IBM Tivoli Access Manager for e-businesspublib.boulder.ibm.com/tividd/td/ITAME/SC32-1366... · IBM WebSphere Application Server, Advanced Single Server Edition 5.0 |,ZT&Z Z{DYw53D

IBM Tivoli Access Manager for e-business

BEA WebLogic Server/I8O

f> 5.1

S152-0811-00

��

IBM Tivoli Access Manager for e-business

BEA WebLogic Server/I8O

f> 5.1

S152-0811-00

��

"b

Z9C>JO0d'VDz7.0,kDAZ 57 3D=< C, :yw;PDE"#

Z;f(2003 j 11 B)

>f>JCZ IBM Tivoli Access Manager V5.1.0(z7E 5724-C08)T0yPsx"PfM^)f,1=ZBf>P

mPyw*9#

© Copyright International Business Machines Corporation 2003. All rights reserved.

?<

0T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v>iDA_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v>iDZ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vvfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi

"PE" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viBase E" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viWeb 2+TE" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi*"_N< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii<u9d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii`Xvfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiiZ_CJvfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

(z!n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi*5m~'V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi>iP9CD<( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Ve<( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiYw53xp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Z 1 B riMEv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Tivoli Access Manager 2+T#M . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1+ Tivoli Access Manager k WebLogic Server /I . . . . . . . . . . . . . . . . . . . . . . 2

Tivoli Access Manager Security Service Provider Interface i~ . . . . . . . . . . . . . . . . . . 2_TMG+?p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4J4MG+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49C Tivoli Access Manager O$ . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

U>G<MsF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6I?T"ICTMIluT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Z 2 B 208>E" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9\'V=( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9ELMZf*s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9m~Hvu~ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Tivoli Access Manager policy server . . . . . . . . . . . . . . . . . . . . . . . . . . 10Tivoli Access Manager Authorization Server . . . . . . . . . . . . . . . . . . . . . . . . 10Tivoli Access Manager WebSEAL r Tivoli Access Manager Plug-in for Web Servers . . . . . . . . . . 10BEA WebLogic Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Tivoli Access Manager Java KP1 . . . . . . . . . . . . . . . . . . . . . . . . . . 11

9C20r<20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11install_amwls !n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

9C>z5CLr20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Z AIX O20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Z HP-UX O20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Z Solaris O20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Z Windows O20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Z 3 B dC}L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Z 1 ?V:dC Tivoli Access Manager Java runtime environment . . . . . . . . . . . . . . . . . 17Z 2 ?V:* startWebLogic hC CLASSPATH . . . . . . . . . . . . . . . . . . . . . . . 18Z 3 ?V:dC Tivoli Access Manager for WebLogic . . . . . . . . . . . . . . . . . . . . . 19

9CXF()9 Web &CLrdC Tivoli Access Manager for WebLogic . . . . . . . . . . . . . . 19S|nPdC Tivoli Access Manager for WebLogic . . . . . . . . . . . . . . . . . . . . . 21

© Copyright IBM Corp. 2003 iii

Z 4 ?V:dC Tivoli Access Manager r . . . . . . . . . . . . . . . . . . . . . . . . . 229CXF()9 Web &CLrdC Tivoli Access Manager r . . . . . . . . . . . . . . . . . 22S|nPdC Tivoli Access Manager r . . . . . . . . . . . . . . . . . . . . . . . . . 22

Z 5 ?V:* BEA WebLogic Server %cG<xPdC . . . . . . . . . . . . . . . . . . . . 249C WebSEAL acdC%cG< . . . . . . . . . . . . . . . . . . . . . . . . . . . 249C Tivoli Access Manager Plug-in for Web Servers dC%cG< . . . . . . . . . . . . . . . . 25

Z 6 ?V:Z BEA WebLogic Server `~qw73(|(:/73)PdC Tivoli Access Manager for WebLogic 25Z 7 ?V:bTdC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Z 4 B tC%cG< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279C Tivoli Access Manager WebSEAL xP%cG< . . . . . . . . . . . . . . . . . . . . . 27

Z 5 B \mNq . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Z Tivoli Access Manager Authorization server OtCZ(~q . . . . . . . . . . . . . . . . . . 29(} Tivoli Access Manager for WebLogic xPDC'Mi\m . . . . . . . . . . . . . . . . . . 309C]>&CLr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309C<I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32}N%wG<_T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32>} Tivoli Access Manager r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33!{dC Tivoli Access Manager for WebLogic . . . . . . . . . . . . . . . . . . . . . . . . 34JOoO<I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

9CyZm%DG<1D%cG<'\ . . . . . . . . . . . . . . . . . . . . . . . . . 34WebLogic Server WvZfl# . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

V^ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Q*JbMd(=( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Z 6 B }%8>E" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37S Solaris }% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37S Windows }% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37S AIX }% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38S HP-UX }% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

=< A. tTD~N<. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41amsspi.properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41rbpf.properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42amwlsjlog.properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

=< B. |nlYN<. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49AMWLSConfigure –action config . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50AMWLSConfigure –action unconfig . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52AMWLSConfigure –action create_realm. . . . . . . . . . . . . . . . . . . . . . . . . . . 53AMWLSConfigure –action delete_realm. . . . . . . . . . . . . . . . . . . . . . . . . . . 55

=< C. yw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57Lj . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Jcm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

w} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

iv IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O

0T

6-9C IBM® Tivoli® Access Manager for BEA® WebLogic Server®(TBF* Tivoli

Access Manager for WebLogic)#>z7)9K IBM Tivoli Access Manager D&\9

d'V* BEA WebLogic Server `4D&CLr#

IBM® Tivoli® Access Manager(Tivoli Access Manager)GZ IBM Tivoli Access Manager

z7W~PKP&CLryhDy!m~#|'V/ICZa)cs6'DZ(M\

mbv=8D IBM Tivoli Access Manager &CLr#b)z7w*/Ibv=8v[;

|Ga);VCJXF\mbv=8,bV=8*gSLq&CLr/PKxgM&

CLr2+T_T#

":IBM Tivoli Access Manager GH0"PDF* Tivoli SecureWay® Policy Director

m~DB{F#,y,TZl$ Tivoli SecureWay Policy Director m~MD5DC

',management server VZF* policy server#

6IBM Tivoli Access Manager for WebLogic Server C'8O7a)aO BEA WebLogic

Server 9C IBM Tivoli Access Manager D20"dCM\mD8>E"#

>iDA_

>\m8OD?jA_|(:

v 2+\m1

v xg53\m1

v IT hFK1

A_&l$TBZ]:

v rXx-i,|( HTTP"TCP/IP"D~+d-i(FTP)M Telnet

v WebLogic Server 53D?pM\m

v 2+\m,|(O$MZ(

g{tC2+WSVc(SSL)(E,9&l$ SSL -i"\?;;(+CM(C)"

}V){"S\c(MO$PD#

>iDZ]

>D5|,TBBZ:

v Z 1 B,:riMEv;

xv Tivoli Access Manager for WebLogic a)DO$MZ(~qDEv#

v Z 2 B,:208>E";

hvgN20 Tivoli Access Manager for WebLogic#

v Z 3 B,:dC}L;

hvgNdC Tivoli Access Manager for WebLogic#

v Z 4 B,:\mNq;

© Copyright IBM Corp. 2003 v

hvgN9C]>&CLr,"a)9C<I"JOoOE"MV^T#

v Z 5 B,:}%8>E";

hvgN}% Tivoli Access Manager for WebLogic#

vfo

4iT Tivoli Access Manager b"X8vfoT0`XvfoDhvT7(D)vf

oI\TzPoz#Z7(zh*Dvfo.s,kN<Z_CJvfoD8>E

"#

XZ IBM Tivoli Access Manager for e-business z7>mD=SE"IZTBX7R

=:

http://www.ibm.com/software/tivoli/products/access-mgr-e-bus/

Tivoli Access Manager b;i/*TB`p:

v :"PE";

v :Base E";

v :Web 2+TE";

v Z vii 3D:*"_N<;

v Z viii 3D:<u9d;

"PE"

v 6IBM Tivoli Access Manager for e-business kHDA7(G152-0804-00)

a)XZ20M*<9C Tivoli Access Manager DE"#

v 6IBM Tivoli Access Manager for e-business "P5w7(G152-0805-00)

a)}gm~V^"d(=(MD5|BDnB;FE"#

Base E"

v 6IBM Tivoli Access Manager Base 208O7(S152-0806-00)

