ����� ���� ������ ������.

��� ����� WebSphere Advanced Edition Single Server� �� Tivoli

Access Manager for WebSphere ���� �� ���� ����.

17 ���� ��� ����� ������ ������.

Tivoli Access Manager �� ��

��� � ��� ���� � WebSphere Application Server �� ����

���. � � ����� Tivoli Access Manager policy ������ ��

� ����.

�� Tivoli Access Manager �� �� � �� ���� �� � � �� �

� �� ��� ���.

v pdadmin ��� ����

v Tivoli Access Manager Web Portal Manager ��� �� �����

�� Tivoli Access Manager� �� ��� ����� ���� � ��� �

�� �� API �����.

Tivoli Access Manager �� ��� �� �� ��� �� ��� �����

�.

v pdadmin � ��� �� ������ ��� IBM Tivoli Access Manager

Base Administration Guide ������.

v ��� API� ��� IBM Tivoli Access Manager for e-business Administration

C API Developer Reference �� IBM Tivoli Access Manager for e-business

Administration Java Classes Developer Reference ������.

�� �� ��

Tivoli Access Manager for WebSphere��� �� ���� �� �� Java �

� �� �����. �� �� pdwascfg ���� ���� � ����

�, � �� � �� ���� �� ��� ��� � ����.

Java �� �� �� ��� �� ���.

v UNIX: WAS_HOME/etc/PDWAS.properties

v Windows: WAS_HOME\etc\PDWAS.properties

�� ���� �� ��� ���� ��� � �����.

v 65 ���� ��� � �� ���

64 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 83: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v ��� � ���

v �� � ���

v 66 ���� �� �� policy ����� ����

�� � �� ��

�� � �� ��

com.tivoli.pd.as.cache.StaticRoleCache=com.tivoli.pd.as.cache.StaticRleCacheImpl

�� � �� �� ��

�� � �� �� �� �� ��� ���. �� � �� ���� ��

������.

com.tivoli.pd.as.cache.EnableStaticRoleCaching=true

�� � ��

�� �� WebSphere ��� �� WebSphere Application Server admin.ear �

� adminconsole.ear �� ���� �� �� �� �� �����.

com.tivoli.pd.as.cache.StaticRoleCache.Roles=Administrator,Operator,Monitor,Deployer

�: ���� ��� �� �(CosNamingRead, CosNamingWrite ,

CosNamingCreate, CosNamingDelete)� ���� �����.

�� � ��

� ���� �� ��� � �����.

v �� � �� ���

v �� � �� �� ���

v 66 ���� �� �� � ���

v 66 ���� ����� �� ���

v 66 ���� �� �� ���

v 66 ���� ��� ��� � ���

�� � �� ��

com.tivoli.pd.as.cache.DynamicRoleCache=com.tivoli.pd.as.cache.DynamicRoleCacheImpl

�� � �� �� ��

� � �� �� �� �� �� ��� ���. � � �� ���

� �� ������.

com.tivoli.pd.as.cache.EnableDynamicRoleCaching=true

� 5 � �� ��� 65

Page 84: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ��� � ��

�� ���� �� ��� ���� � �� �. � � �� ��� �

� ���� �����. �� �� �� 100000����.

com.tivoli.pd.as.cache.DynamicRoleCache.MaxUsers=100000

��� �� ��

��� ���� ��� ���� ��(�). � � �� ��� � � ���

� �����. �� ��� 10����.

com.tivoli.pd.as.cache.DynamicRoleCache.PrincipalLifeTime=10

��� ������� ��� � LDAP ����� ��� Tivoli Access Manager

� �� �����.

� �� ��

�� �� ���� �� �� � ��� �� ���� ��(�). �

� �� ��� � � ���� �����. ���� 20����.

com.tivoli.pd.as.cache.DynamicRoleCache.RoleLifetime=20

�� �� � ��

� � ���� ����� ���� ��� �. � � �� ��� � �

���� �����. ���� 20���.

��� ���� �� ��� ��, �� ��� �� ��� ���� ����

��.

com.tivoli.pd.as.cache.DynamicRoleCache.NumBuckets=20

� �� policy �� �� ���

Tivoli Access Manager for WebSphere � �� policy ����� ���� Tivoli

Access Manager for WebSphere �� � pdwascfg ����� � �� ��

���. � � ��� ��� ��� � ����. �� ����� � ��

� �����.

v com.tivoli.pd.as.rbpf.AmasSession.AMGroup=amgroup-admin

� �� ���� � ��� �� ��� � �� ��� �� ��� ��

���. � �� ��� �� ���� ���� � ����. ����

amgroup-admin���.

v com.tivoli.pd.as.rbpf.AMAction=i

66 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 85: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� ��� �� �� ���� ������ ��� � Tivoli

Access Manager for WebSphere ��� � ���� ���� �����. �

�� Tivoli Access Manager ACL� �����. �� � ��� �� ��

���� ����.

v com.tivoli.pd.as.rbpf.AMActionGroup=WebAppServer

� ���� ���� �� � Tivoli Access Manager for WebSphere �

���� �����. AMAction ��� ���� ��� ����� ���� Tivoli

Access Manager �� �����.

v com.tivoli.pd.as.rbpf.PosRoot=WebAppServer

� ���� ���� �� � Tivoli Access Manager for WebSphere �

���� �����. � ���� �� ��� ��� ��� �� ����

� �����.

v com.tivoli.pd.as.rbpf.ProductId=deployedResources

� ���� ���� �� � Tivoli Access Manager for WebSphere �

���� �����. � ���� �� ��� ��� ��� �� ����

� �����. ���� deployedResources���.

v com.tivoli.pd.as.rbpf.ResourceContainerName=Resources

� ��� Tivoli Access Manager for WebSphere� ����� ��� ��

����� ���. ���� Resources���.

v com.tivoli.pd.as.rbpf.RoleContainerName=

� ���� Tivoli Access Manager for WebSphere ����� �����. �

���� � ���� ��� ��� �� ����. � ���� �� �

�� ��� ��� �� ���� � �����. �� ��� ��� ��

� ���� ��� �� ��� ����� ���� �� ����. � ��

�� �� ���� ��� �� ����� ���� ����� ����

� ���� ��� ���.

v com.tivoli.pd.as.rbpf.GrantUnprotectedAccess=true

� ��� Tivoli Access Manager for WebSphere� ����� ��� ��

� ����� ���. ���� true���.

v com.tivoli.pd.as.rbpf.UseEntitlements=false

WebSphere Application Server� �� ���� Tivoli Access Manager for

WebSphere� ������ ��� ��� �� �� �� �� ��� ���.

true� ������. ������ ���� ���� � ���� �� ��

ACLD� �� URL�� ����� ���. ���� false���.

v com.tivoli.pd.as.rbpf.AmasSession.CfgURL=

pdwascfg ����� ����� � ��� -cfg_url � WebSphere ��� ��

� ��� �� �����.

� 5 � �� ��� 67

Page 86: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v com.tivoli.pd.as.rbpf.AmasSession.LoggingURL=

file:/c:\WebSphere\AppServer\etc\jlog.properties

� ��� �� �� � Tivoli Access Manager for WebSphere �� ��� �

� �����.

v com.tivoli.pd.as.rbpf.AmasSession.AMName=

� �� Tivoli Access Manager for WebSphere �� �� �����. pdwascfg

�� �� � -remote_acl_user ����� �� �����.

�� Authorization Server ��

Tivoli Access Manager �� ����� � ��� Authorization Server� �

�� �� ����. � Authorization Server� ��� ��� � �� ��� �

�� � ����.

v ��� Authorization Server ��� � �� ��� �� �� ��

v ��� � ��� �� � ��� �� ��

Tivoli Access Manager for WebSphere� � Authorization Server� �����

� ��� � ����. Java ��� com.tivoli.pd.jcfg.SvrSslCfg ����

Authorization Server ������. �� ��� ��� ����.

java com.tivoli.pd.jcfg.SvrSslCfg -action addsvr-authsvr host_name:port_number:rank -cfg_file cfg_file

�: � ��� � ���� ���� ������.

7. Authorization Server ���� �� �� ���

��� ��

-action addsvr �� �� ���� �� �� �� �����.

-authsvr Tivoli Access Manager Authorization Server. �� ��� ��� ���

�.

v host_name

��. Authorization Server� �� ��� ���� ��

v port_number

�� �. Authorization Server� ��� � �� ��

v rank

�� �. �� Authorization Server� ���� � Authorization Server

� � ��. ���� ��� ��� �� � �� �� � �

�� ��� � ��, ��� � Authorization Server� �� ��

���. �� ��� �� ��� �����.

68 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 87: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

7. Authorization Server ���� �� �� ��� (��)

-cfg_file cfg_file ���� ��(Tivoli Access Manager for WebSphere) �� �. �

� �� PdPerm.properties���. URI(Uniform Resource Indicator)

� �� ������. WebSphere Application Server� �� ���

����, �� ��� ��� ����.

v Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

v AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

v Windows

– WebSphere Application Server �� 4.0.6:

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

– WebSphere Application Server �� 5.0.2:

file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

��� ��� ��� ��

WebSphere Application Server �� ���� WebSphere ���� ���� �

���� �� policy ��� � ����. �� WebSphere Application Server

�� �� ����� ��� ���� ��, �� �� �� policy ��

� �� ����.

Tivoli Access Manager� ��� ��� accessGroup� �� ������ �

����. Tivoli Access Manager ��� pdadmin ��� ���� Web Portal

Manager ���� � ��� �� � ����. � � � ��� ��� ��

� accessGroup� �����.

WebSphere Application Server �� ����� accessGroup ���� ���

�� ����� ���� ����� ���� �����. WebSphere

Application Server �� ���� �� ����� ��� ���� ��� �

�� ��� � ��� ��� ��� � ����.

�� ����� ������.

1. WebSphere Application Server� �� �� �� �� � ����.

2. WebSphere ��� ��� ���� �� � ��� �������. WebSphere

Application Server �� 5.0.2� ��, �� ��� �� → �� ����� →

LDAP → � LDAP �����.

3. �� �� �� ������. �� ��� ������.

� 5 � �� ��� 69

Page 88: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

(objectclass=accessGroup)

� ��, �� �� ��� ��� ����.

(&(cn=%w)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=accessGroup)))

4. �� ��� ID �� ������. �� ��� ������.

accessGroup:member

� ��, �� ��� ID ��� ��� ����.

groupOfNames:member;groupOfUniqueNames:uniqueMember;accessGroup:member

5. �� ���� �� WebSphere Application Server ��� � �� � �

���.

GSO ����(���) �� ��

Tivoli Access Manager for WebSphere� WebSphere Application Server �� �

��� �� WebSphere Enterprise Information Systems(EIS)(�: �����, �

�� �� ��� � ��� ��� ���)� �� ����� ��� � ���

�. EIS �� ���� �� �� J2C �� GSO ����(��) � JAAS

��� � � ���� Tivoli Access Manager for WebSphere�� ������.

�� �� ��� � � � �� JAAS Subject� ��� � ���� �

� EIS� ��� � �����. ��� JAAS ��� � � ��� � ���

���� �����. ����(��) �� � � �� WebSphere Application Server

����� XML �� ��� �� �� � � �� �����. Tivoli Access

Manager for WebSphere� XML �� �� ��� � �� ��� , ��

Tivoli Access Manager GSO ����� ���� EIS �� ��� � ��

�����.

WebSphere Application Server� �� � �� EIS �� ���� ��

����(��) �� � � �����. �� �� � � �� → JAAS �� → �

����� ����� WebSphere Application Server �� �� ���� ���

�. �� � ��� DefaultPrincipalMapping���. EIS �� ���� �� �

� ID � �� authDataAlias ��� � �� ��� ��� ���� ����.

authDataAlias ���� ��� �� ��� �� ���� �� ����.

authDataAlias ���� �� �� ���� ���� �� �� ��� � �

��� ��� �����.

Tivoli Access Manager ����(��) �� � � authDataAlias ���� Tivoli

Access Manager GSO ������ �� ��� ���� � ��� GSO �

70 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 89: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� � �� ��� �����. � � � ������� GSO ��� ���

� Tivoli Access Manager Policy Server� �����.

Tivoli Access Manager� �/�� �� � ��� � �� Tivoli Access

Manager GSO ������ �����.

� ������ ��� ��

��� � �� ���� � Tivoli Access Manager GSO ����� �

��� � ����� ���� ���� ��� ������.

1. �� → JAAS �� → ������ ���� ����. �� �� �� �

� JAAS ��� ��� �����.

2. � ���� ���� �� ��� ������. ��� �����.

3. �� �� �� ��� JAAS ��� � �� � JAAS ��� � � �

�����.

4. �� ��� �� JAAS ��� � � ������.

�� 7. GSO ����(��) �� ��.

� 5 � �� ��� 71

Page 90: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

com.ibm.ws.security.common.auth.module.proxy.WSLoginModuleProxy

��� �����.

5. �� �� �� ��� ��� �� �� �� � �� ��� � � ��

���� ��� � �� �� ������.

6. �� ��� �����.

Tivoli Access Manager ����(��) �� � � �� ��� authDataAlias

���� �� ���� ��� �� ��� � �����.

� � ��� authDataAlias� J2C ConnectionFactory� � �����.

authDataAlias� �� � ��� ��� ����� �� ����� �����.

v authDataAlias�� GSO � ��� �� ��� �� �����. � �

�� ��� ″�/��″���.

v authDataAlias�� GSO � ��� �����. �� ��� �� ��

�� ���� �����.

JAAS �� �� �� ��� ���� �����. �� �� �� ��

��� ��� ����.

��: com.tivoli.pd.as.gso.AliasContainsUserName

�: ��� �� ��� ��� �� true, �� ��� �� ������ �

�� �� �� false.

authDataAliases WebSphere Application Server �� � ���� �� �

�� �� ���� �� �����. JAAS �� ��� � �� ��� �

��� ��� �� � ��� ��� ����� ��� �����.

��: com.tivoli.pd.as.gso.AliasContainsNodeName

�: ��� �� ��� ��� �� true.

7. �� ���� ��� ��� ��� ������.

���� 1:

Auth Data Alias BackendEIS/eisUser

� BackEndEIS

�� eisUser

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapper

com.tivoli.pd.as.gso.aliasContainsUserName true

com.tivoli.pd.as.gso.aliasContainsNodeName false

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

���� 2:

Auth Data Alias BackendEIS

72 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 91: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� BackEndEIS

�� �� �� WAS ��

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapper

com.tivoli.pd.as.gso.aliasContainsUserName false

com.tivoli.pd.as.gso.aliasContainsNodeName false

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

���� 3:

Auth Data Alias nodename/BackendEIS/eisUser

� BackEndEIS

�� eisUser

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapdelegateper

com.tivoli.pd.as.gso.aliasContainsUserName true

com.tivoli.pd.as.gso.aliasContainsNodeName �

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

���� 4:

Auth Data Alias nodename/BackendEIS/eisUser

� nodename/BackEndEIS(�� ��� ��� ���� ��)

�� eisUser

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapper

com.tivoli.pd.as.gso.aliasContainsUserName true

com.tivoli.pd.as.gso.aliasContainsNodeName false

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

���� 5:

Auth Data Alias nodename/BackendEIS

� BackEndEIS

�� �� �� WAS ��

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapper

com.tivoli.pd.as.gso.aliasContainsUserName false

com.tivoli.pd.as.gso.aliasContainsNodeName true

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

���� 6:

Auth Data Alias nodename/BackendEIS/eisUser

� nodename/BackendEIS/eisUser(�� Auth Data Alias ��� �

�).

� 5 � �� ��� 73

Page 92: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� �� �� WAS ��

����(���) � ���

��: �:

delegate com.tivoli.pd.as.gso.AMPrincipalMapper

com.tivoli.pd.as.gso.aliasContainsUserName false

com.tivoli.pd.as.gso.aliasContainsNodeName false

com.tivoli.pd.as.gso.AMLoggingURL file:///<jlog.props.path>

�� J2C � ��� �� ��� ����. Tivoli Access Manager� �� �

� � � ����� � � �� ��� ��� �� �� � �� ��� �

���. � � J2C � ��� ��� �� ��� �� ��� J2C �� �

��� � � � ��� ��� ��� ����.

WebSphere Application Server ��� J2C � ��� ���� �� → J2C

�� ��� � � ��� � �� �� �� �����. ���� ��

� ��� �� �� ������.

GSO ����� ��� �� � � ���� �� ���� Tivoli Access

Manager ����(��) �� � � ����� ����� ���. �� �� �

�� ��� ������.

1. WebSphere Application Server ��� ������ → ����� ����

��� ����.

2. ����� ��� �����.

3. ����� ���� ��� � ��� �� � ��� ��� ��� �

�� �����.

4. .rar �� �����.

5. ��� � ��� �� �� �� �� ��� �� ��� �� �����.

�: � ���� ������ ���� ��� ���. ���� � ���

�. � � ����� �� � ���� �� → �� ����� ����

�.

6. ��� � ��� �� �� �� �� ��� J2C � ��� �� ���

��.

7. �� ��� �� �� ��� �� �� ������.

GSO ����(��) � � � �� Tivoli Access Manager for WebSphere �

��� ������. � �, pdwascfg �� �� �� �� �

(�: JAVA_HOME/PdPerm.properties � PDWAS_HOME/etc/jlog.properties)� �

����. Tivoli Access Manager for WebSphere ���� � GSO ����

74 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 93: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

(��) �� � � ����� SvrSslCfg � jlog.properties.template �

� ��� ���� �� �� PdPerm.properties �� jlog.properties

� ��� ��� ���.

Tivoli Access Manager for WebSphere ��

Tivoli Access Manager for WebSphere ��� � �� ��� WebSphere Application

Server SystemOut.log �� �����. � �� $WAS_HOME/logs/cellname �

���� ����.

Tivoli Access Manager for WebSphere ��� Access Manager Java Runtime

Environment� �� JLog �� ����� �����. �� � ��� � Tivoli

Access Manager for WebSphere ����� � ��� ��� � ����.

� � ����� �� �� � ��� ��� jlog.properties�� ��� ��

� �����. � �� $AMWAS_HOME/etc ����� ����.

� �� ��� ���� ��� ��� ��� � ����.

v � Tivoli Access Manager for WebSphere ����� � ��� �� �� �

� �� ��.

v � Tivoli Access Manager for WebSphere ����� � ��� ��� ��

�� �� �� ��.

jlog.properties �� � �� ″�� ���″� �����. � �� ���

� �� Tivoli Access Manager for WebSphere ����� ���� ����. �

� �� ���� ��� ����.

AmasRBPFTraceLogger

AmasRBPFMessageLogger

� �� policy ������ � ���/��� ����

� �����. Tivoli Access Manager for WebSphere� �

�� ��� ��� � ���� �� ��������.

AmasCacheTraceLogger

AmasCacheMessageLogger

� �� policy ������� ��� policy ��� �

���/��� ���� � �����.

AMWASWebTraceLogger

AMWASWebMessageLogger

WebSphere Application Server � ��� � ��

�/��� ���� � �����. ���� ��� �� �

����� ���� �� ��� ���.

� � �� ���� ��� ��� WebSphere Application Server �� ��

����� ������. ��� ��� �� �� �� ���� WebSphere

Application Server ��� SystemOut.log �� �����.

� �� ����� jlog.properties �� � Tivoli Access Manager for

WebSphere ����� ��� �� ��� ��(true� ��� ��) isLogging �

�� �����. false �� ���� � ���� ��� � ����.

� 5 � �� ��� 75

Page 94: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

jlog.properties� MessageLogger � TraceLogger�� ″��″ �� ����

�����. �� � �� ����� isLogging ��� ����. ″��″ �� �

��� � isLogging ��� ���� �� ��, � ��� �� �����. Tivoli

Access Manager for WebSphere� ��� ��, isLogging ��� MessageLogger

� ��� true�, TraceLogger� false� �����. �� ��� ��� ���

�� ����� �� ��� ��� �� ����� �� ����� �� ��

���.

Tivoli Access Manager for WebSphere ���� ���� �� � � ����

�.

1. jlog.properties �� ����� �� isLogging ��� ��� �����

� true� ����� ���. � ��, AMWASWeb ���� �����

�� �� jlog.properties� ��� ���.

baseGroup.AMWASWebTraceLogger.isLogging=true

2. WebSphere Application Server ��� PDWAS ����� ��� �� ��

� ����. WebSphere Application Server �� ���� ����� ��

�� �����.

WebSphere �� 5� �

a. �� ����� �� → ������ �� �����.

b. �� �� �����.

c. �� � �� → � ��� �����.

d. �� ���� �� �����.

e. ���� → PDWAS �� ��� �� ��� ����.

f. ��� �����.

WebSphere �� 4� �

a. �� ����� �� → ������ �� �����.

b. �� �� �����.

c. �� � �� �� �� → � �� ��� �����.

d. �� �� ��� ��� ������.

com.ibm.ws.security.PDWAS=all=enabled

e. ��� �����.

�� �� ���� �� ��� � ��� ����� ���� ���. ����

� ����� ��� ��� �� �� � ����.

76 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 95: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

WebSEAL ���� WebSphere Application Server� �� ��

Tivoli Access Manager WebSEAL� ��� ��� ���� Tivoli Access Manager

for WebSphere �� ����� �� ��� �� � ��� �� �����.

� � ��� WebSEAL� �� ��� ��� � �� IV � � ���

� WebSphere Application Server� �����. WebSphere Trust Association

Interceptors(TAI)� WebSEAL��� �� iv-user HTTP � �� �� �� �

�� ���� ���� � �� �� � �� � �� �� ���� Tivoli

Access Manager for WebSphere� �����. TAI� �� ��� WebSphere

Application Server �� ������.

�� �� ���� WebSEAL� WebSphere Application Server� � ����

������(�� �� �� ��).

v �1�� -- Tivoli Access Manager�� ���� �� �� ��

v �2�� -- WebSEAL �� WebSphere Application Server� ��

v ��� �� WebSphere Application Server ��� �� 78 ���� �3a��

-- WebSphere Application Server �� 4.0.6� TAI ���� SSO ��� ��

79 ���� �3b�� -- WebSphere Application Server �� 5.0.2� TAI �

��� SSO ���

1�� -- Tivoli Access Manager�� ����� ��� �� ��

TAI� �� ��� ��� �� � ��� WebSphere Application Server ���

�� ��� Tivoli Access Manager �� ������ ���� ��(trusted

user) ��� ��� ����. WebSEAL� WebSphere Application Server�

�� ���� � ���� ID � ����. sec_master ���� ��(trusted

user) ���� ���� � ���� �� ��� ������. ���� �

�(trusted user) ��� TAI ����� ���. Tivoli Access Manager ����

� pdadmin ���� �� ��� ������.

pdadmin> user create webseal_userid webseal_userid_DN firstnamesurname passwordpdadmin> user modify webseal_userid account-valid yes

2�� -- WebSEAL �� WebSphere Application Server� ��

WebSEAL� �� ���� �� �� ID ����� ��� � ��� iv ��

� � TAI� ���� ��� � ���. ���� ��� ��� ���� �

SSL� ��� �� ����. � �� SSL ����� ��� SSL� �

�� WebSphere Application Server� � ������ WebSphere Application

Server � WebSphere Application Server �� ���� HTTP �� ���

���. ���� WebSEAL � ���� �� �� � ��� ���� HTTP

�� � ���� ��� ��� ���� ����.

� 5 � �� ��� 77

Page 96: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

-c iv_user �� ���� WebSEAL �� WebSphere Application Server�

�����. � �� ��� ����(� ��� ��).

server task webseald-server create -t ssl -c iv_user -B-U user -W password -h host_name junction_name -b supply

�:

1. �� �� � � ����� ��� �� � ���� ��� �

� ��� ������ ���� ��� �� �� �� �����.

2. �� ����� �� -t tcp �� -t ssl� �� �� � ����.

WebSEAL �� ID ��� �� �� �� ���� WebSEAL � WebSphere

Application Server ��� �� ���� �� �� � �� WebSphere

Application Server� �� �� �� HTTP ��� �� ��� WebSEAL ��

��� ������.

3a�� -- WebSphere Application Server �� 4.0.6� TAI� ����

SSO ��

TAI� � WebSEAL �� �� �� ����� TAI �� ��

$WAS_HOME/properties/webseal.properties ��� �� ���� ����

�� ������.

v com.ibm.websphere.security.webseal.loginId� 1��� �� �� �� ��

���� �����.

v hostnames � ports ����� WebSEAL ��� ��� �� � ��� ��

���.

v com.ibm.websphere.security.webseal.id� iv-user � � � �����. �, �

�� ����.

com.ibm.websphere.security.webseal.id=iv-user

v �� trustedservers.properties� �� ������.

– webseal� com.ibm.websphere.security.trustassociation.types� ���� �

���.

– Webseal ���� ���� ������ ��� ����(� ��� ��).

com.ibm.websphere.security.trustassociation.webseal.interceptor=com.ibm.ws.securicty.web.WebSealTrustAssociationInterceptor

– �� �� �� ��� ����.

com.ibm.websphere.security.trustassociation.webseal.config=webseal

1. WebSphere �� ��� �� → �� �� ���� �� � � �� ��

��� ���� ������.

2. �� ��� � �� default_host �� ��� ����. �� ��� �

� �����. � ��� *:443�� ������.

78 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 97: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3. WebSphere �� � ����.

3b�� -- WebSphere Application Server �� 5.0.2� TAI� ����

SSO ��

�� ��� �� ��� ��� � �����.

1. �� �� ��� �� → �� ���� → LTPA �����.

2. �� �� �� ���� � ��� �����.

3. � �� �� �� �� ����.

4. �� �� �� ���� ���� �����.

5. com.ibm.ws.security.web.WebSealTrustAssociationInterceptor � WebSEAL

���� ������. � ����� ������.

6. �� �� �� ���� ��� �� �� �� �����.

7. �� ��� � �� �� �� � � � ������. �� ���� ��

�� ��� ������.

v webseal� com.ibm.websphere.security.trustassociation.types� ���� �

�� ������.

v com.ibm.websphere.security.webseal.loginId� 1��� �� �� �� �

� ���� �����.

v com.ibm.websphere.security.webseal.id� iv-user � � � �����. �,

��� ����.

com.ibm.websphere.security.webseal.id=iv-user

v com.ibm.websphere.security.webseal.hostnames� � � � ��� ��

��� ��� �����(���� ��). � ��, ��� ����.

com.ibm.websphere.security.webseal.hostnames=host1

�� com.ibm.websphere.security.webseal.ignoreProxy� true� ���� ��

��� ��� ��� ��(�� ��)� ��� ���. �� ��� server

list pdadmin ��� ���� ��� � ����.

v com.ibm.websphere.security.webseal.ports� � � � ��� �� ��

� ��� �� �� �� �����. �� com.ibm.websphere.security.

webseal.ignoreProxy� true� ���� �� ��� ��� ��(�� ��)

��� ���. � ��, ��� ����.

com.ibm.websphere.security.webseal.ports=80,443

v com.ibm.websphere.security.webseal.ignoreProxy� true �� yes� ���

� IV � � ��� ��� �� � �� ���� � �����. ��

���, � ��� false� ���� ����.

� 5 � �� ��� 79

Page 98: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

8. ��� �����. ��� ��� ��������. WebSphere Application

Server �� � ����.

4�� -- WebSEAL�� SSO �� ��

WebSEAL �� �� webseal_install_directory/etc/webseald-default.conf

��� basicauth-dummy-passwd=webseal_userid_passwd ��� ���

� 1���� �� ��� sso � ������.

WebSEAL� �� � ����.

5�� -- WebSEAL � ���

WebSEAL �� �� WebSphere Application Server� ���� � �

�� ����� WebSEAL� �� ���� ��, �� WebSphere Application

Server� �� �� ���� �������.

��� � �

� �� ��� �� ���� ����.

v ��� � ���� � WebSphere ��� � �� �� �� -- WebSphere

Application Server �� 4.0.6 ���

v 81 ���� ��� � � WebSphere ��� � �� �� �� -- WebSphere

Application Server �� 4.0.6 ���

�� � ��� � WebSphere ��� ���� �� �� --WebSphere Application Server �� 4.0.6 ��

���: Tivoli Access Manager for WebSphere �� �, WebSphere Application

Server� � �� ����.

��: ��� �� � �� ��� �� � ����.

v Tivoli Access Manager for WebSphere �� �, � �� ��� pdwas-admin�

��� ACL� ���� �����.

v Tivoli Access Manager for WebSphere �� �, � �� ��� pdwas-admin�

��� ACL� ������, ACL� �� Authorization Server� ���� ��

���. � ���� � ��� Authorization Server� �� �� ������ �

�� � ����.

�:

���� � �� ��� ����.

80 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 99: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v pdwas-admin� ��� ACL� ���� �� ��, �� ������. �� ACL�

pdwas-admin ��� ���� ��� 39 ���� �5a�: WebSphere �� ��

� ���� -- WebSphere �� 4.0.6�� ������.

v pdwas-admin� ��� ACL� ��� ��, �� ���� � ��� Authorization

Server� � , � Authorization Server ���� �� ��, �� ������.

�� ACL� pdwas-admin ��� ���� ��� 39 ���� �5a�: WebSphere

�� ��� ���� -- WebSphere �� 4.0.6�� ������.