5wgN20MdC Tivoli Access Manager Base m~,|( Web Portal Manager

SZ#CiG6IBM Tivoli Access Manager for e-business Web Security 208O7

DS/,<Zkd| Tivoli Access Manager z7(g IBM Tivoli Access Manager

for Business Integration M IBM Tivoli Access Manager for Operating Systems);

p9C#

v 6IBM Tivoli Access Manager Base \m8O7(S152-0807-00)

hv9C Tivoli Access Manager ~qDEnM}L#a)S Web Portal Manager g

fT0(}9C pdadmin |n4PNqD8>E"#

Web 2+TE"

v 6IBM Tivoli Access Manager for e-business Web Security 208O7(S152-0808-00)

a)PX Tivoli Access Manager Base m~T0 Web Security i~D20"dCM

}%8>E"#CiG6IBM Tivoli Access Manager Base 208O7D,/#

v IBM Tivoli Access Manager Upgrade Guide(SC32-1369-00)

vi IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O

http://www.ibm.com/software/tivoli/products/access-mgr-e-bus/

5wgNS Tivoli SecureWay Policy Director V3.8 r Tivoli Access Manager DH

0f>}6= Tivoli Access Manager V5.1#

v 6IBM Tivoli Access Manager for e-business WebSEAL \m8O7(S152-0809-00)

a)9C WebSEAL \m2+ Web rPJ4D30JO"\m}LM<uN<E

"#

v 6IBM Tivoli Access Manager for e-business IBM WebSphere Application Server /

I8O7(S152-0810-00)

a)CZ+ Tivoli Access Manager k IBM WebSphere® Application Server xP/

ID20"}%M\m8>E"#

v IBM Tivoli Access Manager for e-business IBM WebSphere Edge Server Integration

Guide(SC32-1367-00)

a)CZ+ Tivoli Access Manager k IBM WebSphere Edge Server &CLrxP

/ID20"}%M\m8>E"#

v 6IBM Tivoli Access Manager for e-business Plug-in for Web Servers /I8O7

(S152-0813-00)

a)9C Plug-in for Web Servers #$ Web r2+D208>E""\m}LM

<uN<E"#

v 6IBM Tivoli Access Manager for e-business BEA WebLogic Server /I8O7

(S152-0811-00)

a)CZ+ Tivoli Access Manager k BEA WebLogic Server xP/ID20"}

%M\m8>E"#

v IBM Tivoli Access Manager for e-business IBM Tivoli Identity Manager Provisioning

Fast Start Guide(SC32-1364-00)

a)k+ Tivoli Access Manager k Tivoli Identity Manager xP/I`XDNqD

Ev,"5wgN9CM20 Provisioning Fast Start /O#

*"_N<

v IBM Tivoli Access Manager for e-business Authorization C API Developer

Reference(SC32-1355-00)

a)hvgN9C Tivoli Access Manager Z( C API M Tivoli Access Manager ~

qe~SZ+ Tivoli Access Manager 2+TmS=&CLrPDN<JO#

v IBM Tivoli Access Manager for e-business Authorization Java Classes Developer


a)9CZ( API D Java™ oT5V'V&CLr9C Tivoli Access Manager 2

+TDN<E"#

v IBM Tivoli Access Manager for e-business Administration C API Developer


a)XZ9C\m API 'V&CLr4P Tivoli Access Manager \mNqDN<

E"#>D5hv\m API D C 5V#

v IBM Tivoli Access Manager for e-business Administration Java Classes Developer


a)9C\m API D Java oT5V'V&CLr4P Tivoli Access Manager \m

NqDN<E"#

0T vii

v IBM Tivol i Access Manager for e-bus iness Web Secur i ty Deve loper


a)PXgrO$~q(CDAS)"gr3dr\(CDMF)T0\kS?#iD\

mM`LE"#

<u9d

v IBM Tivoli Access Manager for e-business Command Reference(SC32-1354-00)

a)XZ Tivoli Access Manager a)D|nP5CLrME>DE"#

v IBM Tivoli Access Manager Error Message Reference(SC32-1353-00)

a) Tivoli Access Manager yzz{"D5wMFvDYw#

v IBM Tivo l i Acces s Manager for e -bus ines s Prob lem Determina t ion

Guide(SC32-1352-00)

a) Tivoli Access Manager DJb7(E"#

v 6IBM Tivoli Access Manager for e-business T\w{8O7(S152-0812-00)

a)IT IBM Tivoli Directory Server w*C'"amD Tivoli Access Manager y

9ID73DT\w{E"#

`Xvfo

>ZPvk Tivoli Access Manager b`XDvfo#

Tivoli Software Library a)KwV Tivoli vfo,}gW$i"}]m"]>"

Redbooks Myw/#Tivoli Software Library ITSTB Web >cOq!:

http://www.ibm.com/software/tivoli/library/#

Tivoli Software Glossary |,m`k Tivoli m~`XD<uuoD(e#Tivoli Software

Glossary(v"of)ISTB Tivoli Software Library Web 3fOs_D Glossary4Sq!:http://www.ibm.com/software/tivoli/library/#

IBM Global Security KitTivoli Access Manager (}9C IBM Global Security Kit(GSKit)V7.0 a)}]S

\#GSKit |,ZT&ZzX(=(D IBM Tivoli Access Manager Base CD"IBM Tivoli

Access Manager Web Security CD"IBM Tivoli Access Manager Web Administration

Interfaces CD M IBM Tivoli Access Manager Directory Server CD O#

GSKit m~|a) iKeyman \?\m5CLr gsk7ikm,|CZ4(\?}]b"+

C-(C\?TT0$iks#TBD5IS Tivoli Information Center Web >cOk

IBM Tivoli Access Manager z7D5`,D?VPR=:

v IBM Global Secur i ty Ki t Secure Sockets Layer and iKeyman User’s

Guide(SC32-1363-00)

a)KF.Zd Tivoli Access Manager 73PtC SSL (EDxgr532+\

m1DE"#

IBM Tivoli Directory ServerIBM Tivoli Directory Server V5.2 |,ZT&ZZ{DYw53D IBM Tivoli Access

Manager Directory Server CD O#

":IBM Tivoli Directory Server GH0"PD{FgBDm~DB{F:

viii IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O

http://www.ibm.com/software/tivoli/library/


v IBM Directory Server(V4.1 M V5.1)

v IBM SecureWay Directory Server(V3.2.2)

IBM Directory Server V4.1"IBM Directory Server V5.1 M IBM Tivoli Directory Server

V5.2 <\ IBM Tivoli Access Manager V5.1 D'V#

XZ IBM Tivoli Directory Server D=SE"IZTBX7R=:

http://www.ibm.com/software/network/directory/library/

IBM DB2 (C}]bIBM DB2® Universal Database™((C}]b)s5~qwff> 8.1 Z IBM Tivoli

Access Manager Directory Server CD Oa),"k IBM Tivoli Directory Server m~

;p20#Z+ IBM Tivoli Directory Server"z/OS™ r OS/390® LDAP ~qww*

Tivoli Access Manager DC'"am9C1,DB2 GXhD#

XZ DB2 D=SE"IZTBX7R=:

http://www.ibm.com/software/data/db2/

IBM WebSphere Application ServerIBM WebSphere Application Server, Advanced Single Server Edition 5.0 |,ZT&Z

Z{DYw53D IBM Tivoli Access Manager Web Administration Interfaces CD O#

WebSphere Application Server tCT Web Portal Manager SZ(CZ\m Tivoli Access

Manager)M Web \m$_(CZ\m IBM Tivoli Directory Server)b=_D'V#

IBM WebSphere Application Server Fix Pack 2 2G Tivoli Access Manager yXhD,

"Z IBM Tivoli Access Manager WebSphere Fix Pack CD Oa)#

XZ IBM WebSphere Application Server D=SE"IZTBX7R=:

http://www.ibm.com/software/webservers/appserv/infocenter.html

IBM Tivoli Access Manager for Business IntegrationIBM Tivoli Access Manager for Business Integration w*I%@):Dz7,|* IBM

MQSeries® V5.2 M V5.3 {"D IBM WebSphere® MQ a)K2+Tbv=8#IBM

Tivoli Access Manager for Business Integration 'V WebSphere MQSeries &CLr(

}9Ck"MMSU&CLrX*D\?=\X"Rj{X"M}]#s WebSEAL M

IBM Tivoli Access Manager for Operating Systems ;y,IBM Tivoli Access Manager

for Business Integration G9C IBM Tivoli Access Manager ~qDJ4\mw.;#

XZ IBM Tivoli Access Manager for Business Integration D=SE"IZTBX7R

=:

http://www.ibm.com/software/tivoli/products/access-mgr-bus-integration/

TBk IBM Tivoli Access Manager for Business Integration V5.1 `XDD5IZ Tivoli

Information Center Web >cOR=:

v 6IBM Tivoli Access Manager for Business Integration \m8O7(S152-0085-01)

v 6IBM Tivoli Access Manager for Business Integration Jb7(8O7(G152-0676-00)

v 6IBM Tivoli Access Manager for Business Integration "P5w7(G152-0518-01)