�� �� � WebSphere ��� ���� �� �� -- WebSphereApplication Server �� 4.0.6 ��

���: Tivoli Access Manager for WebSphere � Access Manager Java Runtime

Environment� �� � �, WebSphere Application Server � �� �� ��

� ����. � ��� �� �� �����. WebSphere Application Server� �

� ��� com.ibm.ejs.security.EJSSecurityCollaborator ���� � �

��� �����.

��: WebSphere Application Server ��� �� ��� � WebSphere

Application Server �� � ����.

1. DB2 �� �� ����� ����. DB2� ��� �� ���� ����

���. � ��, ��� ����.

# su - db2inst1

��� ���� ����.

2. �� ��� �� �� �� ��� ������. ��� was40� WebSphere

�� 4 ������ �����.

db2 => connect to was40 user db2inst1db2inst1� �� ��

������ �� �������� �� = DB2/LINUX 7.2.0SQL �� ID = DB2INST1�� ������ �� = WAS40

db2 => update ejsadmin.securitycfg_table set securityenabled = 0DB20000I SQL ��� ������.

db2 => commitDB20000I SQL ��� ������.

3. WebSphere Application Server � ����.

� 5 � �� ��� 81

Page 100: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Tivoli Access Manager for WebSphere �� ��

Tivoli Access Manager for WebSphere � �� ��� ��� ��� ��

��� �� �� ��� � ����.

Tivoli Access Manager for WebSphere �� ��� ����.

v Tivoli Access Manager for WebSphere ��� /etc ����� ��

PDWAS.properties � jlog.properties

v WebSphere Application Server ��� /config ����� �� PD_WAS.prop

Tivoli Access Manager for WebSphere ����� ����� �� ���

�� �� �� Tivoli Access Manager for WebSphere � WebSphere Application

Server ��� ��� ��� �� ��� ���.

82 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 101: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 6 � ��: �� �� ��

� ���� �� ����� ��� ���� ��� ���� ��� ���

��. ���� WebSphere ���� ����, �� � ��� �� � ���

��� � ��� �� WebSphere ���� �����. WebSphere �����

WebSphere ��� ��� ���� �� ��� �� �����.

� Tivoli Access Manager ��� ���� � WebSphere ��� ��� �

�� ����. � Tivoli Access Manager for WebSphere ���� WebSphere �

�� ����� �� WebSphere �� ����� �� ���� EAR ��

�����.

WebSphere ���� �� ���� ����.

http://www.ibm.com/software/webservers/appserv/infocenter.html

Tivoli Access Manager for WebSphere� ���� �� ���� �� ���

���� 6.7.1, 6.7.2 � 6.7.3 �� ��� �������� ����. � ��

�� �� ��� ���� �� 6.7.4 �� ��� �����.

� �� �� �� ���� ����.

v ����: Tivoli Access Manager for WebSphere Application Server �� 4.0.6

��

v 94 ���� ����: Tivoli Access Manager for WebSphere Application Server

�� 5.0.2��

��: Tivoli Access Manager for WebSphere Application Server �

� 4.0.6�

��� ���� ��

� ���� ���� EAR �� �� ��, LDAP �� ������ ��

��, WebSphere �� ��, � ���� �� � ���, Tivoli Access

Manager� ���� ����, Tivoli Access Manager for WebSphere

� ���� �� � Tivoli Access Manager ��� ���� �� ��� ��

� �� ��. ���� �� ��� ��� �� ��� �� � �� ����

� ����� ��� �� ��.

� ������� �� ��� �����.

© Copyright IBM Corp. 2002, 2003 83

Page 102: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v IBM Directory LDAP �� ����� ����� WebSphere Application

Server� �� � �������.

v WebSphere� ��� �� ���� ����.

Tivoli Access Manager for WebSphere� �� �� � ��� ���� ��� �

�� �� � ��� ��� � ����. �� Tivoli Access Manager for

WebSphere ���� ����, ������ �� �� �� ��.

������� Tivoli Access Manager � WebSphere Application Server� ��

� ������ �� IBM Directory Server �� ����� ��� �� �

����.

�� Tivoli Access Manager for WebSphere �� � ���� �� ��, ��

� �� ����� ������.

v 85 ���� �1�: LDAP �� ������ �� ���

v 86 ���� �2�: Tivoli Access Manager for WebSphere ���

v 86 ���� �3�: WebSphere ������ �� ���

v 88 ���� �4�: WebSphere Application Server� � Tivoli Access Manager

�� �� ��

v 89 ���� �5�: WebSphere �� ���

v 89 ���� �6�: ����� ���

v 90 ���� �7�: ��� ����� �� ����

v 91 ���� �8�: ����� Tivoli Access Manager� �����

v 93 ���� �9�: ��� ����� �� ����

v 93 ���� �10�: � ���

v 94 ���� �11�: ��� ����� �� ����

31 ���� � 3 � ��� ���� �� ����� �� Tivoli Access Manager

for WebSphere �� �� ��� ��� ��, �� �� ������.

v 85 ���� �1�: LDAP �� ������ �� ���

�: ��� 2�� ���� ���. � ���� Tivoli Access Manager for

WebSphere� �� �� �� �������.

v 86 ���� �3�: WebSphere ������ �� ���

v 89 ���� �6�: ����� ���

v 90 ���� �7�: ��� ����� �� ����

v 91 ���� �8�: ����� Tivoli Access Manager� �����

v 93 ���� �9�: ��� ����� �� ����

84 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 103: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v 93 ���� �10�: � ���

v 94 ���� �11�: ��� ����� �� ����

1�: LDAP ��� ������ ��� ��

Tivoli Access Manager pdadmin ���� ���� �� ��� � ��

(user1, user2 � user3) LDAP �� ������ �����. �� �� ��

user4� �����.

� ���� �� ���� �� �� pdadmin ��� �� ��. �� pdadmin

�� �� �� ��� IBM Tivoli Access Manager Base Administration Guide

������.

1. Tivoli Access Manager ��� �������.

C:> pdadmin -a sec_master -p myPassword

sec_master ��� � � Tivoli Access Manager �� ����� ��

����.

2. Tivoli Access Manager for WebSphere �� ����� �� ��� ���

��, � �� ������. �� ��� ����.

�� Tivoli Access Manager for WebSphere ���� ����, WebSphere

�� �� �����. � ���� ���� �� ��� ������.

pdadmin> user create wsadmin cn=wsadmin,o=organization,c=country wsadmin wsadmin myPassword

organization � country LDAP �� ������ �� ��� ���

���.

3. � �� ��� �� ��� �����. � ������. �� ���

� ��� �� ��. ��� ibm� ��, au� ���� �� ��� �

myPassword �����.

pdadmin> user create user1 cn=user1,o=ibm,c=us user1user1 myPasswordpdadmin> user create user2 cn=user2,o=ibm,c=us user2user2 myPasswordpdadmin> user create user3 cn=user3,o=ibm,c=us user3user3 myPasswordpdadmin> user create user4 cn=user4,o=ibm,c=us user4user4 myPassword

4. �� ��� �� ��� �����.

pdadmin> user modify wsadmin account-valid yespdadmin> user modify user1 account-valid yespdadmin> user modify user2 account-valid yespdadmin> user modify user3 account-valid yespdadmin> user modify user4 account-valid yes

5. pdadmin ���� ������.

� 6 � ���: �� �� �� 85

Page 104: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdadmin> quit

6. WebSphere �� ���� ��� ������. �� �(89 ���� �5�:

WebSphere �� ���)� �� ������.

2�: Tivoli Access Manager for WebSphere ��

Tivoli Access Manager for WebSphere �� ��� ��� ��, � ��� �

�����. �� �(91 ���� �8�: ����� Tivoli Access Manager�

�����)� ����.

�� Tivoli Access Manager for WebSphere ����� ��� ��� ���

�����.

13 ���� � 2 � ��� ������ ����� �����.

Tivoli Access Manager for WebSphere �� ��� �, �� ��� �� 31 �

��� ��� �� ���� ��� �� ��� ������.

85 ���� �1�: LDAP �� ������ �� ����� � ��� �

WebSphere �� �� wsadmin� �� �����. ��� �� �� � � �

� ��� ��� ����. 32 ���� �1�: WebSphere Application Server� �

Tivoli Access Manager �� ��� 2�� ������.

3�: WebSphere ������� �� ��

1. WebSphere ����� ���� �� � ����. �� → ���� → IBM

WebSphere → Application Server �� 4.0 AE → ������ ���� �

� ��� C:\WebSphere\AppServer\bin\assembly � ����.

� ���� �� �����.

2. � ����� � simpleSession.ear�

C:\temp\assembly\simpleSession.ear� ������.

3. WebSphere ����� ���� ���� � ����� EAR �� �

���. �� → �� � � ����� EAR ��

C:\temp\assembly\simpleSession.ear� ����.

4. �� ��� �� ��� ��� �����. �� ��� �����.

5. �� �� ����. ��� ������.

��: GoodGuys

6. ��� �� ����. ��� �� �����.

��: user1

��� �����.

7. �� �� ���� �� �� ������.

86 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 105: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��: user2��: user3

�� ��� ������ ��� �����.

8. EJB �� �����. EBJ11� �����. ��� ��� �� ��� �

�� �����. �� ��� �����. ��� ������.

��: MyMethodPermissions

a. ���: �� �����.

v Home (*)� ����.

v Remote (*) ����.

��� �����.

b. �: �� �����. GoodGuys ����. ��� �����.

9. � �� �����. SimpleSessionWar � � �����.

a. �� �����.

b. ��� �� � ����.

c. �� ���: ��� ������.

d. � ��: Getting Started ������

e. ��� �����.

10. � �� �����. SimpleSessionWar �����. SecurityConstraints

� �� ��� ��� �����. �� ��� �����.

a. �� ���� ���� GoodGuys ������.

b. ��:

v �� �����.

v GoodGuys ����.

v ��� �����.

c. � ��� �� ��� ����.

d. ��� �����.

11. � � -> SimpleSessionWar -> SecurityConstraints -> GoodGuys -> �

�� ���� �� ��� ��� �����.

a. �� ��� �����.

b. � �� ���� SecureMe ������.

c. HTTP ���� �� �� �����. GET� ����. ��� ��

���.

d. HTTP ���� �� �� �����. POST ����. ��� �

����.

� 6 � ���: �� �� �� 87

Page 106: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

e. URL� �� �� �����. “/SimpleSession”� ������. ���

�����.

f. ��� �����.

12. � EAR �� ������. �� -> �� ���� ��� � � ���

������.

C:\temp\assembly\simple SessionSecure.ear

13. �� -> ��� �� ��� ����.

a. � ���� C:\temp� ������.

b. � ��� �����.

c. �� ������.

14. ���� ���� �� ������. �� �(85 ���� �1�: LDAP

�� ������ �� ���)� �� ������.

4�: WebSphere Application Server� �� Tivoli Access Manager�� ��� ��

��� �� WebSphere Application Server�� �� ��� ��, Tivoli Access

Manager ��� ���� WebSphere Application Server �� �� ���

���. Tivoli Access Manager ��� ����� pdadmin �� Tivoli Access

Manager Web Portal Manager � �� ���� WebSphere Application Server

� � Tivoli Access Manager �� �� ������. Tivoli Access Manager

��� ������ ��� ������.

1. ����� �� �� sec_master� pdadmin� � ����.

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server �� �� ������. � ��, ���

����.

pdadmin> user import was_admin_user dn_registry_identifier

WebSphere �� �� ��� �� �����.

pdadmin> user modify was_admin_user account-valid yes

��� WebSphere Application Server�� �� ���� �� ��, WebSphere

Application Server �� �� �� ���. Tivoli Access Manager ���

����� pdadmin �� Tivoli Access Manager Web Portal Manager � ��

���� WebSphere Application Server� � Tivoli Access Manager �� ��

�����.

pdadmin� ���� ��� ��� ����.

1. ����� �� �� sec_master� pdadmin� � ����.

88 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 107: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server� �� Tivoli Access Manager �� ��

�����. � ��, �� ��� � �� wsadmin� ����. ��� �

���� ���� ��� ���.

pdadmin> user create wsadmin cn=wsadmin,o=organization,c=countrywsadmin wsadmin myPassword

organization � country LDAP �� ������ �� ��� ���

���.

wsadmin ��� �� �����.

pdadmin> user modify wsadmin account-valid yes

5�: WebSphere �� ��

WebSphere ��� �� ��� �� �� ��, 33 ���� �WebSphere

Application Server �� 4.0.6�� �� ���� ����� ���� �� ���

����.

6�: ������ ��

1. WebSphere �� �� �� ��� ������.

2. WebSphere �� ���� � ����.

C:\websphere\appserver\bin\adminclient

3. �� myPassword� �� wsadmin�� �������.

4. WebSphere �� ��� -> ����� ������� ����.

5. ����� ������ �� �� ��� ��� � ����.

a. ������ �� �� ����.

b. �� �� ������.

c:\temp\assembly\simpleSessionSecure.ear

c. ��� �����. ���� �� �� ���� �� ��� �� ���

�� �� �� �����. �����.

d. ��� �����.

e. �� ��� ������ ������.

user1 user2 user3

f. ��� �����.

g. ��� �� �� ��� �� ��� � � ����. �� �� ��

� ��� ����.

v �� �� ��

v EJB RunAs �� ��� ��

� 6 � ���: �� �� �� 89

Page 108: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v Enterprise Bean� JNDI ��� ��

v EJB �� �� ��

v EJB � � �� �� ����� ��

v �� CMP Bean� �� ����� ��

v � � �� �� ���

v Application Server

h. ������ �� ��� � �� �� ���, � �����.

i. � �� ������. ��� �����.

j. ��� � �� � ������.

6. �� �� �� �� ��, �� ������. �� ��� �� �� �� �

�, �� ��� �� ������.

�� �� ����� ��� ������.

v WebSphere �� ��� -> �� -> ��� �� -> Application Server ->

�� �� ����.

v �� �� �� ��� ��� �����.

v �� ����.

v ��� � �� � ������.

7. �� �� � ����.

v WebSphere �� ��� -> �� -> ��� �� -> Application Server ->

�� �� ����.

v �� �� �� ��� ��� �����.

v ��� ����.

v ��� � �� � ������.

8. WebSphere � �� �� ������.

9. �� �(�7�: ��� ����� �� ����)� �� ������.

7�: ��� ���� �� ���

Servlet

1. ���� � ����.

2. �� URL� ����. hostname� ��� ��� ����.

http://hostname:9080/gettingstarted3/SimpleSession?msg=Test

3. �� ��� � ����� ����� ����. �� �� �� user1

�� user2 �� user3� ��� ��� �� ��(�: user4)� ������.

� � ������.

90 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 109: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ���� ����. ��� �� �� user4 ����, �� ����

����.

4. ���� �� � ����.

5. �� URL� ����. �� ��� � ����� ����� ��� �

�� �� �� �� � � ������.

�� ���� ����.

Thick Client

1. launchclient ���� ���� �� ����� � ����. �� �

�� � �� ������.

C:> c:\websphere\appserver\bin\launchclientc:\websphere\appserver\installedApps\simpleSessionSecure.ear

2. �� �� � � ��� ��� ����� ����.

3. �� �� �� � � ������(�: user1).

��� �� ���� ���� ����.

4. ���� �� � ����.

5. �� 1��� �� launchclient ���� ���� �� ����� �

����. �� ��� � ����� ����� ��� ��� �� �

� �� � � ������.

��� �� ���� ���� ����.

6. �� �� �� ������.

8�: ���� Tivoli Access Manager� ���

� � ������� 31 ���� ��� �� ���� ��� �� Tivoli Access

Manager for WebSphere� �� �� � ��� ���� �����. �� �� �

���� admin.ear �� ����� �����.

�: Tivoli Access Manager for WebSphere� �� �� � ��� ���� ��

��, �� ������. 31 ���� ��� �� ���� ����� �����

�.

1. ���� ����� �� �� ���� ���� � ��� �� �� �

�����.

v ����� EAR �� ��.

c:\temp\assembly\simpleSessionSecure.ear

v PDPerm.properties �� ��. � �� WebSphere Application Server

�� ���� ��� ����� ����. �� ����� � ���� �

� �� �� �� ��.

� 6 � ���: �� �� �� 91

Page 110: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�: � ��� URI(Uniform Resource Indicator)� ���� ���.

– Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

– AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

– Windows

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

v Tivoli Access Manager �� ��� ��. � ��� sec_master�� ���.

v sec_master ��� �.

v WebSphere �� �� ��� ��. � ��� Tivoli Access Manager for

WebSphere� �� �� � �� ��� ��� ���. � ��, ���

����.

wsadmin

v Tivoli Access Manager Policy Server� WebSphere Application Server� �

� �� ���� LDAP �� ��(DN) ���. �� wsadmin ��

�� � ���� DN ���� ��� ���.

32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��� ��� �� DN� ���� wsadmin� �� ��

��.

cn=wsadmin,o=ibm,c=us

� ��, DN ���� o=ibm,c=us� ����.

� �� migrateEAR4 ����� -d �� ��� ��� ���.

�: pdadmin� ���� �� ���� wsadmin� �� DN� �� �

����.

pdadmin> user show wsadmin

2. ���� ����� ��� ���� ������.

v UNIX ��� - /opt/pdwas/bin

v Windows ��� - C:\Program Files\Tivoli\pdwas\bin

92 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 111: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3. ���� ���� ���� ���� ��� ��������.

�� ���� ���� ��� ���� �� ����� �� ��� � �

��� ���� ������.

8. ���� ����� ��� ��

UNIX

migrateEAR4 -j /temp/assembly/simpleSessionSecure.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

AIX�� PdPerm.properties �� �� ��� ��� ����.

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR4 -j C:\temp\assembly\simpleSessionSecure.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

���� ����� ��� �� �� �����. �� � ��� ��

��(�: pdwas_migrate.log). �� �� ��� ���� �� �� ��

������ ��� � ����.

�� �� ��� �� ��, ���� ����� ���� �� ���

�. � ��, � URI(Uniform Resource Indicator) -c �� �����

� � ��� -j �� ����� ������.

4. ����� ����, �� �(�9�: ��� ����� �� ����)� ��

������.

9�: ��� ���� �� ���

1. �� ����� ��� ��� ������. 90 ���� �7�: ���

����� �� ����� Servlet � Thick Client � ��� �� ��

������.

2. ��� ���� �� �(�10�: � ���)� �� ������.

10�: � ��

Tivoli Access Manager pdadmin ���� ���� �� ��� � �

� �����.

1. pdadmin� � ����.

pdadmin -a sec_master -p myPassword

2. SimpleSession ����� ACL� ���� user4� ��� ������. �

�� acl modify ��� � ���� ���� ������.

� 6 � ���: �� �� �� 93

Page 112: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_SimpleSessApp_ACLset user user4 T[WebAppServer]i

3. ��� ��� � ���� ������.

pdadmin> server replicatepdadmin> quit

4. �� �(�11�: ��� ����� �� ����)� �� ������.

11�: ��� ���� �� ���

1. �� ����� ��� ��� ������. 90 ���� �7�: ���

����� �� ����� Servlet � Thick Client � ��� �� ��

������.

�� �� ��� ��� �� user1, user2, user3 �� user4 ���

� ��� �� ������.

2. �� user4 ���� � ��� ������.

�� ��� �� ����.

��: Tivoli Access Manager for WebSphere Application Server �

� 5.0.2�

��� ���� ��

� ���� ���� EAR �� �� ��, LDAP �� ������ ��

��, WebSphere �� ��, � ���� �� � ���, Tivoli Access

Manager� ���� ����, Tivoli Access Manager for WebSphere

� ���� �� � Tivoli Access Manager ��� ���� �� ��� ��

� �� ��. ���� �� ��� ��� �� ��� �� � �� ����

� ����� ��� �� ��.

� ������� �� ��� �����.

v IBM Directory Server ����� WebSphere Application Server� �� � �

������.

v WebSphere� ��� �� ���� ����.

Tivoli Access Manager for WebSphere� �� �� � ��� ���� ��� �

�� �� � ��� ��� � ����. �� Tivoli Access Manager for

WebSphere ���� ����, ������ �� �� �� ��.

94 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 113: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

������� Tivoli Access Manager � WebSphere Application Server� ��

� ������ �� IBM Directory Server �� ����� ��� �� �

����.

�� Tivoli Access Manager for WebSphere �� � ���� �� ��, ��

� �� ����� ������.

v �1�: LDAP �� ������ �� ���

v 97 ���� �2�: Tivoli Access Manager for WebSphere ���

v 97 ���� �3�: WebSphere ������ �� ���

v 99 ���� �4�: WebSphere Application Server� � Tivoli Access Manager

�� �� ��

v 100 ���� �5�: WebSphere �� ���

v 100 ���� �6�: ���� ���

v 101 ���� �7�: ��� ������ �� ����

v 102 ���� �8�: ������ Tivoli Access Manager� �����

v 104 ���� �9�: ��� ����� �� ����

v 104 ���� �10�: � ���

v 104 ���� �11�: ��� ����� �� ����

31 ���� � 3 � ��� ���� �� ����� �� Tivoli Access Manager

for WebSphere �� �� ��� ��� ��, �� �� ������.

v �1�: LDAP �� ������ �� ���

v 97 ���� �3�: WebSphere ������ �� ���

�: ��� 3�� ���� ���. � ���� Tivoli Access Manager for

WebSphere� �� �� �� �������.

v 100 ���� �6�: ���� ���

v 101 ���� �7�: ��� ������ �� ����

v 102 ���� �8�: ������ Tivoli Access Manager� �����

v 104 ���� �9�: ��� ����� �� ����

v 104 ���� �10�: � ���

v 104 ���� �11�: ��� ����� �� ����

1�: LDAP ��� ������ ��� ��

Tivoli Access Manager pdadmin ���� ���� �� ��� � ��

(user1, user2 � user3) LDAP �� ������ �����. �� �� ��

user4� �����.

� 6 � ���: �� �� �� 95

Page 114: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� �� ���� �� �� pdadmin ��� �� ��. �� pdadmin

�� �� �� ��� IBM Tivoli Access Manager Base Administration Guide

������.

1. Tivoli Access Manager ��� �������.

C:> pdadmin -a sec_master -p myPassword

sec_master ��� � � Tivoli Access Manager �� ����� ��

����.

2. Tivoli Access Manager for WebSphere �� ����� �� ��� ���

��, � �� ������. �� ��� ����.

�� Tivoli Access Manager for WebSphere ���� ����, WebSphere

�� �� �����. � ���� ���� �� ��� ������.

pdadmin> user create wsadmin cn=wsadmin,o=organization,c=country wsadmin wsadmin myPassword

organization � country LDAP �� ������ �� ��� ���

���.

3. � �� ��� �� ��� �����. � ������. �� ���

� ��� �� ��. ��� ��� ibm� , ��� au��, �� ���

� myPassword �����.

pdadmin> user create user1 cn=user1,o=ibm,c=us user1user1 myPasswordpdadmin> user create user2 cn=user2,o=ibm,c=us user2user2 myPasswordpdadmin> user create user3 cn=user3,o=ibm,c=us user3user3 myPasswordpdadmin> user create user4 cn=user4,o=ibm,c=us user4user4 myPassword

4. �� ��� �� ��� �����.

pdadmin> user modify wsadmin account-valid yespdadmin> user modify user1 account-valid yespdadmin> user modify user2 account-valid yespdadmin> user modify user3 account-valid yespdadmin> user modify user4 account-valid yes

5. pdadmin ���� ������.

pdadmin> quit

6. WebSphere �� ���� ��� ������. �� �(100 ���� �5�:

WebSphere �� ���)� �� ������.

96 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 115: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

2�: Tivoli Access Manager for WebSphere ��

Tivoli Access Manager for WebSphere �� ��� ��� ��, � ��� �

�����. �� �(102 ���� �8�: ������ Tivoli Access Manager�

�����)� ����.

�� Tivoli Access Manager for WebSphere ����� ��� ��� ���

�����.

13 ���� � 2 � ��� ������ ����� �����.

Tivoli Access Manager for WebSphere �� ��� �, �� ��� �� 31 �

��� ��� �� ���� ��� �� ��� ������.

95 ���� �1�: LDAP �� ������ �� ����� � ��� �

WebSphere �� �� wsadmin� �� �����. ��� �� �� � � �

� ��� ��� ����. 32 ���� �1�: WebSphere Application Server� �

Tivoli Access Manager �� ��� 2�� ������.

3�: WebSphere ������� �� ��

1. � ����� � simpleSession.ear� ��� %PDWAS_HOME%\example

������ C:\temp\assembly\simpleSession.ear� ������.

2. WebSphere ����� ���� �� � ����. �� -> ���� ->

IBM WebSphere -> Application Server �� 5.0 -> ������ ����

�� ��� C:\WebSphere\AppServer\bin\assembly � ����.

� ���� �� �����.

3. WebSphere ����� ���� ���� � ����� EAR �� �

���. �� -> �� � � ����� EAR ��

C:\temp\assembly\simpleSession.ear� ����.

4. EJB �� �����. EBJ11� �����. �� ��� �� ��� ��

� �����. �� ��� �����. ��� ������.

��: GoodGuys

��� �����.

5. � �� �����. SimpleSessionWar �����. �� ��� �� �

�� ��� �����. �� ��� �����. ��� ������.

��: GoodGuys

��� �����.

6. �� ���� �� ��� �� ��� ��� �����. ��� ��

����. ��� ��� �� �����. user1� ������.

� 6 � ���: �� �� �� 97

Page 116: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� �����.

7. �� �� ���� �� �� ������.

��: user2��: user3

�� ��� ������ ��� �����.

8. EJB �� �����. EBJ11� �����. ��� ��� �� ��� �

�� �����. �� ��� �����. �� �� �� � Method

Permission_Name: ��� ������,

��: ’MyMethodPermissions’

a. ��� ��� �� �����. SimplesessionEJBI0.jar� � �

com_ibm_websphere_gettingstarted_ejbs_SimpleSession_(*)� ���

��. ��� ����. ��� �����.

b. � ��� �� �����. GoodGuys ����. ��� ���

��.

c. ��� �����.

9. � �� �����. SimpleSessionWar � � �����.

a. �� �����.

b. ��� �� � ����.

c. �� ���: ��� ������.

d. � ��: Getting Started ������

e. ��� �����.

10. � �� �����. SimpleSessionWar �����. SecurityConstraints

� �� ��� ��� �����. �����(9�� ���)>

11. � �� �� �����. SimpleSessionWar �����. SecurityConstraints

� �� ��� ��� �����. �����. �� ��� �����.

a. �� ���� ���� GoodGuys ������.

b. ��:

v �� �����.

v GoodGuys ����.

c. � ��� �� ��� ����.

d. ��� �����.

12. � � -> SimpleSessionWar -> SecurityConstraints -> GoodGuys -> �

�� ���� �� ��� ��� �����.

a. �� ��� �� �� �� ��� �����.

b. � �� ���� SecureMe ������.

98 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 117: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

c. HTTP ���� �� �� �����. GET� ����. ��� ��

���.

d. HTTP ���� �� �� �����. POST ����. ��� �

����.

e. URL� �� �� �����. “/SimpleSession”� ������. ���

�����.

f. ��� �����.

13. � EAR �� ������. �� -> �� ���� ��� � � ���

������.

C:\temp\assembly\simpleSessionSecure.ear

14. �� -> ��� �� ��� ����.

a. � ���� C:\temp� ������.

b. � �� �� �����.

c. �� ������.

d. �� �� �����.

15. ���� ���� �� ������. �� �(85 ���� �1�: LDAP

�� ������ �� ���)� �� ������.

4�: WebSphere Application Server� �� Tivoli Access Manager�� ��� ��

��� �� WebSphere Application Server�� �� ��� ��, Tivoli Access

Manager ��� ���� WebSphere Application Server �� �� ���

���. Tivoli Access Manager ��� ����� pdadmin �� Tivoli Access

Manager Web Portal Manager � �� ���� WebSphere Application Server

� � Tivoli Access Manager �� �� ������. Tivoli Access Manager

��� ������ ��� ������.

1. ����� �� �� sec_master� pdadmin� � ����.

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server �� �� ������. � ��, ���

����.

pdadmin> user import was_admin_user dn_registry_identifier

WebSphere �� �� ��� �� �����.

pdadmin> user modify was_admin_user account-valid yes

��� WebSphere Application Server�� �� ���� �� ��, WebSphere

Application Server �� �� �� ���. Tivoli Access Manager ���

� 6 � ���: �� �� �� 99

Page 118: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

����� pdadmin �� Tivoli Access Manager Web Portal Manager � ��

���� WebSphere Application Server� � Tivoli Access Manager �� ��

�����.

pdadmin� ���� ��� ��� ����.

1. ����� �� �� sec_master� pdadmin� � ����.

pdadmin -a sec_master -p sec_master_password

2. WebSphere Application Server� �� Tivoli Access Manager �� ��

�����. � ��, �� ��� � �� wsadmin� ����. ��� �

���� ���� ��� ���.

pdadmin> user create wsadmin cn=wsadmin,o=organization,c=countrywsadmin wsadmin myPassword

organization � country LDAP �� ������ �� ��� ���

���.

wsadmin ��� �� �����.

pdadmin> user modify wsadmin account-valid yes

5�: WebSphere �� ��

WebSphere ��� �� ��� �� �� ��, 34 ���� �WebSphere

Application Server �� 5.0.2�� �� ���� ����� ���� �� ���

����.

6�: ��� ��

1. WebSphere �� �� �� ��� ������.

2. �� �� ����: http://localhost:9090/admin.