0T ix

http://www.ibm.com/software/network/directory/library/

http://www.ibm.com/software/data/db2/

http://www.ibm.com/software/webservers/appserv/infocenter.html


v 6IBM Tivoli Access Manager for Business Integration kHDA7(G152-0675-00)

IBM Tivoli Access Manager for WebSphere BusinessIntegration BrokersIBM Tivoli Access Manager for WebSphere Business Integration Brokers w* IBM Tivoli

Access Manager for Business Integration D;?Vxa),* WebSphere Business

Integration Message Broker V5.0 M WebSphere Business Integration Event Broker V5.0

a)K2+Tbv=8#IBM Tivoli Access Manager for WebSphere Business Integration

Brokers (}a)yZ\kM>$DO$"/P(eDZ(MsF~q4k Tivoli Access

Manager -,KPT#$ JMS "</$)&CLr#

XZ IBM Tivoli Access Manager for WebSphere Integration Brokers D=SE"IZ

TBX7R=:


TBk IBM Tivoli Access Manager for WebSphere Integration Brokers V5.1 `XDD

5IZ Tivoli Information Center Web >cOR=:

v 6IBM Tivoli Access Manager for WebSphere Business Integration Brokers \m8O7

(S152-0793-00)

v 6IBM Tivoli Access Manager for WebSphere Business Integration Brokers "P5w7

(G152-0794-00)

v 6IBM Tivoli Access Manager for Business Integration kHDA7(G152-0675-00)

IBM Tivoli Access Manager for Operating SystemsIBM Tivoli Access Manager for Operating Systems w*I%@):Dz7,|a)}

K>zYw53ya)DTbZ UNIX 53ODZ(_Tv?c#IBM Tivoli Access

Manager for Operating Systems s WebSEAL M IBM Tivoli Access Manager for Business

Integration ;y,G9C IBM Tivoli Access Manager ~qDJ4\mw.;#

XZ IBM Tivoli Access Manager for Operating Systems D=SE"IZTBX7R=:

http://www.ibm.com/software/tivoli/products/access-mgr-operating-sys/

TBk IBM Tivoli Access Manager for Operating Systems V5.1 `XDD5IZ Tivoli

Information Center Web >cOR=:

v 6IBM Tivoli Access Manager for Operating Systems 208O7(S152-0190-00)

v 6IBM Tivoli Access Manager for Operating Systems \m8O7(S152-0571-00)

v 6IBM Tivoli Access Manager for Operating Systems Jb7(8O7(S152-0179-00)

v 6IBM Tivoli Access Manager for Operating Systems "P5w7(G152-0185-00)

v 6IBM Tivoli Access Manager for Operating Systems kHDA7(G152-0186-00)

IBM Tivoli Identity ManagerIBM Tivoli Identity Manager V4.5 w*I%@):Dz7xa),9zIT/P\mC

'(gC'j6M\k)M)&(a)r7zT&CLr"J4rYw53DCJ)#

Tivoli Identity Manager IT(}9C Tivoli Access Manager zmLrxk Tivoli Access

Manager /IZ;p#k*5zD IBM M'zmTq!XZ:rCzmLrD|È

"#

x IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O


http://www.ibm.com/software/tivoli/products/access-mgr-operating-sys/

XZ IBM Tivoli Identity Manager D=SE"IZTBX7R=:

http://www.ibm.com/software/tivoli/products/identity-mgr/

Z_CJvfo

TB Tivoli Software Library PZ_a)>z7DIF2D5q=(PDF)M/r,D

>jGoT(HTML)q=Dvfo:http://www.ibm.com/software/tivoli/library

*ZbPR=z7vfo,k%wb3fs`D Product manuals 4S#;sZ Tivoli

software information center 3fOR="%wz7{F#

z7vfo|("P5w"208O"C'8O"\m18OT0*"_N<s+#

":*7#\}7r! PDF vfo,kZ Adobe Acrobat0r!10Z(I(}%w

D~ → r!4T>C0Z)P!qJO3f4!r#

(z!n

(z!n&\oz_PmePO(gP/;crS&O-)DC'I&9CwVm~

z7#TZKz7,zIT9C(z<u4v}M/@gf#2I9C|L!zsj

4Yw<NC'gfDyP&\#

*5m~'V

ZM3;Jb*5 IBM Tivoli m~'V.0,k%w;ZTB Web >cD Tivolisupport 4STCJ IBM Tivoli m~'V>c: http://www.ibm.com/software/support/

g{h*d|oz,rk(}9CTB Web >cD IBM Software Support Guide Py

hvD=(4*5m~'V: http://techsupport.services.ibm.com/guides/handbook.html

C8Oa)KTBE":

v XZSU'VD"aMJq*s

v g0Ek(y]zyZDzRrXx)

v *5M''V.0&U/D;5PE"

>iP9CD<(

>N<TXbuoMYwT0!vZYw53D|nM769CKtI<(#

Ve<(

>N<P9CKTBVM<(:

VeV QTk\'D>xVD!4|nrs!4lO|n"X|V"N}"!n"

Java `{T0TsyTVeVT>#

1eV d?"vfojbM?wDXb%JrLoyT1eVT>#

HmVM

zk>}"|nP"A;dv"QTk\'D>xVDD~0?<{"53{

""C'XkdkDD>T0N}r|n!nD5yTHmVMT>#

0T xi

http://www.ibm.com/software/tivoli/products/identity-mgr/


http://www.ibm.com/software/support/

http://techsupport.services.ibm.com/guides/handbook.html

Yw53xp

>iTZ8(73d?M?<{E9CK UNIX <(#9C Windows |nP1,TZ

73d?kC %variable% f; $variable,"C41f;?<76PD?v}1

\(/)#g{Z Windows 53O9C bash shell,rIT9C UNIX <(#

xii IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O

Z 1 B riMEv

Tivoli Access Manager for WebLogic G Tivoli Access Manager D)9,|9C Tivoli

Access Manager D2+&\,#$T BEA WebLogic Server &CLrDCJ#(}9

C BEA WebLogic Server Security Service Provider Interface,Tivoli Access Manager

for WebLogic 9C Tivoli Access Manager \mDC'"am4O$M'z#IBM Tivoli

Access Manager WebSEAL(WebSEAL)r IBM Tivoli Access Manager Plug-in for Web

Servers IC4)9 Tivoli Access Manager for WebLogic D2+&\,T*nUC'

%cG<a)'V#

Tivoli Access Manager for WebLogic 9 WebLogic Server &CLr\;9C Tivoli

Access Manager 2+T,x;h*NN`kr?p|D#

XkZ20 Tivoli Access Manager for WebLogic 0?p Tivoli Access Manager 2+

r#

T Tivoli Access Manager 0zDC'Z?p2+r.0&14i Tivoli Access Manager

2+T#M#K&a)KT2+T#MDr%**#

Tivoli Access Manager 2+T#M

Tivoli Access Manager G;vj+DZ(Mxg2+T_T\mDbv=8,|TXm

OV"DZ?xMb?xDJ4a)KKTK#$#

Tivoli Access Manager DX+ZZ|GG#HxD2+T_T\m#Kb,|9'VO

$"Z("}]2+TMJ4\m&\#+ Tivoli Access Manager kj<DyZrX

xD&CLraO9C,I9(_H2+R<C\mDZ?xMb?x#

ZdKD,Tivoli Access Manager a):

v O$r\

Tivoli Access Manager 'Vc:DO$zF,|(:$i"y>O$"m%M HTTP

7#

v Z(r\

Tivoli Access Manager a)Z(_T\mDr\#Z(_TG/P\mD"+T/V

"={vs56'ZDwCJ5)c#Tivoli Access Manager Z(~qT>z Tivoli

Access Manager ~qwMZ}=&CLrDCJksa)mIM\xv_#

WebSEAL GCZyZ Web DJ4D Tivoli Access Manager J42+T\mw#

WebSEAL G;V_T\"`_LD Web ~qw,|+8#H2+T&C=\#$D

Web J4#

Tivoli Access Manager Plug-in for Web Servers k Tivoli Access Manager /I,T*

zD Web J4a)j{D2+Tbv=8#Ke~w*k Web ~qw`,DxLD

;?VKP,9X=oD?vks"7(Gqh*Z(v_"*C'O$a)=(

(g{X*)#

© Copyright IBM Corp. 2003 1

Tivoli Access Manager Plug-in for Web Servers M WebSEAL yIa)%cG<bv

=8,"+ Web &CLrJ4"k|GD2+_T#

(}4i IBM Tivoli Access Manager DD5,zITKbXZ Tivoli Access Manager

D|È",|(F(?pv_yhDE"#>vfoD0T|,K`X Tivoli Access

Manager D5DPm#

+ Tivoli Access Manager k WebLogic Server /I

Tivoli Access Manager for WebLogic V5.1 'V:

v BEA WebLogic Server V7.0 SP2


Tivoli Access Manager for WebLogic V5.1 (}9C Security Service Provider

Interface(SSPI)4* BEA WebLogic Server a)j+2+Tr\#

":Tivoli Access Manager for WebLogic V5.1 ;'V BEA WebLogic Server (Fr#

'V BEA WebLogic Server (FrG Tivoli Access Manager for WebLogic V4.1

D;?V#

BEA WebLogic Server *Z}=2+a)Lr(}g Tivoli Access Manager for

WebLogic)a) SSPI,T+|GD2+&\^l/I= BEA WebLogic Server e5

a9P#

Tivoli Access Manager Security Service Provider Interfacei~

Tivoli Access Manager for WebLogic C?v BEA WebLogic Server 2+r(domain)