�: LTPA ��� �� ��� �� FQDN� ��� ���.

http://hostname.domain.com:9090/admin

3. wsadmin�� �������.

4. ����� ������� � � � ������ �� ����.

5. ���� � ������ �����. ������

C:\temp\assembly\simpleSessionSecure.ear���. �� �����.

6. �� �� ��� ���� ��� � � ����. ��� ��� ���

����.

v ����� �� ��

v 1��: �� ��� � ��

v 1��: EJB �� ��� � ��

100 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 119: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v 3��: Bean� JNDI �� ��

v 4��: Bean� EJB �� ��

v 5��: � � �� ��� ��

v 6��: ����� ��� � ��

v 7��: ��/��� �� � ��

v 8��: ��� ID� �� ��

v 9��: ��

� � ����� �� � ����.

7. ��� ���� �� �� �����.

8. �� �� � ��� ���� ��� ������.

9. ����� ������� � SimpleSessionApp �� � ��

� � �� �� � ������ � ����.

10. ��� �����.

7�: ��� ������� �� ���

Servlet

1. ���� � ����.

2. �� URL� ����. hostname� ��� ��� ����.

http://hostname:9080/gettingstarted3/SimpleSession?msg=Test

3. �� ��� � ����� ����� ����. �� �� �� user1

�� user2 �� user3� ��� � ACL� �� �� �� �� �� �

�� ��� ������(�: user4). � � ������.

″���″ ���� �� ���� ����. ��� �� �� user4 ��

��, ����� �� (403 ��) ���� ����.

4. ���� �� � ����.

5. �� URL� ����. ������ ���� �� �� ��� � ���

���.

�� ������ ����� ����.

Thick Client

1. launchclient ���� ���� �� ����� � ����. �� �

�� � �� ������.

C:> c:\program files\websphere\appserver\bin\launchclient"c:\program files\websphere\appserver\installedApps\<nodename>\simpleSessionSecure.ear"

2. �� �� � � ��� ��� ����� ����.

� 6 � ���: �� �� �� 101

Page 120: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

3. �� �� �� � � ������(�: user1).

��� �� ���� ���� ����.

4. ���� �� � ����.

5. �� 1��� �� launchclient ���� ���� �� ������ �

����. �� ��� � ����� ����� ��� ��� �� �

� �� � � ������.

��� �� ���� ���� ����.

6. �� �� �� ������.

8�: ������� Tivoli Access Manager� ���

� � ������� 31 ���� ��� �� ���� ��� �� Tivoli Access

Manager for WebSphere� �� �� � ��� ���� �����. �� �� �

���� adminconsole.ear �� ����� �����.

�: Tivoli Access Manager for WebSphere� �� �� � ��� ���� ��

��, �� ������. 31 ���� ��� �� ���� ����� �����

�.

1. ���� ����� �� �� ���� ���� � ��� �� �� �

�����.

v ����� EAR �� ��.

c:\temp\assembly\simpleSessionSecure.ear

v PDPerm.properties �� �� ��. � �� WebSphere Application

Server �� ���� ��� ����� ����. �� ����� � ��

�� �� �� �� �� ��.

�: � ��� URI(Uniform Resource Indicator)� ���� ���.

– Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

– AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

– Windows

file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

v Tivoli Access Manager �� ��� ��. � ��� sec_master�� ���.

v sec_master ��� �.

v WebSphere �� �� ��� ��. � ��� Tivoli Access Manager for

WebSphere� �� �� � �� ��� ��� ���. � ��, ���

����.

102 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 121: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

wsadmin

v Tivoli Access Manager Policy Server� WebSphere Application Server� �

� �� ���� LDAP �� ��(DN) ���. �� wsadmin ��

�� � ���� DN ���� ��� ���.

32 ���� �1�: WebSphere Application Server� � Tivoli Access

Manager �� ��� ��� �� DN� ���� wsadmin� �� ��

��.

cn=wsadmin,o=ibm,c=us

� ��, DN ���� o=ibm,c=us� ����.

� �� migrateEAR5 ����� -d �� ��� ��� ���.

�: pdadmin� ���� �� ���� wsadmin� �� DN� �� �

����.

pdadmin> user show wsadmin

2. ���� ����� ��� ���� ������.

v UNIX ��� - /opt/amwas/bin

v Windows ��� - C:\Program Files\Tivoli\amwas\bin

3. ���� ���� ���� ���� ��� ��������.

�� ���� ���� ��� ���� �� ����� �� ��� � �

��� ���� ������.

9. ���� ����� ��� ��

UNIX

migrateEAR5 -j /temp/assembly/simpleSessionSecure.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

AIX�� PdPerm.properties �� �� ��� ��� ����.

/usr/WebSphere/AppServer/java/jre/PdPerm.properties

Windows

migrateEAR5.bat -j C:\temp\assembly\simpleSessionSecure.ear-a sec_master -p sec_master_password-w wsadmin -d "o=ibm,c=us"-c file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

���� ����� ��� �� �� �����. �� � ��� ��

��(�: pdwas_migrate.log). �� �� ��� ���� �� �� ��

������ ��� � ����.

� 6 � ���: �� �� �� 103

Page 122: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� �� ��� �� ��, ���� ����� ���� �� ���

�. � ��, � URI(Uniform Resource Indicator) -c �� �����

� � ��� -j �� ����� ������.

4. ����� ����, �� �(�9�: ��� ����� �� ����)� ��

������.

9�: ��� ���� �� ���

1. �� ����� ��� ��� ������. 101 ���� �7�: ���

������ �� ����� Servlet � Thick Client � ��� �� ��

������.

2. ��� ���� �� �(�10�: � ���)� �� ������.

10�: � ��

Tivoli Access Manager pdadmin ���� ���� �� ��� � �

� �����.

1. pdadmin� � ����.

pdadmin -a sec_master -p myPassword

2. SimpleSession ����� ACL� ���� user4� ��� ������. �

�� acl modify ��� � ���� ���� ������.

pdadmin> acl modify _WebAppServer_deployedResources_GoodGuys_SimpleSessApp_ACLset user user4 T[WebAppServer]i

3. ��� ��� � ���� ������.

pdadmin> server replicatepdadmin> quit

4. �� �(�11�: ��� ����� �� ����)� �� ������.

11�: ��� ���� �� ���

1. �� ����� ��� ��� ������. 101 ���� �7�: ���

������ �� ����� Servlet � Thick Client � ��� �� ��

������.

�� �� ��� ��� �� user1, user2, user3 �� user4 ���

� ��� �� ������.

2. user4� ���� ���� � �� ��, ��� ����� ��� ����

WebSphere Application Server �� � ����.

�� ��� �� ����.

104 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 123: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 7 � �� ����

�� �� �� ��� � ���� ��� Tivoli Access Manager for

WebSphere �����.

Tivoli Access Manager for WebSphere � ���� �� ��� � ���

�.

1. ���� �������.

v UNIX ��� - root

v Windows ��� - �� �� �� ��

2. WebSphere Application Server ������.

3. �� �� WebSphere Application Server� ��� �� -action unconfigWAS4

�� unconfigWAS5 ��� ���� Tivoli Access Manager for WebSphere

� ���� �� ���� pdwascfg ���� ������.

# pdwascfg -action unconfigversion_number-remote_acl_user user_CN-sec_master_pwd password-was_home home_directory_of_WebSphere_Application_Server-pdmgrd_host policy_server_host_name-pdacld_host authorization_server_host_hame

��� �� �� �� ��� 109 ���� �� A ��� ����� � �

�� ������.

� ����� �� ���� ��� �� ������.

v �Solaris�� ��

v 106 ���� �Windows�� ��

v 107 ���� �AIX�� ��

v 107 ���� �HP-UX�� ��

v 107 ���� �Linux�� ��

Solaris�� ��

�� ����� ������.

1. Tivoli Access Manager for WebSphere ���� �� ��� ������.

# pkgrm PDWAS

� ��� � ���� ����� ����.

2. y ������.

© Copyright IBM Corp. 2002, 2003 105

Page 124: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� �� �� � �� ���� � �� �����. postremove ����

� ��� �, ����� ��� ����� �� ���� ����. pkgrm

����� �����.

3. �� ���� Tivoli Access Manager ���� ���� ��, � �� �

���� ���� Tivoli Access Manager Authorization Server(��� �

�), Access Manager Base Runtime Environment � Access Manager Java

Runtime Environment �����.

��� ���� IBM Tivoli Access Manager �� �� ��� �����

�.

Tivoli Access Manager for WebSphere ��� ������.

Windows�� ��

�� ����� ������.

1. WebSphere Application Server ���� � �� � ����. ���� ��/

�� ���� �����.

2. Access Manager for WebSphere ����.

3. ��/�� �����.

�� � �� �� ����.

4. � � � ��� �����.

5. �� �� �� ����. ��� �����.

� �� �� �� �� ����.

6. ��� �����.

Tivoli Access Manager for WebSphere �� ����.

�� � �� �� ����.

7. � �����.

8. �� ���� Tivoli Access Manager ���� ���� ��, � �� �

���� ���� Tivoli Access Manager Authorization Server(��� �

�), Access Manager Base Runtime Environment � Access Manager Java

Runtime Environment �����.

��� ���� IBM Tivoli Access Manager �� �� ��� �����

�.

Tivoli Access Manager for WebSphere� ����.

106 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 125: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

AIX�� ��

Tivoli Access Manager for WebSphere Application Server AIX �� ��

�� installp ���� ������.

�� ���� Tivoli Access Manager ���� ���� ��, � �� �

���� ���� Tivoli Access Manager Authorization Server(��� ��), Access

Manager Base Runtime Environment � Access Manager Java Runtime Environment

�����. ��� ���� IBM Tivoli Access Manager �� �� ���

������.

HP-UX�� ��

�� ����� ������.

1. Tivoli Access Manager for WebSphere ���� �� ��� ������.

# swremove PDWAS

��� �� ���� ����. �� ���� �� ��� ������ ��

���. swremove ����� Tivoli Access Manager for WebSphere �� �

���� ����.

�� ����, swremove ����� �����.

2. �� ���� Tivoli Access Manager ���� ���� ��, � �� �

���� ���� Tivoli Access Manager Authorization Server(��� �

�), Access Manager Base Runtime Environment � Access Manager Java

Runtime Environment �����.

��� ���� IBM Tivoli Access Manager �� �� ��� �����

�.

HP-UX�� Tivoli Access Manager for WebSphere� ����.

Linux�� ��

�� ����� ������.

1. Tivoli Access Manager for WebSphere ���� �� ��� ������.

# rpm -e PDWAS-PD

�� ����. rpm ����� �����.

2. �� ���� Tivoli Access Manager ���� ���� ��, � �� �

���� ���� Tivoli Access Manager Authorization Server(��� �

�), Access Manager Base Runtime Environment � Access Manager Java

Runtime Environment �����.

� 7 � � ���� 107

Page 126: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� ���� IBM Tivoli Access Manager �� �� ��� �����

�.

Tivoli Access Manager for WebSphere ��� ������.

108 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 127: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� A. ��

© Copyright IBM Corp. 2002, 2003 109

Page 128: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

pdwascfgTivoli Access Manager for WebSphere Application Server ���� ��

����.

pdwascfg -action {configWAS4|configWAS5} -remote_acl_user user

-sec_master_pwd password -was_home was_home_dir -pdmgrd_host

policy_server_hostname -pdacld_host authorization_server_hostname[-amwas_home

amwas_install_path] [-pdmgrd_port policy_server_port] [-pdacld_port

authorization_server_port] [-embedded {true|false}] [-action_type {all|local|remote}]

[-am_domain was_domain] [-cfg_url pdjrte_config_file_URL] [-key_url

pdjrte_keystore_URL ] [-verbose {true|false}]

pdwascfg -action {unconfigWAS4|unconfigWAS5} -remote_acl_user user

-sec_master_pwd password -was_home was_install path -pdmgrd_host

policy_server_hostname -pdacld_host authorization_server_hostname

pdwascfg -help [ options]

���

-action {configWAS4|configWAS5}

��� ��� �� �� �����. Tivoli Access Manager for WebSphere

Application Server �����.

-action {unconfigWAS4|unconfigWAS5}

��� � ��� �� �� �����. Tivoli Access Manager for WebSphere

Application Server �� ����.

-action_type {all|local|remote}

�� �� �� �����. ��� �� all, local �� remote���. local

�� �� ���(SvrSslCfg� ��� ��)�� ��� �� ���� ����

�. remote �� �� ���(SvrSslCfg ��)�� ��� �� ���� �

����. ��� ���� all� �����.

-am_domain was_domain

Tivoli Access Manager for WebSphere� Tivoli Access Manager ���� �

�����. Tivoli Access Manager � ��(pdacld)� ���� ��� �

���� Tivoli Access Manager �� ��� ��� ��� ���.

-amwas_home amwas_install_path

Tivoli Access Manager for WebSphere� �� ��� ���� �� �� Tivoli

110 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 129: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Access Manager for WebSphere� �� �� ������. -action

{configWAS4|configWAS5} �� -action {unconfigWAS4|unconfigWAS5} �

� � ��� ������.

�: Tivoli Access Manager for WebSphere �� ��� ��� ��, pdwascfg

��� -amwas_home �� ��� ��� ����.

-cfg_url pdjrte_config_file_url

PDJrte �� �� �� �����. -action_type remote �� -action_type

all �� ���� ��� � �� �� �� ��� �� � �� �

���.

-embedded {true|false}

true� ���� � ��� WebSphere� �� ��� �����. ����

false���.

-help [options]

�� � �� � ��� ��� �����. �� ��� �� ��� ��, �

� � ��� ��� �����.

-key_url pdjrte_keystore_url

PDJrte ��� �� �� �����. -action_type remote ��

-action_type all �� ���� ��� � �� �� �� ��� ��

� �� ����.

-pdacld_host authorization_server_hostname

Tivoli Access Manager Authorization Server� ��� ��� �����. -action

{configWAS4|configWAS5} �� -action {unconfigWAS4|unconfigWAS5} �

� � ��� ������.

-pdacld_port authorization_server_port

Tivoli Access Manager Authorization Server� �� ��� � ��� ��

� � � � � �� � � � � � � � � � � . - a c t i o n

{configWAS4|configWAS5} �� -action {unconfigWAS4|unconfigWAS5} �

� � ��� ������. � �� ��� ��, pdmgrd_port� ��

� ��� �� ������.

-pdmgrd_host policy_server_hostname

Tivoli Access Manager Policy Server� ��� ��� �����. -action

{configWAS4|configWAS5} �� -action {unconfigWAS4|unconfigWAS5} �

� � ��� ������.

-pdmgrd_port policy_server_port

Tivoli Access Manager Policy Server� �� ��� � ��� �� ��

�� A. �� �� 111

Page 130: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� � �� �� �����. -action {configWAS4|configWAS5} �

� -action {unconfigWAS4|unconfigWAS5} �� � ��� �����

�.

-remote_acl_user user

�� ACL ��� �� ��� �����. � ���� Tivoli Access

Manager Authorization Server�� SSL ��� �����. ��� ����

�� ���� ����. -action {configWAS4|configWAS5} �� -action

{unconfigWAS4|unconfigWAS5} �� � ��� ������.

��� -remote_acl_user pdpermadmin� ����.

-sec_master_pwd password

�� ��� � �����(�� sec_master). -action

{configWAS4|configWAS5} �� -action {unconfigWAS4|unconfigWAS5} �

� � ��� ������.

-verbose {true|false}

true;� ��� �� �� ��� �� ����, ��� �� �� �� ��

� �� �����. ���� false���.

-was_home was_home_dir

WebSphere Application Server ��� � ����� �� ��� �� ��

���. -action {configWAS4|configWAS5} �� -action

{unconfigWAS4|unconfigWAS5} �� � ��� ������.

��� c:\WebSphere\AppServer� ����.

pdwascfg ����� UNIX ������ �����, Windows ������ �

� �� �����. config� �� ����, ����� �� ��� ����

�.

v Tivoli Access Manager for WebSphere ����� WebSphere �����.

v Java ��� com.tivoli.mts.SvrSslCfg ���� Tivoli Access Manager for

WebSphere � ����� Policy Server � Authorization Server ��� SSL

��� �����.

v ��� ���� Tivoli Access Manager for WebSphere ���� �� ID

����.

����� �� �� ������ ��� ��� � �� �� ���� �

� �����. %WAS_HOME% �� ��� WebSphere Application Server ��

���� ������. %PDWAS_HOME%� Tivoli Access Manager for

WebSphere �� ����� ������. pdwascfg �� �� �� �� ��

Java �����.

112 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 131: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

v -Dpdwas.lang.home

� � ���� ����� Tivoli Access Manager for WebSphere� ��

���� ��� � �����. � ����� Tivoli Access Manager for

WebSphere �� ���� ��� ������� ����. � ��, ��� �

���.

-Dpdwas.lang.home=%PDWAS_HOME%\java\nls

v -Dpdwas.home

Tivoli Access Manager for WebSphere� �(��) ����. � ��, ���

����.

-Dpdwas.home=%PDWAS_HOME%

�: � �� ��� � �� �� Tivoli Access Manager for WebSphere �� �

� ��� ���� �����.

v -Dwas.home

WebSphere Application Server� �(��) ����. � ��, ��� ����.

-Dwas.home=%WAS_HOME%

pdwascfg� � �� � Java ��� ��� ����.

java -Dpdwas.lang.home=%PDWAS_HOME%\java\nls-Dpdwas.home=%PDWAS_HOME%-Dwas.home=%WAS_HOME%PDWAScfg -action configWAS5-remote_acl_user pdpermadmin-sec_master_pwd myPassword-was_home c:\WebSphere\AppServer

-pdmgrd_host pdmgrserver.mysubnet.ibm.com -pdacld_host pdacldserver.mysubnet.ibm.com

���

� ��� ��� �� �� �� ����� �����.

v UNIX:

/opt/amwas/sbin/

v Windows ���� ��:

C:\Program Files\Tivoli\amwas\sbin\

��� ��� �� ����� �� � ����� �� ����

(�: install_dir\sbin\) ��� sbin ����� ����.

�� ��

��� �� �� �� ��� ��� � ����.

0 ��� ������.

1 ��� ������.

�� A. �� �� 113

Page 132: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� ���� �� ���� ����. ���� �� �� ��� IBM

Tivoli Access Manager Error Message Reference ������.

114 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 133: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

migrateEAR4�� �����(������ ���� �)�� Tivoli Access Manager for

WebSphere Application Server �� 4.0.6�� �� policy �� ������

�.

migrateEAR4 -j absolute_pathname_to_application_EAR_file -c URI -a admin_ID

-p admin_pwd -w Websphere_admin_ID -d user_registry_domain_suffix [-r

root_objectspace_name] [-t ssl_timeout] [-e enterprise_application_name]

���

-a admin_ID

Tivoli Access Manager �� �� �����. � ���� ��, �

�� � ACL� ��� � ��� �� ��� ���. � ��, -a

sec_master���.

� ���� ����. ���� ���� �� ��, ���� ���

� �� �� ��� ����� ����� ����.

-c URI

pdwascfg����� ���� PdPerm.properties �� URI(Uniform Resource

Indicator) �� �����. WebSphere Application Server� �� ��� �

���, URI� ��� ����.

v Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PdPerm.properties

v AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

v Windows

– WebSphere Application Server 4:

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

– WebSphere Application Server 5:

file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

-d user_registry_domain_suffix

�� ������ ���� ��� ��� �����. � ��, LDAP �

� ������ �� �� ��� �� ��� ������.

"o=ibm,c=us"

�: Windows��� ��� ��� �� � ��� ���.

�� A. �� �� 115

Page 134: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

-e enterprise_application_name

���� ��� ���� ��� ��� � ��� �� ��� ����

� � ������� ���. �� ���� �� ��, �����

.ear � �� .xml �� ���� ���� ��� ���� ����

�.

���� �� � �� ��� WebSphere �� � ���� ���

��� � ����. � ����� EAR �� ��� ����. � ��� �

��� EAR �� ���� �� ��, ��� �� ���� ����.

WebSphere Application Server �� �� �� ����� ��� ��

��� -e �� ������.

-j absolute_pathname_to_application_EAR_file

Java 2 Enterprise Edition ���� ���� �� �����. � ��

��� EAR ����� �� ����.

� ��, -j /tmp/test_application.EAR���.

-p admin_pwd

Tivoli Access Manager �� ��� � �����. �� ���� �

�, ��� � ACL� ��� � ��� �� ��� ���. � ��,

-a sec_master �� ��� � -p myPassword� ��� � ����.

� ���� ����. ���� �� ��, ���� �� �� ��

� � ����� ����� ����.

-r root_objectspace_name

WebSphere Application Server� � �� �� ��� �� �� �� �

�� �� ��� �� ��� �� ��� �����. � ���� ��

��. �� ��� ��� ���� WebAppServer���.

���� �� ��� ��� ��, � ��� ��� ������

PDWAS.properties �� ����� ���.

�� �� ��� �� ��� �� ��� �����. ��� �� ��� �

��� ���� �� �� ��� �� �����.

-t ssl_timeout

SSL ����(�)� �����. � ���� �� ��� ������ ��

Tivoli Access Manager Authorization Server� Policy Server ��� SSL �

��� ��� ���� �� ���� � �����.

���� 60����. ��� 10����. ��� Tivoli Access Manager

ssl-v3-timeout �� ���� ����. ssl-v3-timeout� ���� 120�

���.

116 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 135: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� ����. � �� ��� ���� �� ��, ���� ��

�� �� ����.

-w WebSphere_admin_ID

��� WebSphere Application Server �� �� ����� ��� ���

�� �� ��� �����. Tivoli Access Manager �� ��� ���

��� ����� � ��� ���� ���.

WebSphere �� ��� �� ��� ��� �� ���� �� ��, � �

�� ��� �����. � ��, ��� �� � � �� ���� �

�� invalid� �����. � � ��� �� � ��� valid� ��

� ���.

�� ��� � ACL� ����. �� ��� �� ACL ��� ��

pdwas-admin ��� �����.

v T -- traverse �

v i -- invoke �

v WebAppServer -- �� �� ��. WebAppServer� �� �����.

���� ����� -r ��� ���

admin.ear �� ����� ��, pdwas-admin ��� �� �� �

�� ���.

� ����� �� �����(������ ���� �)�� Tivoli Access Manager

for WebSphere� �� policy �� �������. ����� UNIX ���

��� �����, Windows ������ �� �� �����. ����� Java

��� com.tivoli.pdas.migrate.Migrate �����.

����� �� �� ������ ��� ��� � �� �� ���� �

� �����. ����� �� �� �� Java �����.

v -Dpdwas.lang.home

� � ���� ����� Tivoli Access Manager for WebSphere� ��

���� ��� � �����. � ����� Tivoli Access Manager for

WebSphere �� ���� ��� ������� ����. � ��, ��� �

���.

-Dpdwas.lang.home=%PDWAS_HOME%\java\nls

v -cp %CLASSPATH% com.tivoli.pdwas.migrate.Migrate

CLASSPATH� Java ��� � ����� ���.

�� A. �� �� 117

Page 136: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� Windows�� -j �� -c �� � � �� %WAS_HOME%� ����

WebSphere Application Server� ��� �� ��� � ����. � ��� ��

��� �����.

v ������ ���� �� �� �� ��� �� ��

v �� URI �� ��� PdPerm.properties �� ��� �� ��

���

� ��� ��� �� �� �� ����� �����.

v UNIX:

/opt/amwas/bin/

v Windows ���� ��:

C:\Program Files\Tivoli\amwas\bin\

��� ��� �� ����� �� � ����� �� ����

(�: install_dir\bin\) ��� bin ����� ����.

�� ��

��� �� �� �� ��� ��� � ����.

0 ��� ������.

1 ��� ������.

��� ���� �� ���� ����. ���� �� �� ��� IBM

Tivoli Access Manager Error Message Reference ������.

118 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 137: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

migrateEAR5�� �����(������ ���� �)�� Tivoli Access Manager for

WebSphere Application Server �� 5.0.2� �� policy �� �������.

m i g r a t e E A R 5 - j p a t h - c U R I - a a d m i n _ I D - p a d m i n _ p w d - w

Websphere_admin_user -d user_registry_domain_suffix [-r root_objectspace_name]

[-t ssl_timeout] [-e enterprise_application_name]

���

-a admin_ID

�� �� ID �����. �� ���� ��, ��� � ACL�

��� � ��� �� ��� ���. � ��, -a sec_master���.

� ���� ����. ���� ���� �� ��, ���� ���

� �� �� ��� ����� ����� ����.

-c URI

pdwascfg ����� ���� PdPerm.properties �� URI(Uniform

Resource Indicator) �� �����. WebSphere Application Server� ��

��� ����, URI� ��� ����.

v Solaris, Linux, HP-UX

file:/opt/WebSphere/AppServer/java/jre/PDPerm.properties

v AIX

file:/usr/WebSphere/AppServer/java/jre/PdPerm.properties

v Windows

– WebSphere Application Server 4:

file:/c:\WebSphere\AppServer\java\jre\PdPerm.properties

– WebSphere Application Server 5:

file:/"c:\Program Files\WebSphere\AppServer\java\jre\PdPerm.properties"

-d user_registry_domain_suffix

�� ������ ���� ��� ��� �����. � ��, LDAP �

� ������ �� �� ��� �� ��� ������.

"o=ibm,c=us"

�: Windows��� ��� ��� �� � ��� ���.

-e enterprise_application_name

���� ��� ���� ��� ��� � ��� �� ��� ����

�� A. �� �� 119

Page 138: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� � ������� ���. �� ���� �� ��, �����

.ear � �� .xml �� ���� ���� ��� ���� ����

�.

���� �� � �� ��� WebSphere �� � ���� ���

��� � ����. � ����� EAR �� ��� ����. � ��� �

��� EAR �� ���� �� ��, ��� �� ���� ����.

WebSphere Application Server �� �� �� ����� ��� ��

��� -e �� ������.

-j path

Java 2 Enterprise Edition ���� ���� �� � �� � ��� �

� �����. ���, � ��� �� ������ ������ ���

�� � ����.

� ��, -j /tmp/test_application.EAR���.

-p admin_pwd

Tivoli Access Manager �� ��� � �����. �� ���� �

�, ��� � ACL� ��� � ��� �� ��� ���. � ��,

-a sec_master �� ��� � -p myPassword� ��� � ����.

� ���� ����. ���� �� ��, ���� �� �� ��

� � ����� ����� ����.

-r root_objectspace_name

WebSphere Application Server� � �� �� ��� �� �� �� �

�� �� ��� �� ��� �� ��� �����. � ���� ��

��.

�� ��� ��� ���� WebAppServer���. ���� �� ��� ��

� ��, � ��� ��� ������ PDWAS.properties �� ��

��� ���.

�� �� ��� �� ��� �� ��� �����. ��� �� ��� �

��� ���� �� �� ��� �� �����.

-t ssl_timeout

SSL ����(�)� �����. � ���� �� ��� ������ ��

Tivoli Access Manager Authorization Server� Policy Server ��� SSL �

��� ��� ���� �� ���� � �����.

���� 60����. ��� 10����. ��� Tivoli Access Manager

ssl-v3-timeout �� ���� ����. ssl-v3-timeout� ���� 120�

���.

120 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 139: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� ����. � �� ��� ���� �� ��, ���� ��

�� �� ����.

-w WebSphere_admin_user

��� WebSphere Application Server �� �� ����� ��� ���

�� ��� �����. Tivoli Access Manager �� ��� ��� ��

� ����� � ��� ��� �� �����.

WebSphere �� ��� �� ��� ��� �� ���� �� ��, � �

�� ��� �����. � ��, ��� �� � � �� ���� �

�� invalid� �����. � � ��� �� � ��� valid� ��

� ���.

�� ��� � ACL� ����. �� ��� �� ACL ��� ��

pdwas-admin ��� �����.

v T -- traverse �

v i -- invoke �

v WebAppServer -- �� �� ��. WebAppServer� �� �����.

���� ����� -r ��� ���

adminconsole.ear �� ����� �� �� �� pdwas-admin

��� ������.

� ����� �� �����(������ ���� �)�� Tivoli Access Manager

for WebSphere� �� policy �� �������. ����� UNIX ���

��� �����, Windows ������ �� �� �����. ����� Java

��� com.tivoli.pdas.migrate.Migrate �����.

����� �� �� ������ ��� ��� � �� �� ���� �

� �����. ����� �� �� �� Java �����.

v -Dpdwas.lang.home

� � ���� ����� Tivoli Access Manager for WebSphere� ��

���� ��� � �����. � ����� Tivoli Access Manager for

WebSphere �� ���� ��� ������� ����. � ��, ��� �

���.

-Dpdwas.lang.home=%PDWAS_HOME%\java\nls

v -cp %CLASSPATH% com.tivoli.pdwas.migrate.Migrate

CLASSPATH� Java ��� � ����� ���.

�� A. �� �� 121

Page 140: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� Windows�� -j �� -c �� � � �� %WAS_HOME%� ����

WebSphere Application Server� ��� �� ��� � ����. � ��� ��

��� �����.

v ������ ���� �� �� �� ��� �� ��

v �� URI �� ��� PdPerm.properties �� ��� �� ��

���

� ��� ��� �� �� �� ����� �����.

v UNIX:

/opt/amwas/bin/

v Windows ���� ��:

C:\Program Files\Tivoli\amwas\bin\

��� ��� �� ����� �� � ����� �� ����

(�: install_dir\bin\) ��� bin ����� ����.