4fz4(D1!2+r(realm),"a)TB BEA WebLogic Server 2+a)Lr:

v O$a)Lr

v Z(a)Lr

v G+3da)Lr

Tivoli Access Manager for WebLogic 9C1! BEA WebLogic Server >$3d2+

a)LrM1! keystore#

TOPvD?va)Lr9|,(} WebLogic XF(tCdC`-D Management

Bean(MBean)#TBwZj8hvKb)a)LrM MBean PD?;vya)D&

\#

Tivoli Access Manager a)k BEA WebLogic Server DTB/Ic:

O$a)Lr

Tivoli Access Manager for WebLogic O$a)Lr5V BEA WebLogic Server r%

O$#Zr%O$P,C'"T9CC'{M\kDiO4r BEA WebLogic Server O

$#KC'{M\kI Tivoli Access Manager 9C Tivoli Access Manager Java KP

1i~4li#

2 IBM Tivoli Access Manager for e-business: BEA WebLogic Server /I8O

Tivoli Access Manager for WebLogic 9a)|T:DCZa) WebSEAL r Tivoli

Access Manager Plug-in for Web Servers %cG<&\DG<#i#Z 27 3DZ 4 B,

:tC%cG<;|,tC%cG<&\Dj8E"#

Tivoli Access Manager for WebLogic DO$a)LrI8vi~iI:

v O$a)Lr

+ IBM Tivoli Access Manager for WebLogic Server O$a)Lr/I= WebLogic

Security Framework P#

v Java O$MZ(~q(JAAS)G<#i

4Pr%M%cG<O$# JAAS G<#i5X;v;2kwe(CweI JAAS j

<8()Dwb# Tivoli Access Manager for WebLogic a)|T:DG<#i,C

#i9C Tivoli Access Manager Java KP1i~4r Tivoli Access Manager

authorization server O$#

v O$ MBean

(} WebLogic XF(tCO$a)LrDdC#|9JmC'4PC'"am\m

Nq,}g9C Tivoli Access Manager for WebLogic XF()94mSM>}C'#

Z(a)Lr

Z(a)LrZ BEA WebLogic Server Mb?Z(~q.da)SZ#Z(a)Lr

7(GmI9G\xT BEA WebLogic Server J4DCJ#CJv(G9Cf Tivoli

Access Manager Java KP1i~V"D PDPermission `4wvD#

Tivoli Access Manager for WebLogic DZ(a)LrITBi~iI#

v Z(a)Lr

+Z(a)Lr/I= WebLogic Security Framework P#}XFT BEA WebLogic

Server J4DCJb,Tivoli Access Manager for WebLogic Z(a)Lr9&m_

TD?p(+_T?p= Tivoli Access Manager TsUdP)M_TD}%(S

Tivoli Access Manager TsUdP}%_T)#

v Z( MBean

(} WebLogic XF(tCZ(a)LrDdC#2aZxP;)Yw(}g(}

WebLogic XF(4(M>}_T)1wCZ(a)Lr#

G+3da)Lr

G+3da)LrCZZ BEA WebLogic Server M}ZC4\mG+Db?Z(~q

.da)SZ#G+3da)LrX"DGG+x;G_T(_TGZ(a)LrD

0p)#

G+3da)LrITBi~iI:

v G+3da)Lr#

+G+3da)Lr/I= WebLogic Security Framework P#Tivoli Access Manager

for WebLogic G+3da)Lr:pG+D?pM}%#

v G+3d MBean#

(} WebLogic XF(tCG+3da)LrDdC#2aZxP;)Yw(}g(

} WebLogic XF(>}G+44(M|BG+I1Jq)1wCG+3da)L

r#

Z 1 B riMEv 3

_TMG+?p

_TMG+IZ?phv{P(er(} WebLogic XF(4(#?p J2EE &CLr

s,Z&CLr?phv{Z(eDG+M_Ta;<v= Tivoli Access Manager \

#$TsUd#

!\PI\,+T;#{9C Tivoli Access Manager \m5CLr pdadmin r Tivoli

Access Manager Web Portal Manager 4P_T4(#Zt/}Z9C Tivoli Access

Manager for WebLogic D BEA WebLogic Server 0,Z Tivoli Access Manager P4

(;)1!_TGX*D#KYwZ Tivoli Access Manager for WebLogic dC}L(Z

Z 17 3DZ 3 B, :dC}L;P-GK Tivoli Access Manager for WebLogic dC

Dj8E")P4P#

J4MG+

BEA WebLogic Server (eKm`;,DJ4`M,b)J4`M<\ Tivoli Access

Manager for WebLogic 'V#yPDJ4`MZ Tivoli Access Manager for WebLogic

Z<;O*G`,D,rK* BEA WebLogic Server Dsx"Pfx4(DBJ4`

M+;T/'V#

*yPJ4`M(eD_TMG+<T3;==f"Z Tivoli Access Manager \#$

TsUdP#

IST#$D\'VD BEA WebLogic Server J4D10Pm*:

v \mJ4

v &CLrJ4

v COM J4

v EIS J4

v EJB J4

v JDBC J4

v JMS J4

v ~qwJ4

v URL J4

v Web ~qJ4

Z Tivoli Access Manager \#$TsUdPTBPq=m>J4:

/WebAppServer/WLS/Resources/wls_domain/wls_realm/resource_type/Details

Z Tivoli Access Manager \#$TsUdPTBPq=m>G+:

/WebAppServer/WLS/Roles/wls_domain/wls_realm/role_name/AppName

I9CC Tivoli Access Manager for WebLogic dCDtTD~Tb) Tivoli Access

Manager \#$Ts]w{xPj+dC#rKI+yP BEA WebLogic Server Md

|&CLr~qwdC=,;v Tivoli Access Manager r#byMIT*yPD&C

Lr~qw`M4(G+M_TD/P;C#


9C Tivoli Access Manager O$

Tivoli Access Manager ICZ*b?C'rZ?C'a)O$#b?C'DO$@5Z

WebSEAL r Tivoli Access Manager Plug-in for Web Servers D%cG<\&#*K

q!nQDxg2+T,?v(} WebSEAL r Tivoli Access Manager Plug-in for Web

Servers SU4Tb?C'CJksD WebLogic Server,<;&1S\4TZ?C'D

CJks#TBwZhvKgNTb?MZ?C'&mO$#

C WebSEAL O$b?C'

B<T>K&m4Tb?C'"*T\#$J4xPCJDksD#M#

TBPmhvKO<T>D}L#

1. 3b?C'ksCJ\#$J4#CksZxks5D2+xg.0; WebSEAL S

U#

2. WebSEAL Z Tivoli Access Manager 2+rP9XCC'ks"O$CC'#

WebSEAL 'VTBO$=(:C'{M\k"$i"C'{M RSA 2+j6,r

_3V(FO$zF#

WebSEAL y]ksD URL M Tivoli Access Manager CJ_T&CdTmDZ(

v_#WebSEAL IT&C;)"bBn,}gJ'P'T"?U1dMO$zF#

3. ;)TCC'D URL ksxPZ(,WebSEAL c+Cks*"A WebLogic

Server#Cks+b?C'{MXb\k|,Zy>O$7P#KXb\ktZ

sso_user,|9 Security Service Provider Interface IT+ WebSEAL 7O*ksD

p4#

PX sso_user D|È",kNDZ 17 3DZ 3 B, :dC}L;#

4. WebLogic ~qw+-}O$DC'm]M\k8wX+]x Security Service Provider

Interface#

5. Security Service Provider Interface 9C Tivoli Access Manager O$~qi$TZ

Ov sso_user,WebSEAL a)D\kGq}7#MG5,K\ka)KTCksD

44G WebSEAL DENDy!#

< 1. Tivoli Access Manager Tb?C'a)%cG<O$

Z 1 B riMEv 5

VZCksQ-Mw,ITZ(#

O$Z?C'

B<T>K&mZ?C'(;h*(} WebSEAL re~2+T)*T\#$J4xP

CJDksD#M:

TBPmhvKO<T>D}L#

1. 3Z?C'ksCJ\#$J4#

2. WebLogic C'O$#i+CC'm]"M= Security Service Provider Interface#

3. Security Service Provider Interface +CO$ks"M=C'"am#

g{O$I&,r Security Service Provider Interface +CC'{w*QO$C'5

Xx WebLogic Server#

4. *xksZ(,BEA WebLogic Server i/ Tivoli Access Manager for WebLogic

Z(a)Lr,Ca)Lr7(GqQZ(10QO$C'(2mG4O$C')

CJyksDJ4#

CJ(IT Tivoli Access Manager Authorization Server(|!q;Z(CJJ4D

G+"7(Gq+b)G+PDNN;vZh10QO$C')DwCv(#

U>G<MsF

Z Tivoli Access Manager for WebLogic ZDU>G<If Tivoli Access Manager Java

KP1i~V"D IBM JLog `&m#(}9C Tivoli Access Manager for WebLogic

Mf Tivoli Access Manager for WebLogic a)D JLog properties D~,I+ JLog

`dC*9C BEA WebLogic Server U>G<`#b9C Tivoli Access Manager for

WebLogic I+B~1SG<= WebLogic U>D~P#

< 2. Tivoli Access Manager (FrTZ?C'a)O$


I?T"ICTMIluT

Tivoli Access Manager for WebLogic 9C Tivoli Access Manager Java KP1`4Y

w Tivoli Access Manager \#$Ts}]bMC'"am#Z? Tivoli Access Manager

for WebLogic _Y:fI*CJv(a)T\Dx#

Tivoli Access Manager Java KP1`'V Tivoli Access Manager authorization server

JO*F#g{w authorization server @#,rT/"z=(z~qwDJO*F#

FvD73hCG9C4FD acld M Tivoli Access Manager for WebLogic Z(~q#

I9C Tivoli Access Manager Policy Server rf Tivoli Access Manager for WebLogic

a)D Tivoli Access Manager Authorization Server Z(~q4wvCJv(#

IZ%;JOcMT\Jb,Tivoli Access Manager Policy Server dC;\ZbT73

P9C#Z(~qG(*Zzz73P9Cx*"D#PX|`j8E",kNDZ

29 3D:Z Tivoli Access Manager Authorization server OtCZ(~q;#

Z 1 B riMEv 7


Z 2 B 208>E"

>B|,TBwb:

v :\'V=(;

v :ELMZf*s;

v Z 10 3D:m~Hvu~;

v Z 11 3D:9C20r<20;

v Z 14 3D:9C>z5CLr20;

\'V=(

Tivoli Access Manager for WebLogic V5.1 'V:



Tivoli Access Manager for WebLogic ZK"PfP;'V(Fr#xK/I'V BEA

WebLogic Server Security Service Provider Interface(SSPI)#

Tivoli Access Manager for WebLogic ZTBYw53O\'V:

v IBM AIX 5.1

v Sun Solaris 8 M 9

v Hewlett-Packard HP-UX 11.0 M 11i(v BEA WebLogic Server V7.0)

v Microsoft Windows 2000 Server M Advanced Server(Service Pack 3)

":Tivoli Access Manager for WebLogic 'V53ZtC Java 2 Security Manager D

ivBKP#Java _TD~fm~a),Cm~|( Java 2 Security Manager K

PyXhDX(zkbDmI(#

ELMZf*s

Tivoli Access Manager for WebLogic _PTBELMZf*s:

v 64 MB RAM((i 128 MB)#

bG} BEA WebLogic Server Md|NN Tivoli Access Manager i~8(DZf

*s.b9hDZf?#=SD 64 MB RAM CZE/_Y:fT\#

d| Tivoli Access Manager i~yhDZf?+!vZD) Tivoli Access Manager

i~20Zwz53O#XZ|È",kND6IBM Tivoli Access Manager Base 2

08O7#

v 2 MB ELUd((i 4 MB)#

K*sG} BEA WebLogic Server Md|NN Tivoli Access Manager i~yhD

ELUd.b9hDELUd#

v 5 MB ELUd(CZU>D~)#

KELUdG}m~i~yhDELUd.b9hDELUd#


m~Hvu~

I&20 Tivoli Access Manager for WebLogic h*TBBZhvDHvu~:

v :Tivoli Access Manager policy server;

v :Tivoli Access Manager WebSEAL r Tivoli Access Manager Plug-in for Web

Servers;

v Z 11 3D:BEA WebLogic Server;

v Z 11 3D:Tivoli Access Manager Java KP1;

Tivoli Access Manager policy server20 Tivoli Access Manager for WebLogic .0Xk(" Tivoli Access Manager 2+

r#

20 Tivoli Access Manager policy server 1,+(" Tivoli Access Manager 2+r#

K policy server GZzYw53D IBM Tivoli Access Manager Base CD OV"D#

(#,Tivoli Access Manager policy server 20Z;,Zw\ Tivoli Access Manager

for WebLogic D53O#

Tivoli Access Manager Authorization ServerTivoli Access Manager Authorization Server &k BEA WebLogic Server M Tivoli Access

Manager for WebLogic 20Z,;(wzO#

authorization server * BEA WebLogic Server a)T Tivoli Access Manager Z(~

qDCJ(#authorization server 9d1U>G<MsFU/~qw4f"~qwn/

DG<#

Tivoli Access Manager WebSEAL r Tivoli Access ManagerPlug-in for Web Servers

Tivoli Access Manager WebSEAL(WebSEAL)M Tivoli Access Manager Plug-in for

Web Servers(e~)a)II Tivoli Access Manager for WebLogic 9CDyZ Web

D2+~q#20s,b)&CLrICZa) BEA WebLogic Server %cG<bv

=8#

WebSEAL re~;G20 Tivoli Access Manager for WebLogic DX8m~#+Gg

{zh*%cG<bv=8,|GGXhD#

PX20 WebSEAL re~D8>E",kND6IBM Tivoli Access Manager for

e-business Web Security 208O7#

19C WebSEAL rd|zm~qw,S= BEA WebLogic Server 1,&7#Kzm

~qwGC'CJ BEA WebLogic Server J4D%;*5c#*^FCJ,+h*4

( BEA WebLogic Server ,S}Kw#,S}Kw9z\;Zxg6p#$J4,x

;G(}9CG+4^FCJ#PX4(,S}KwDj8E",kND BEA

WebLogic Server D5#


BEA WebLogic ServerBEA WebLogic Server Xk20"dCZ+w\ Tivoli Access Manager for WebLogic

D53O#9C startWebLogic |nt/ BEA WebLogic Server#

BEA WebLogic Server fyP\'V=((} AIX b)OyhD Java Runtime

Environment V"# Tivoli Access Manager for WebLogic 9Cb,;v Java Runtime

Environment#I&20 BEA WebLogic Server Izc Tivoli Access Manager for

WebLogic T Java Runtime Environment DHvu~#

Z AIX OD IBM Java Runtime EnvironmentZ AIX 53O,BEA WebLogic Server 7.0 *s IBM Java Runtime Environment V1.3

20Z+w\ Tivoli Access Manager for WebLogic D53O#Z AIX 53O,BEA

WebLogic Server 8.1 *s IBM Java Runtime Environment V1.4 20Z+w\ Tivoli

Access Manager for WebLogic D53O#Tivoli Access Manager for WebLogic 9C

b)`,f>D Java Runtime Environment#

Tivoli Access Manager Java KP1

4T Tivoli Access Manager Base D Tivoli Access Manager Java KP1 V5.1 73X

kZ+w\ Tivoli Access Manager for WebLogic D53O20"dC#

Tivoli Access Manager Java runtime environment a)KyZ Java DO$MZ($_#

b) Java `)9KI BEA WebLogic Server 9CD Java runtime environment#

Z+w\ Tivoli Access Manager for WebLogic D53OdC Tivoli Access Manager

Java runtime environment 0Xk(" Tivoli Access Manager 2+r#

Tivoli Access Manager Java runtime environment f?v\'VYw53D IBM Tivoli

Access Manager Base CD V"#XZ208>E",kND6IBM Tivoli Access Manager

Base 208O7#

9C20r<20

"b

vTZ BEA WebLogic Server V7.0 D1!20;C,K20r<EG\'VD#

g{}Z9C BEA WebLogic Server V8.1,kq-Z 14 3D:9C>z5CL

r20;PD8>E"#

install_amwls 20r<(}TJ13r20MdCTBi~r/K Tivoli Access

Manager for WebLogic Server 53D20#

v Access Manager Java Runtime Environment

v Access Manager for WebLogic Server

*9C install_amwls r<20MdC Tivoli Access Manager for WebLogic Server 5

3,kq-TBb)=h:

1. 7#zQ-ZrP20K Tivoli Access Manager registry server"policy server M

authorization server#

Z 2 B 208>E" 11

2. 7#Q20yPX*DYw539!Lr#PXE",kNDZ 9 3D:\'V

=(;#

3. *9C}"o(1!oT)TbDoTi44,M{",XkZKP20r<.