�� ��

��� �� �� �� ��� ��� � ����.

0 ��� ������.

1 ��� ������.

��� ���� �� ���� ����. ���� �� �� ��� IBM

Tivoli Access Manager Error Message Reference ������.

122 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 141: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� B. ���

� ��� ���� ���� �� � ������ �� ����. IBM� �� �

���� � �� ��� ��, ��� �� ��� ���� �� �� ����. �

� ��� � �� �� � ���� �� ��� �� IBM �� �����

�. � ��� IBM ��, ��� �� ��� ��� �� � IBM ��, �

�� �� ����� ��� � ��� �� ����� ����. IBM� �� �

�� ��� �� �, ����� �� ��, ��� �� ��� �� ��

� � ����. � � �IBM ��, ��� �� ���� ��� �� �� � �

� ��� �����.

IBM� � ��� �� �� �� ��� � �� ��� �� �� ��

�� �� � ����. � �� ���� � ��� �� ������ ����

�� ����. ����� �� ����� ���� ������.

135-270

����� ��� �� 467-12, ������ �

�� ��.�.� ����

�����

����: 080-023-8080

2��(DBCS) ��� �� ���� ��� �� IBM ������ ����

�� ��� �� ����� ���

IBM World Trade Asia Corporation

Licensing

2-31 Roppongi 3-chome, Minato-ku

Tokyo 106, Japan

�� ��� ��� ���� ���� �� ����� ��� ����. IBM�

��� � ��, ��� � �� ���� ���� �� ��� �� ����

(�, �� ��� ��) ����� ����� �� ��� ��� � �� “��

���” �����. �� ����� �� ��� ��� �� ��� �� ��

��� ���� ����, � ��� ���� �� �� ����.

� ���� ����� ���� ���� ���� ��� �� � ����. � �

�� ����� ����, ��� ��� ��� �����. IBM� � ��� �

�� �� �(��) ���� �� ���� ��� � �(��) ��� � ��

��.

© Copyright IBM Corp. 2002, 2003 123

Page 142: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� ��� �IBM� ���� �� ��� ��� ���, �� ���

�� �� ��� ��� �� �� ����. � ���� �� �

IBM �� �� ��� ���� � ��� ���� �� ��� �� ��

� ��� ���.

IBM� ��� � ��� �� �� ��� ���� ���� ���� ��

� ��� �� ���� ��� � ����.

(i) ����� �� ���� �� ���(� ��� ��) �� �� � �

(ii) �� ��� �� ��� ���� �� ��� ��� ���� ���

�� ��� ������.

135-270

����� ��� �� 467-12, ������ �

�� ��.�.� ����

�����

� � ��� � ��(� ��, ��� � �)� �� ��� � ����.

� ��� ��� ����� ��� ��� � �� ��� �� ����� ��

�� IBM� IBM �� ��, IBM ��� ���� ��(IPLA) �� �� �

� ��� �� ��� ����.

� ��� ��� �� �� ���� ��� ���� ��� ����. ��� ��

� ���� ��� ��� ��� � � ����. �� ��� �� �� ���

����� ����� � ���� � � ���� ����� ��� �� ���

��� �� ��� ��� � �� � ����. ��, �� ��� ��� �

����� �� ���� �� ��� � � ����. � �� ��� �

��� ��� �� ���� �� ���.

�IBM ��� �� ��� � ��� ����, �� � �� �� �� �� �

���� �� ����. IBM��� � � �IBM ��� ����� �����, �

� ��� ��� ��� ���, ��� �� �� ��� ��� ��� � ���

�. �IBM ��� ��� �� ����� � ��� ����� ������.

IBM� ���� �� �� ��� �� �� �� ��� ���� ��� � �

���.

� ���� ��� ���� ��� ���� � � � �� �� ��� ��

����. � ���� ��� ��� ��� ���� � ��, ��, � � �

�� ��� ��� � ����. �� ��� �� ��� ��� �� ��� ��

� ��� ��� �� �� ���� �����.

� :

124 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 143: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� ���� � � ����� ���� ��� ���� ��� � � �

����� �� ����. ��� � ���� � ��� � � ��� �

���� ���� ������ ���� ������ ��, ��, �� �

���� �� ���� � � � ���� �� ���� �� ���� ��, �

� � ��� � ����. � � ��� �� ����� ��� ���� �� ��

��. ��� IBM� � � ���� ��, ��� ��� �� ��� ��

� ��� ����. ��� IBM� ����� ���� ������ ����

������ ��, ��, �� � ���� �� ���� � � � ���

� �� ���� �� ���� ��, �� � ��� � ����.

� � � ��� �� � ��� � ���� � ���� ��� ��� ��

� �� ����� ���.

© (��� ���) (��). � ��� ��� IBM Corp. � ����� ���

�. © Copyright IBM Corp. _��_. All rights reserved.

� �� ������ �� ���� ��� � �� ��� �� �� ���

�.

��

�� ��� �� �� �� ���� ���� IBM Corporation� � �� ��

� ���.

AIX

DB2

IBM

IBM �

SecureWayTivoli

Tivoli �

Microsoft, Windows, Windows NT � Windows � � �� �� �� ����

���� Microsoft Corporation� � ���.

Java � �� Java �� �� � � � � �� �� �� ���� ���� Sun

Microsystems,Inc� � �� �� � ���.

UNIX� �� �� �� ���� ���� Open Group� ��� ���.

�� ��, �� � ��� ��� ��� � � ��� ���.

�� B. ���� 125

Page 144: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

126 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 145: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��

�� ���(virtual hosting). ���� � ��� ���� �

���� �� ��� ��.

�� �(private key). ��� ���� ���� ��� �

�� . �� � ��.

�� �(public key). ��� ���� �� ��� ���

� �� . �� � ��.

�� ���(management domain). Tivoli Access Manager

� �, � �� � ��� �� � �� policy ��

�� �� ���. � ���� Policy Server� ��� �

����. ���(domain) ��.

�� ��(management server). �� ���� ����.

Policy Server ��.

�� ���(administration service). Tivoli Access Manager

� �� ������ �� �� ���� � ��

� � �� � API ��� ��. �� ���� �� �

�� �� �� �� �� ��� ��� ���� ��

�� ��� ���� � pdadmin ��� � �� �

� �����. �� � ADK ���� � � ���

��� � ����.

�� ��(distinguished name:DN). ���� ��� ���

���� � ��. �� ��� ��:��� ����, �

� �����.

��(configuration). (1) �� �� ���� ���� � �

����� ���� �� ���� ��. (2) ���, ����

� �� ���� ���� ���, ��� � ���.

�� (authorization rule). �(rule) ��.

�� ��� ����(authorization service plug-in). � API

��� ��� ����� ���� �� ���� �, �

�� � Tivoli Access Manager � API ��� ����

�� ��� � �� ��� �� ��� ��� �(DLL �

� �� ��� �). �� �� ��� ��� �������

��, �� �, � �� ��, � � PAC � ����

�� ����. �� � ADK ���� � � ���

��� � ����.

�� ���(entitlement service). ���� �� �� ���

�� ����� �� ���� � ��� � �� � API

��� ��. �� �� �� ���� � �� �

����� ���� ��� � ������ ���� �

����� � ��� ��� ���� �� ����

��. �� � ADK ���� � � ��� ��� �

����.

�� �� � ���(credentials modification service).

Tivoli Access Manager � �� ���� � ��� �

�� � API ��� ��. �� ���� ��� �

�� �� ���� � �� �� ��� ��� � ���

� ��� � � ����� ����, �� ��� ��� �

��� ������ �����.

�� ��(credentials). � ��� �� �� ���, ��

, �� �� � �� �� �� ID ��� � �����.

� �� ���� �, �� � ��� �� � � ���

��� � ����.

��(authorization). (1) ��� ���� ���� ���

� ���� ��� � ��� ��� ���� �. (2) �

��, � �� ��� �� ���� ��� ��� �

�� ���� ����.

��(entitlement). ���� �� policy �� ���� �

�� ��. ��� �� ������ �� � �� �

��� ���� �� �� policy ���� ����.

��(permission). ��� ����� �� �� ����

���� � �� ��. ���� ��� � �� ���

ACL(Access Control List)�� �����. ACL(Access Control

List) ��.

�� ��(basic authentication). �� ��� �� ���

� � �� �� ����� ��, ��� � �� �

� � � ��� �� � ���.

© Copyright IBM Corp. 2002, 2003 127

Page 146: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

���� �� ��(network-based authentication). ��

� IP(Internet Protocol) �� ��� ��� ��� �

��� �� ��� policy(POP). POP(Protect Object Policy)

��.

�� �� ��(multi-factor authentication). ��� � �

��� � ��� ���� ���� �� ���� �� �

�� policy(POP). � ��, �� �� �� ��� ��

�� ��� �� ��/�� �� ��/�� � ��

� �� �� ���. POP(Protected Object Policy) ��.

��� ��(step-up authentication). �� ��� � ��

�� ��� ����, �� policy ��� �� �� ���

�� �� ���� �� ��� policy(POP). ��� �

POP ���� ��� ��� �� ����� � �

��� �� ���� ��� ���, ��� �� ��

���� policy�� ���� ���� �� ���.

��� ��(domain name). ��� ������� ��� �

��� ��. ��� ��� ���� ���� ��� �� �

��� �����. � ��, ��� ���� ��� ���

��(FQDN)� as400.rchland.vnet.ibm.com� ��, ��� �

� ��� ��� � � . as400. rchland .vnet . ibm.com,

vnet.ibm.com, ibm.com.

���(domain). (1) �� ��� ���� �� ���� �

��� ���� ��, ��� � �� �� ���. (2) �

�� �� �� �� �� �� �� ��� ���� ��.

��� ��(domain name) ��.

���� ���(directory schema). ����� ��� � �

� � �� �� � ��� ���. �� �� � ��

� ���� �� � ��(� ��, �� ��� ��� �

��, �� ����� � �� ��� ��� � ���)�

�����.

��(daemon). ���� ��� �� �� �� ����� �

�� ��� ��� ���� � ���� ���� ���.

�� ��� � ��� ���� � �� ��� ,

��� ��� ����� ���.

��� ��(digital signature). e-commerce�� ��� ��

� ���� ��� ��� � ��� ��� ����, �

�� �� ��� ��� ��� � �� ��� �� �

��� ��� � � ���.

� ��(routing file). ��� ��� ���� ��� �

��� ASCII �.

���(run time). ��� ���� ���� ��. ��� �

�� �� �����.

�����(registry). ��, ��� � ������ �� �

�� � �� �� ���� ��� ���.

(rule). ��� ��� ��� �� ��(��� ��) ��

� �� �� ��� ��� � ��� �� �� ��

� �� ���.

������(migration). �� ���� ��� �� �

���� � ���� ��� ���� �.

�����(metadata). ��� ���� ��� ���� ��

�.

���(bind). ID ��� �� �� ���� ����

�. � ��, ID �, �� �� �� ID� ����, ��

�� ��� � �� ���� ���� �.

�� ��(security management). ��� ��� ��� �

�� � ����� ��� ���� �� ��� ���

���� �� ��.

�� �(quality of protection). �, ��� � ����

� �� ���� ���� ��� �� ��.

�� � � �(protected object space). ACL � POP

���� � ���� �� ��� � ��� ���

� �� ��� �� �� ��� �. �� ���

(protected object) � POP(Protect Object Policy) ��.

�� � �(protected object). ACL � POP ���� �

���� �� ��� � ��� ���� �� ���

128 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 147: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� �� �. POP(Protect Object Policy) � �� ��

� ��(protected object space) ��.

��(replica). �� ��� ���� ��� ���� ��.

���� ��� �� ��� ��� ��� ���� ��

�� � �� ����.

����(blade). ���� �� ��� � ���� �

��� ����.

��� ��(business entitlement). �� �� � �

�� ��� � �� �� ��� ���� �� � ��

� �� ��.

��� �����(user registry). �����(registry) ��.

���(user). �� ��, ��, ����, ���, ���,

���� �� ����� ���� ��� ���� �� �

�, ��, ����, ���, ���, ���� �� ���.

���(service). ���� ���� �. ���� ��� �

�� ���� �� ��� ���(� ��, HTTP �

�, � �� �� � � ����), �� �� �� ���

� ��� ���� �� ��� �� � ����.

�� �(attribute list). �� ���� � ���� �

� �� ���� ��� ��. �� ��� �� = � �

� �����.

���(schema). ����� �� ��� ���� ��

� ���, ��� �� �� ����. ��� �����

�� �� ���, � ���� ��, ��� ��� �� �

� �����.

��� �(trusted root). SSL(Secure Sockets Layer)

�� CA(Certificate Authority)� �� � ��� �� �

�.

���(encryption). ��� ���� �� ��� �

� ������ ���� � � ��� �� ��� ���

� ����.

��(cipher). ���� �� ���� ��(� �)�

� ��� �� � ��� ��� ���.

�� ��(access permission). �� ���� ���� �

�� �.

�� ��(access control). ��� ���� �� �� �

��� �� ��� ���� ��� �� ���� � �

�� ���� ����.

�� ��(role assignment). ��� � �� ��� �

��� � ��� ��� �� �� ���, ���

�� ���� ����.

�� ���(role activation). �� ��� �� ����

����.

�(connection). (1) ��� ���� �� ��� �� ��

�� ��� ���� ��. (2) TCP/IP�� �� � �� �

�� ��� �� ��� ���� � �� ���� ��

�� ��� ��. ����� ��� � ���� TCP �

����� �� ���� TCP ������ �����.

(3) ��� ���� � ��� �� �� ���� ��� �

�� ��� ��� � �� � .

�� �� ���(external authorization service). Tivoli

Access Manager � �� ��� ��� ���� �� �

� �� � ��� � ��� � �� � API ���

��. �� � ADK ���� � � ��� ���

� ����.

� ��(response file). ����� ��� ��� ��

�� ��� �� �� ����, ��� ��� �� ���

� �� ���� �.

���(certificate). ��� ���� �� �� ��

� ID� ���� �� �� �� � ��� �� �

� ��. ��� CA(Certificate Authority)�� �����.

��(authentication). (1) ��� ���� �� ID �� �

�� ��� ��� �� ���� �. (2) ��� ���

� ���� �� �� ���� ���� ���� �. (3) �

�� ���� �� ����� �� �� �� ����

� ���� ����. �� �� �, ���� �� �

(authentication) � ��� �(authentication) ��.

��� �����(Internet suite of protocols). �����

���� � ���� IETF(Internet Engineering Task Force)

� RFC(Requests for Comment)� ��� ���� ��.

�� 129

Page 148: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

�� ��(silent installation). ��� �� ��� ���

�� �� �� ���� �� ���� ��. �� �

���� ��� ��� � �� �� ��� � ����.

�� �(response file) ��.

�� � �(resource object). ���, � � ����

�� �� ���� �� �.

�� ��(self-registration). ��� ��� ��� ���

� � ��� ���� ��� Tivoli Access Manager �

�� � � �� ����.

���(suffix). ��� ���� ���� �� ���� � �

��� ���� �� ��. LDAP(Lightweight Directory

Access Protocol)�� ���� ��� ���� ���� �,

� ���� ���� �� �� �� �� �� ��� ���

��. ���� ���� ��� ���� ���� �� �� �

�� ���� � �� ���� �� � ����.

��(action). ACL(Access Control List) � ��.

ACL(Access Control List) ��.

��� � �(container object). ��� ��� ���

�� region� ���� ��� ��.

�(cookie). ��� ���� ���� ��� �� �

�� ����� ��. �� ��� ����� �� �� �

� ��� � � ���.

�� �� ��(scalability). �� ����� �� ��

�� ���� �� ���� ��� ��.

� ������ ��(key database file). �(key ring) �

�.

� �(key ring). ��� ���� �� , �� , ���

� �� � �� ���� �.

� �(key pair). ��� ���� �� � �� . �

�� � ��� �, ��� �� ���� ���

��� , ��� �� ���� ��� �

����. ��� � ��� �, ��� �� ��

�� ��� � ��� , ��� �� ���� �

� ��� � ��� � � ����.

� ��(key file). �(key ring) ��.

�(key). ��� ���� ��� �� � � �� �

�� � ���� ���� ��� ��. �� � ��

��.

�(token). (1) � �� �� ���� ��� ��

� �� �� ��� ��� � ��� ��� �� ��

��� ���� � ��. ��� ��� ����� �

���� � ��� ��� ��� ��� ����. ���

�� �� ��� �� ���� �� �����. (2) �

�� (LAN)�� �� �� �� ��� �� ���� �

� ���. ��� ���� ��� ��, � ��� ���� �

��.

��(portal). �� ��� ��� �� ����, �� �

�� �� ��� �(�: ��, �� �� ���)� �

� �� ��� ��� ��� �� ���.

�(polling). ���� �� �� ���� � ����

� ����� ���� ����.

���(host). ����(�: ��� �� SNA ����)� �

��� � � ����� ����� ��� ���� ���.

�� ���� ��� �� ����� �� ���� �� �

�� �� ����. ���� ����� ��, �� ��

���� � �� � �� � � ����.

A

ACL. ACL(Access Control List) ��.

ACL(Access Control List). ��� ���� ���� �

��� � �� �� ��� ��� ��� �� ����,

���� ���� ��. � ��, ACL� �� ����

� �� �� ��� , � �� � ��� �� �

� ��� �� ����, �� ���� �����.

B

BA. �� �(basic authentication) ��.

130 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 149: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

C

CA. CA(Certificate Authority) ��.

CA(Certificate Authority). �� ���� ��.

CA(Certificate Authority)� �� ��� ID� � ��

� �� �� ��� ��� �, � �� ��, �� �

� ���, ��� �� �� �� ��� �� �

� �� �����.

CDAS. CDAS(Cross Domain Authentication Service) ��.

CDAS(Cross Domain Authentication Service). ��

WebSEAL � ����, Tivoli Access Manager ID

WebSEAL� ���� �� �� ����� �� ���

�� �� ��� � ���� ���� WebSEAL ���.

WebSEAL ��.

CDMF. CDMF(Cross Domain Mapping Framework) ��.

CDMF(Cross Domain Mapping Framework). ���

WebSEA e-Community SSO ��� ��� � �� ID �

� � �� �� �� ��� � ��� � � ��

���� �����.

CGI. CGI(Common Cateway Interface) ��.

CGI(Common Cateway Interface). HTTP �� �

���� ������ �� ���� ���� ���

� �� ��� �. ��� ��� ������. CGI ��

��� Perl� �� ���� �� �� CGI �����

�.

D

DN. �� ��(distinguished name:DN) ��.

E

EAS. �� � ��� ��

F

FTP(File Transfer Protocol). ��� ������� ���

�� ��� ��� �� ��� �� ���� � TCP�

Telnet ��� ���� ���� �� ����.

G

GSO. GSO(Global Signon) ��.

GSO(Global Signon). ��� �� �� � � �

� ���� ��� ��� � ��� �� �����

�� �� � �. ��� �� �� �� ���� � �

�� ��� �� �� ��� �� ���� � �

��. ���� �� ��� �� ��� � ��� � �

����� ��� � ��� ������� ��� ���

� GSO ���� ��� � �� ��� � ��

�� ��� ���. GSO(Global Signon) ��.

H

HTTP. HTTP(Hypertext Transfer Protocol) ��.

HTTP(Hypertext Transfer Protocol). ��� ������

� �� ��� �� ��� ��� � ���� ��

��.

I

IP. IP(Internet Protocol) ��.

IPC. IPC(Interprocess Communication) ��.

IPC(Interprocess Communication). (1) ���� �� �

�� ���� � ���� ����. ���, ��

� �� ��� �� ����� ��� �� �����. (2) �

���� �� ��� � �� ���� � �� ����

� �� ��� � ��� �� ��� ���.

IP(Internet Protocol). ��� ������� ��� ��

��� �� ��� ���� � ���� �� ����

��� �� ���� ��� �� �� �� ���� ��

��.

J

junction. ����� WebSEAL Server� �� ��

�� �� �� HTTP �� HTTPS ��. WebSEAL�

junction� ���� �� �� �� �� ��� ���

���.

�� 131

Page 150: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

L

LDAP. LDAP(Lightweight Directory Access Protocol) ��.

LDAP(Lightweight Directory Access Protocol). (a) X.500

��� ���� ����� ���� � �� �� ����

� TCP/IP ��� , (b) ��� X.500 DAP(Directory

Access Protocol)� � ����� ���� �� ����.

LDAP ���� ����(���� �� �� ����

�� � �)� �� �� ���� �� ��(�: � ��

��, �� �� ��� �� �� ���) ��� � �

� ��� ���� ���� ��� � ����. LDAP� �

� RFC 1777� ���� �����. LDAP �� 3� RFC

2251� ���� ���, IETF� ��� �� � ��� �

��� ����. IETF�� ��� �� LDAP� � �

� RFC 2256�� � � ����.

LTPA. LTPA(Lightweight Third Party Authentication) ��.

LTPA(Lightweight Third Party Authentication). ��� �

�� �� � �� �� �� � �� �� �� ��

�� � �����.

M

MPA(Multiplexing Proxy Agent). � ���� ���

���� ����. � ����� � �����

WAP ���� �� ���� ���� ��, WAP(Wireless

Access Protocol) ����� � ���. ����� ��

��� �� �� �� ��� , �� ���� � �

��� � �� � �����.

P

PAC. PAC(Privilege Attribute Certificate) ��.

PAC ���(privilege attribute certificate service). ���

��� ��� PAC Tivoli Access Manager � ���, �

� � ��� ���� � API ��� ���� ��.

� � ���� �� ���� �� ���� ���� �

Tivoli Access Manager � �� ���� ��� ��

�� ��� � ����. �� � ADK ���� �

� ��� ��� � ����. PAC(Privilege Attribute

Certificate) ��.

PAC(Privilege Attribute Certificate). ����(��)� �

� � �� �� � ����� ��� ���� �� �

�.

policy. �� �� ���� � ��.

Policy Server. �� ����� �� ��� �� �� ��

������ Tivoli Access Manager ��.

POP. POP(Protect Object Policy) ��.

POP(Protect Object Policy). �� ���� ���� �

��� ACL policy� ���� � � �� ��� ���� �

� policy ��. POP ��� ���� �� � ��� �

����. ACL(Access Control List), �� ���(protected

object) � �� ��� ��(protected object space) ��.

R

RSA ���(RSA encryption). �� � �� ���� �

� �� ���. 1977� Ron Rivest, Adi Shamir �

Leonard Adleman� � �� �� ������. � �

� � ��� �� ����� ���� ��� ��, ���

��� �����.

S

SSL. SSL(Secure Sockets Layer) ��.

SSL(Secure Sockets Layer). �� ����� ���� �

� ����. SSL� ����/�� ����� �, ��

� ��� �� ���� � ���� ���� ��� �

� ���. SSL� Netscape Communications Corp.� RSA

Data Security, Inc.�� ������.

SSO. SSO(Single Signon) ��.

SSO(Single Signon). ��� � � ����� ��� �

���� ����� ����� � � � ����

� ���� � �� ��. GSO(Global Signon) ��

U

URI. URI(Uniform Resource Identifier) ��.

URI(Uniform Resource Identifier). � ��(���� �

� ��), � ��(���� � � ��� �� ���) �

� ��� ��(HTTP� �� ����)� ���� ����

132 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 151: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��� ���� � ���� ��. URI� � ���

�� � �� ��, � URL� ����.

URL. URL(Uniform Resource Locator) ��.

URL(Uniform Resource Locator). ���� ���� ��

������ �� �� ��� � ���. � � ��

��� (a) �� �� ����� � ���� ����� �

�� ��� (b) �� �� �� � ������ ����

��� ����. � ��, ��� ������ ��� �

� �� �� ����� � ���� ����� ��� �

����(�: http, ftp, gopher, telnet, news). IBM � ���

� URL� http://www.ibm.com���.

W

WebSEAL. Tivoli Access Manager ����. WebSEAL�

�� ��� ��� �� policy ���� ��� �� �

�� �����. WebSEAL� �� �� � �� ��

� �� ���� �� �� �� policy� ��

� � ����.

WPM. WPM(Web Portal Manager) ��.

WPM(Web Portal Manager). �� ����� Tivoli Access

Manager Base � WebSEAL �� policy ���� � �

��� �� ��� ����. pdadmin ��� ���

��� �� ����, � GUI� �� �� ��� ���

� , ��� ��� �� ���� ��� � ���

� �� �� ��� � � ���.

�� 133

Page 152: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

134 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 153: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

��

����� �� xi

�� ��

pdadmin 64

Web Portal Manager 64

�� ��

WebSphere

� 33

�� API 10, 64

��

� � �� 65

�� ��� 31

�� ��� 31, 47

Tivoli Access Manager 31

�� ���

�� 64

� �� 3

�� 5

����� ��

��� �� �� 63

���, �� 37

� � ��

�� 65

���� 17

��� ���� 14

����� 75

������� ����

�� 53

�� 41, 57, 93, 103

�� 53

���� 58

�� �� 41, 57, 93, 103

��� 91, 102

��

�� �� �� 5

�� �� �� 55

�� ���� �� 5

��� ���� 14

��� �� 59, 80

��� � 59, 80

����� ����� 3, 6, 53, 58

� 82

��

2

��� 2

�� ��� ����

WebSphere �� 4.0.6 39

WebSphere �� 5.0.2 41

�����

�� �� 55

�� �� �� 18

�� �����

�� 3, 15

���� 17

LDAP 17

�� �� 18

�� �� �����

Tivoli Access Manager �� 16

�� 2

�� �� 13

�� 1

����� �� 13

������ ��

���� 8

�� 8

�����

Access Manager 3.9�� 18

Policy Director 3.8�� 18

© Copyright IBM Corp. 2002, 2003 135

Page 154: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

� 5

� �� �� 4

� �� policy ����� ���

�� 66

� �� 55

� ��

�� 66

����

��� �� 14

��� 14

���

�� �� 13

����

migrateEAR4 115

migrateEAR5 119

pdwascfg 110

��� �

WebSphere �� �� 33

�� �

�� 65

�� � ��

�� �� 65

AIX 107

HP-UX 107

Linux 107

Solaris 105

Windows 106

�� �� 13

���� �� �

�� 66

�� 75

����� ���

�� 66

������ �� 2

���� 5

���� ��

�� 66

������

�� 83, 94

���� ���� �� 91, 102

�� �� 83, 94

�� � �� 82

�� �� 86, 97

�� ���

Servlet 90, 101

Thick ���� 90, 101

� �� 93, 104

LDAP� �� �� 85, 95

��� �� �� 18, 63

AACL(Access Control List) 5

admin.ear 39, 42, 54, 91, 102

Advanced Edition 3

amwas_migrate.log 57, 93, 103

Authorization Server

�� �� 68

CCLASSPATH

�� 38

com.tivoli.mts.SvrSslCfg 38

configWAS4 38

configWAS5 38

DDTD 53

EEAR � 58

GGSO ����(��) �� 70

136 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 155: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

Iinstallp 24

InstallShield 28

JJ2EE �� 4

Java �� � 64

JRE(Java Runtime Environment)

�� �� ����� �� 16

MmigrateEAR4 ���� 115

migrateEAR5 ���� 119

Ppdadmin

�� �� � 33

�� �� 18

�� �� 85, 95

� �� 93, 104

�� 9

PDPerm.properties 39, 42, 54, 91, 102

pdwascfg

�� 37, 50

pdwascfg ���� 110

pdwas-admin ��

ACL� �� 41

PDWAS.properties 64

PDWAS_HOME, �� 37

pdwas_migrate.log 41

pkgadd 23

policy ��

�� ��� 9

Rrpm 27, 107

SsetupCmdLine 37

Single Server

ACL� �� �� 57

ssl ���� � 59

SvrSslCfg

Authorization Server �� 68

swinstall 25

swremove 107

TTivoli Access Manager

�� API 10, 64

�� 31

� ����� 2

�� ��� 16

�� �� 1

� 105

Authorization Server 11

Policy Server 6, 16

policy �����

�� 11

WebSphere� �� 2

Tivoli Access Manager ��

AIX 24

HP-UX 25

Linux 27

Solaris 23

Windows 28

Tivoli Access Manager � 105

WWAS_HOME

�� 39, 42

Web Portal Manager 9, 64

WebSEAL� ���� �� �� � 76

WebSphere

�� �� 33, 34

�� ���� 89, 100

�� �� �� 9

�� ��

���� �� 57

�� URL 15

�� 86

�� � 86

�� ���� 87, 98

� 87, 98

���

���� �� 89, 100

Advanced Edition

Single Server 15, 63

�� 137

Page 156: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

WebSphere (��)

EJB � 86

Single Server

��� �� �� 18

WebSphere Advanced Edition 3

WebSphere v5.1

�� 45

WebSphere ��

�� 4.0.6�� �� 33

�� 5.0.2�� �� 34

WebSphere �

Tivoli Access Manager �� �� 69

138 IBM Tivoli Access Manager for e-business: IBM WebSphere Application Server �� ���

Page 157: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00
Page 158: IBM WebSphere Application Serverpublib.boulder.ibm.com/tividd/td/ITAME/SC32-1368... · IBM Tivoli Access Manager for e-business IBM WebSphere Application Server 5.1 SA30-2209-00

���

Printed in Denmark by IBM Danmark A/S

SA30-2209-00