020oT'Vm~|#

4. 7#ZKzwOQ20"dCK BEA WebLogic Server,RQ4(K BEA WebLogic

Server r#

5. Z Windows 53O,SyPKPPDLrKv#

6. t/ BEA WebLogic Server:

UNIX /WLS_install_dir/user_projects/domain_name/startWebLogic.sh

WindowsC:\WLS_install_dir\user_projects\domain_name/startWebLogic.cmd

7. (}S BEA WebLogic Server WebLogic_install_dir/server/bin ?<4PTB

E>,4hC CLASSPATH M PATH d?,"+ WebLogic .jars mS=

CLASSPATH T0 bin M lib ?<:

UNIX .setWLSEnv.sh

WindowssetWLSEnv.cmd

ZKP20r<0,7#f BEA WebLogic Server a)D java I4PD~Z53

76P&Zn0f#

8. KP install_amwls Lr,CLr;Z AIX"HP-UX(vTZ BEA WebLogic

Server 7.0)"Solaris M Windows =(D Tivoli Access Manager Web Security CD

Dy?<P#g{;Z1!;C20 BEA WebLogic Server,+h*9CTB|n

4KP20r<:

install_amwls -is:javahome path

dP path *CZ9C20r<4P20D jre D;C#

":

1. install_amwls.options.template D~ICZ2,20r;GCZ2G1!2

05#r%`-KD~T|(yPXhD5#

v *2G1!5,r9CK|n:

install_amwls -options install_amwls.options.template

v *4P2,20,r9C:

install_amwls -silent -options install_amwls.options.template

2. 19Cf BEA WebLogic Server a)D JDK 1,G"o=(OD20r<I

\aZ6-A;OT>;,aDD>#KT>Jb;0l5JDm~20#g

{#{^}KJb,k20 IBM JDK 1.3.1 "9C|4KP install_amwls#

20r<(}a>zdkZ 13 3D:install_amwls !n;PhvDdCE"*<

KP#vZ Windows 53P,7#zS\K Tivoli Access Manager for WebLogic

D1!20?<#

":Zza)KE"(rS\1!5).s,i~Z^hx;=I$DivBj

I20MdC#


Z20r<DnsvV**A;,CA;T>Q20Di~""TDdCT0|

GGqI&#g{20I&+GdC'\,I(}q-Z 17 3DZ 3 B, :dC

}L;PD=h4"TV$dC Tivoli Access Manager for WebLogic,qrML

xxPTB=h#

9. #9 BEA WebLogic Server#

10. li20GqQ+D~ AMSSPIProviders.jar 4F=

/bea_install_dir/weblogic/server/lib/mbeantypes ?<P#g{K?<P;f

ZCD~,rS /amwls_install_dir/lib V$4F|#

11. (}q-Z 18 3D:Z 2 ?V:* startWebLogic hC CLASSPATH;PD8>

E"4* startWebLogic |nhC CLASSPATH#

12. 4("dC Tivoli Access Manager r#PX8>E",kNDZ 22 3D:Z 4 ?

V:dC Tivoli Access Manager r;#

13. 9C WebLogic XF(XBt/ BEA WebLogic Server#

14. g{k*9C Tivoli Access Manager WebSEAL * BEA WebLogic Server a)

%cG<~q,kq-Z 24 3D:Z 5 ?V:* BEA WebLogic Server %cG

<xPdC;PD8>E"#

15. (}jIZ 26 3D:Z 7 ?V:bTdC;PD=h,bT20MdC,T7#

QT Tivoli Access Manager "am}7dCK Tivoli Access Manager for

WebLogic#

install_amwls !n

TB*KP install_amwls 1T>D!n#

m 1. install_amwls 20r<dC!n#

dC!n hv 1!5

6L ACL C' **k authorization server (Ex4(D

Tivoli Access Manager we#

sec_master \k * Tivoli Access Manager \m1\k#

Policy Server wz{ *policy server D+^(wz{#}g:

pdmgr.tivoli.com

Policy Server KZE *policy server C4l}ksDKZE#

1!KZE* 7135#7135

Authorization Server wz{ *Tivoli Access Manager authorization

server wz{#

Authorization Server KZE * authorization server KZE# 7136

1hC* true 1,?p AMWLS5.1 XF

()9true

WebLogic r\m1 *

BEA WebLogic Server rD\m1#1

4( WebLogic r1,&Q("KC

'#

WebLogic r\m1\k * WebLogic r\m1\k#

Access Manager for WebLogic Server 2

0?<D76

Z Windows 53O,Xk9C1!

5#C:\Program Files\Tivoli\pdwls

WebLogic Admin Server D URL t3://localhost:7001

Z 2 B 208>E" 13

9C>z5CLr20

kTzDYw53,jITBBZPD8>E":

v :Z AIX O20;

v :Z HP-UX O20;

v Z 15 3D:Z Solaris O20;

v Z 16 3D:Z Windows O20;

":Z20 Tivoli Access Manager for WebLogic 0,7##9 BEA WebLogic Server,

;sZ20jIsYXBt/|#

Z AIX O20

Tivoli Access Manager for WebLogic 20+D~i!Sm~|dCVk#Z AIX O

9C installp 20m~|#;sV$dC Tivoli Access Manager for WebLogic#

":g{Q-20"dC Tivoli Access Manager for WebLogic "h*XB20|,r

XkWHTd!{dC"}% Tivoli Access Manager for WebLogic m~|#kN

DZ 38 3D:S AIX }%;#

*Z AIX O20 Tivoli Access Manager for WebLogic,kjITB8>E":

1. w* root C'G<#

2. i$GqQzcm~Hvu~(|(4T Tivoli Access Manager Base DXhi~)#

kNDZ 10 3D:m~Hvu~;#

3. + IBM Tivoli Access Manager Web Security for AIX CD ek CD }/w#

4. Z shell a>BdkTB|n:

installp -acgNXd cd_mount_point/usr/sys/inst.images PDWLS

":li20GqQ+D~ AMSSPIProviders.jar 4F=

/bea_install_dir/weblogic/server/lib/mbeantypes ?<P#g{K?<P;

fZCD~,rS /amwls_install_dir/lib V$4F|#

5. B;=,dC Tivoli Access Manager for WebLogic#*A:Z 17 3DZ 3 B, :d

C}L;#

Z HP-UX O20

"b

Z HP-UX =(O201,vTZ BEA WebLogic Server 7.0,Tivoli Access

Manager for WebLogic EG\'VD#

g{Q-20"dC Tivoli Access Manager for WebLogic "h*XB20|,rXk

WHTd!{dC"}%|#kNDZ 38 3D:S HP-UX }%;#

*Z HP-UX O20 Tivoli Access Manager for WebLogic,kjITB=h:

1. w*C' root G<#



kNDZ 10 3D:m~Hvu~;#

3. Zs(t/ pfs_mountd,;st/ pfsd(g{|G;ZKPP)#C pfs_mount|n20 CD#}g,dkTB|n:

/usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cd-rom

dP /dev/dsk/c0t0d0 G CD h8,/cd-rom G20c#

4. dkTB|n20 Tivoli Access Manager for WebLogic m~|:

# swinstall -s /cd_rom/hp PDWLS

T>;u{",8>VvWNQI&#T>m;u{",8>4PWN}Z*<#

S CD i!D~"20Z2LO#T>;u{",8>4PWNQI&# swinstall5CLrKv#




5. B;=,dC Tivoli Access Manager for WebLogic#*A:Z 17 3DZ 3 B, :d

C}L;#

Z Solaris O20

Tivoli Access Manager for WebLogic 20+D~i!Sm~|dCVk#9C pkgaddIZ Solaris Operating Environment(TBF* Solaris)O20m~|#;sV$dC

Tivoli Access Manager for WebLogic#


XkWHTd!{dC"}%|#kNDZ 37 3D:S Solaris }%;#

*Z Solaris O20 Tivoli Access Manager for WebLogic,kjITB8>E":

1. w*C' root G<#


kNDZ 10 3D:m~Hvu~;#

3. ek IBM Tivoli Access Manager Web Security for Solaris CD#

4. KPTB|n420m~:

pkgadd -d /cdrom/cdrom0/solaris -a /cdrom/solaris/pddefault PDWLS

dP:

-d /cdrom/cdrom0/solaris 8(m~|D;C#

-a /cdrom/cdrom0/solaris/pddefault 8(20\mE>D;C#

1?vm~|D20}L<QjI1,T>TB{":

m~|D20I&jI#




Z 2 B 208>E" 15

5. B;=,dC Tivoli Access Manager for WebLogic#*AZ 17 3DZ 3 B, :d

C}L;#

Z Windows O20

Tivoli Access Manager for WebLogic 20+D~i!Sm~|dCVk#9C

InstallShield setup.exe I20 Tivoli Access Manager for WebLogic D~#1

InstallShield jI1,9CZ 17 3DZ 3 B, :dC}L;PD8>E"dC Tivoli

Access Manager for WebLogic#


XkWHTd!{dC"}%|#kNDZ 37 3D:S Windows }%;#

*Z Windows O20 Tivoli Access Manager for WebLogic,kjITB8>E":

1. T_P Windows \m1X(DC'G<= Windows r#

2. i$GqQzcm~Hvu~(|(4T Tivoli Access Manager Base DXhi

~)#kNDZ 10 3D:m~Hvu~;#

3. + IBM Tivoli Access Manager Web Security for Windows CD ek CD }/w#

4. (}+wTBD~KP Tivoli Access Manager for WebLogic InstallShield 20L

r,dPTB|nPDL{ E: zm CD }/w:

E:\Windows\PolicyDirector\Disk Images\Disk1\PDWLS\Disk Images\Disk1\setup.exe

+r*0!q20oT10Z#

5. !q`&DoT"%w7(#

InstallShield Lrt/"r*06-10Z#

6. %wB;=#

+r*0mI$-i10Z#

7. DAmI$-i,g{S\b)unMu~,r%wG#

+r*0!q?DX;C10Z#

8. S\1!5r/@TiRzf;C#%wB;=#

r*0*<4FD~10Z#

9. 7#T>D20;C}7,;s%wB;=#

D~i!=EL#+T>;u{",8>Q20D~#

10. %wjIKv20Lr#

11. li20GqQ+D~ AMSSPIProviders.jar 4F=

c:\bea_install_dir\weblogic\server\lib\mbeantypes ?<#g{K?<P;fZ

CD~,rS c:\amwls_install_dir\lib V$4F|#

12. B;=,dC Tivoli Access Manager for WebLogic#*AZ 17 3DZ 3 B, :d

C}L;#


Z 3 B dC}L

*dC Tivoli Access Manager for WebLogic,kjITB?;ZPD8>E":

v :Z 1 ?V:dC Tivoli Access Manager Java runtime environment;

v Z 18 3D:Z 2 ?V:* startWebLogic hC CLASSPATH;

v Z 19 3D:Z 3 ?V:dC Tivoli Access Manager for WebLogic;

v Z 22 3D:Z 4 ?V:dC Tivoli Access Manager r;

v Z 24 3D:Z 5 ?V:* BEA WebLogic Server %cG<xPdC;

v Z 25 3D:Z 6 ?V:Z BEA WebLogic Server `~qw73(|(:/73)

PdC Tivoli Access Manager for WebLogic;

v Z 26 3D:Z 7 ?V:bTdC;

":>BPD8>E"Y(zQ20K Tivoli Access Manager for WebLogic 0dX8

m~,|( Tivoli Access Manager y>i~DdC#g{zP420Cm~,k

q-Z 9 3DZ 2 B, :208>E";PD8>E"VZ20#

Z 1 ?V:dC Tivoli Access Manager Java runtime environmentTivoli Access Manager Java runtime environment * Tivoli Access Manager for WebLogic

DX8m~#ZdC BEA WebLogic Server r0,XkH}7dC Java KP1i~#

9C Tivoli Access Manager 5CLr pdjrtecfg I|BI BEA WebLogic Server 9

CD Java Runtime Environment#mb,g{53|,`v Java KP1,k7#I BEA

WebLogic Server 9CD Java Runtime Environment ;CZ4PC pdjrtecfg 5CL

r#

1. ki$Q20K Tivoli Access Manager Base D Java runtime environment#

XZ|È",kNDZ 10 3D:m~Hvu~;#

2. (}S BEA WebLogic Server WebLogic_install_dir/server/bin ?<4PTBE

>,4hC CLASSPATH M PATH d?,"+ WebLogic .jars mS= CLASSPATH

T0 bin M lib ?<:

UNIX .setWLSEnv.sh

WindowssetWLSEnv.cmd

ZKP ezInstall 0,7#f BEA WebLogic Server a)D java I4PD~Z53

76P&Zn0f#

3. Tivoli Access Manager Java Runtime Environment h*Tf BEA WebLogic Server

;pa)"20D JDK xPdC#*jIKYw:

a. +?<|D* Tivoli Access Manager 2076PD sbin ?<#}g:

UNIX:/opt/PolicyDirector/sbinWindows:C:\Program Files\Tivoli\Policy Director\sbin

b. 4P pdjrtecfg |n,gBy>:

pdjrtecfg -action config -host policy_server_name -java_home java_location


dP java_location * BEA WebLogic Server Java Runtime Environment D?<

;C#b+G:

WindowsBEA WebLogic Server V7.0

c:\bea\jdk131_ob\jre

BEA WebLogic Server V8.1

c:\bea\jdk141\jre

Solaris,HP-UX

/usr/local/bea/jdk141_03

AIX

Z AIX 53O,BEA WebLogic Server 7.0 h* IBM Java Runtime

Environment V1.3,BEA WebLogic Server 8.1 h* IBM Java Runtime

Environment V1.4#&+ pdjrtecfg |nPD -java_home !nhC*

zD AIX zwOD JRE D20;C#BEA WebLogic Server V7.0

/usr/java131

BEA WebLogic Server V8.1

/usr/java14

":

1. BEA WebLogic Server 8.1 20OD pdjrtecfg 5CLrf;K jre/lib ?

<PD jsse.jar#1!{dC Tivoli Access Manager Java Runtime 1,V

4KD~#

2. 1dC Sun v1.4 JRE 1,;*T;%==KP pdjrtecfg r9C pdconfig5CLr4dC JRE,r*dC+'\#

XZ9C pdjrtecfg D|È",kND6IBM Tivoli Access Manager Base 2

08O7PPXDN<3#

Z 2 ?V:* startWebLogic hC CLASSPATH

":Z4Pb)dC=h0,7#Q4(K WebLogic r#

startWebLogic |nCZt/ WebLogic Server#h*^D CLASSPATH 73d?T9

startWebLogic \;CJ"0k}7D Java `#

kjITB8>E":

1. g{ WebLogic Server }ZKP,VZk+d#9#

2. +TBD~{mS= startWebLogic |nD CLASSPATH d?:

UNIX

/opt/pdwls/lib/AMSSPICore.jar/opt/pdwls/lib/rbpf.jar

Windows

C:\amwls_install_directory\lib\AMSSPICore.jarC:\amwls_install_directory\lib\rbpf.jar


startWebLogic |n;Z BEA WebLogic Server DQ20rD?<P#Zj<2

0P,K;CG:

UNIX /WebLogic_install_directory/user_projects/domain_name

WindowsC:\WebLogic_install_directory\user_projects\domain_name

d? domain_name GZ4( BEA WebLogic Server r1z!qD{F#

3. g{}Z9C1!oT("o),rx}K=h#

g{z}Z9CoT|T'V1!oT("o).bDoT,rXk+TB76m

S=Z startWebLogic E>P(eD CLASSPATH P:

UNIX

/opt/pdwls/nls/java/com/tivoli/amwls/sspi/nls

Windows

C:\Progra~1\Tivoli\pdwls\nls\java\com\tivoli\amwls\sspi\nls

" : m S K ? < + 9 o T | 2 0 \ ; C J 2 0 Z

/opt/pdwls/nls/java/com/tivoli/amwls/sspi/nls/ PDJ4x#

Z 3 ?V:dC Tivoli Access Manager for WebLogicIS|nPr9C Tivoli Access Manager XF()9 Web &CLr4dC Tivoli

Access Manager for WebLogic#b=V!qDj8E"<|,ZTBwZP#

&Z4Pb)8>E"04( BEA WebLogic Server r#

ZdC Tivoli Access Manager for WebLogic "4(r1dkD}]f"ZtTD~P#

b)tTD~ICZ|D Tivoli Access Manager for WebLogic DP*#PX|È",

kNDZ 41 3D=< A, :tTD~N<;#

9CXF()9 Web &CLrdC Tivoli Access Manager forWebLogic

1. t/ BEA WebLogic Server:

UNIX /WLS_install_dir/user_projects/domain_name/startWebLogic.sh

WindowsC:\WLS_install_dir\user_projects\domain_name\startWebLogic.cmd

2. r* Web /@w",S=w\ BEA WebLogic DzwOD BEA WebLogic XF

(#4:

http://WebLogic_server_name:7001/console

7001 *1! BEA WebLogic Server KZE#K5GIdCD#

3. T> BEA WebLogic Server G<A;#T_P\m1X(D BEA WebLogic Server

C'm]G<#

4. ZdC Tivoli Access Manager for WebLogic server "4( Tivoli Access Manager

r0,z+h*?p Tivoli Access Manager XF()9 Web &CLr,C&CL

ra)=dCNqD Web gf#*?pK Web &CLr:

Z 3 B dC}L 19

a. S BEA WebLogic Server w3,ZrdC8Z,!q Web &CLr#

b. !qdCB Web &CLr4S#

c. !q(}/@wOX|4S#

d. /@TiR&CLr amwls_install_dir\lib\AMWLSConsoleExtension.war#%

wOX#

e. * AMWLSConsoleExtension.war %w!q4S#

f. !q?p?j;s%wdC"T>#

*liGqQI&?pXF()9 Web &CLr,9*sÀ;0qPD?p

D~P#9* Web &CLrD~P,AMWLSConsoleExtensions &T>ZKPm

P#Kb,?pXF( Web &CLr)9+QZXF(0Zs_T>D BEA

WebLogic Server <=0qPmS;v Tivoli Access Manager <j#

5. *dC Tivoli Access Manager r,%w BEA WebLogic Server <=0qPD Access

Manager <j#

6. T>dCA;#dkyPXhDE"MNNI!DN}#PX*dkDE"D8

<,kNDBm#

ICZ config YwD!nZBmPPv#Z;vm|,XhD!n#Z~vm|,

I!D!n#

Xh!nD{F hv

domain_admin WebLogic r\m1

domain_admin_pwd WebLogic r\m1\k

remote_acl_user * authorization server 4(D Tivoli Access Manager we

sec_master_pass Tivoli Access Manager sec_master \m1\k

pdmgrd_host Tivoli Access Manager policy server wz{#

pdacld_host Tivoli Access Manager authorization server wz{#

":;Xdk\k,xGZ4PYw0a>dk\k#bG*@9\k#tZ|n

z7G<P#

Bm|, config YwDI!!n#

!n{F hv

wls_server_url 8(>X WebLogic Server D URL#1!5*

t3://localhost:7001#

pdmgrd_port Tivoli Access Manager policy server KZE#

pdacld_port Tivoli Access Manager authorization server KZE#

am_domain 8( Tivoli Access Manager rD{F#1!5* Default#

amwls_home 8(= Tivoli Access Manager for WebLogic Server 20?<D76#

%w&C#

7. g{dCGI&D,raZR`0qPT> Tivoli Access Manager for WebLogic

Server N}DPm#

VZIdC Tivoli Access Manager r#kNDZ 22 3D:Z 4 ?V:dC Tivoli

Access Manager r;#


S|nPdC Tivoli Access Manager for WebLogic1. t/ BEA WebLogic Server:

UNIX

/WLS_install_dir/user_projects/domain_name/startWebLogic.sh

Windows

C:\WLS_install_dir\user_projects\domain_name\startWebLogic.cmd

2. 4PTB|n4dC Tivoli Access Manager for WebLogic#

":g{ZD~b9}LP4+ Tivoli Access Manager for WebLogic 20=(i

D;C(g0;Byv),r7#+ AMWLSConfigure E>PD AMSSPI_DIR

d?hC*5J20?<D;C#`FX,g{4+ WebLogic 20Z1!;

C,rZ ALWLSConfigure E>P9C WebLogic.jar D}7;C|B

WLS_JAR d?#

UNIX install-dir/sbin/AMWLSConfigure.sh

Windowsinstall-dir\sbin\AMWLSConfigure.bat

dC Tivoli Access Manager for WebLogic D AMWLSConfigure Java &CLr

D|nPo(*:

v AMWLSConfigure -action config [options ...]

dC Tivoli Access Manager for WebLogic#

v AMWLSConfigure -help [action]

T>+]x AMSSPIConfigure DXhMI!D5#

ICZ config YwD!nZBmPPv#Z;vm|,XhD!n#Z~vm|,

I!D!n#

Xh!nD{F hv

domain_admin WebLogic r\m1

domain_admin_pwd WebLogic r\m1\k

remote_acl_user * authorization server 4(D Tivoli Access Manager we

sec_master_pass Tivoli Access Manager sec_master \m1\k

pdmgrd_host Tivoli Access Manager policy server wz{#

pdacld_host Tivoli Access Manager authorization server wz{#


z7G<P#

Bm|, config YwDI!!n#

!n{F hv

deploy_extension 1hC* true 1,?p Tivoli Access Manager for Web Logic Server

XF()9#1!5* true#

wls_server_url 8(>X WebLogic Server D URL#1!5*

t3://localhost:7001#

Z 3 B dC}L 21

pdmgrd_port Tivoli Access Manager policy server KZE#

pdacld_port Tivoli Access Manager authorization server KZE#

am_domain 8( Tivoli Access Manager rD{F#1!5* Default#

amwls_home 8(= Tivoli Access Manager for WebLogic Server 20?<D76#

verbose tCr{Cj8dvD<{5#1!5* false#

VZh*dC Tivoli Access Manager r#

Z 4 ?V:dC Tivoli Access Manager r

9CXF()9 Web &CLrdC Tivoli Access Manager r

;)dCK Tivoli Access Manager for WebLogic Server 4* BEA WebLogic Server

a)2+T,zMh*4(;vr4X* Tivoli Access Manager 2+T#*jIKY

w:

1. 9*sÀ;0qPD Access Manager <j,;s%wr<j#

2. T>4(rA;#dkyPXhDd?#%w0&C1#

3. *dC BEA WebLogic Server 7.0 49COf4(D Tivoli Access Manager r:

a. Z BEA WebLogic Server <=0qP!qkzDr`XD<j#

b. T>rdCA;#!q2+T!n(#

c. S#f!n(,9C1!rB-Pm,4!qZOfD=hP4(Dr#%w

&C#

*dC BEA WebLogic Server 8.1 49COf4(D Tivoli Access Manager r,

9C BEA WebLogic Server XF(OD02+T1!n(4hC1!r#

4. XBt/ BEA WebLogic Server#

5. *bTB Access manager rGq}#$w,RÀ;0qP Access Manager D~

PZDC'Mi<j&|,4T Tivoli Access Manager C'"amDu?#

":g{8(K;vQ-fZD SSO C',4*KVPC'dkK;}7D\k,r

4(rYw+aI&,+ SSO +;{C#ZKivB,I(}|B Tivoli Access

Manager for WebLogic rbpf.properties D~P`&Du?4\]WXtC SSO#

PX rbpf.properties Dj8E",kNDZ 41 3D=< A, :tTD~N<;#

S|nPdC Tivoli Access Manager r

1. 4PTB|n44( Tivoli Access Manager for WebLogic r#

":g{ZD~b9}LP4+ Tivoli Access Manager for WebLogic 20=(i

D;C(g0;Byv),r7#+ AMWLSConfigure E>PD AMSSPI_DIR

d?hC*5J20?<D;C#`FX,g{4+ WebLogic 20Z1!;

Cr}Z9C WebLogic V8.1,rZ ALWLSConfigure E>P9C

WebLogic.jar D}7;C4|B WLS_JAR d?#

UNIX install-dir/sbin/AMWLSConfigure.sh

Windowsinstall-dir\sbin\AMWLSConfigure.bat


dC Tivoli Access Manager for WebLogic D AMWLSConfigure Java &CLr

D|nPo(*:

v AMWLSConfigure -action create_realm [options ...]

4( Tivoli Access Manager for WebLogic r#

v AMWLSConfigure -help [action]

T>+]x AMSSPIConfigure DXhMI!D5#

ICZ create_realm YwD!nZBmPv#Z;vm|,XhD!n#Z~vm

|,I!D!n#

Xh!nD{F hv

realm_name 8(}Z4(D WLS rD{F#

domain_admin_pwd 8( WebLogic r\m1\k#

user_dn_suffix 8(Z(}XF()9 Web &CLr4(C'1*9CD(P{

F(DN)s:#

group_dn_suffix 8(Z(}XF()9 Web &CLr4(i1*9CD(P{F

(DN)s:#

admin_group 8(CZZ?dC?DD Tivoli Access Manager i#


z7G<P#

Bm|, create_realm YwDI!!n#

!n{F hv

user_dn_prefix 8(Z(}XF()9 Web &CLr4(C'1*9CD(P{F

(DN)0:#

group_dn_prefix 8(Z(}XF()9 Web &CLr4(i1*9CD(P{F

(DN)0:#

sso_enabled 1hC* true 1,tC%cG<'V#1!5* false#

sso_user 8(CZ4(k Tivoli Access ManagerD%cG<ENX*DC'#

sso_pwd *%cG<C'8(\k#

verbose tCr{Cj8dvD<{5#1!5* false

2. *dC BEA WebLogic Server 7.0 49COf4(D Tivoli Access Manager r:

a. r* Web /@w",S=w\ BEA WebLogic DzwOD BEA WebLogic X

F(#4:

http://WebLogic_server_name:7001/console

7001 *1! BEA WebLogic Server KZE,K5GIdCD#

b. T> BEA WebLogic Server G<A;#T_P\m1X(DC'm]G<#

c. Z BEA WebLogic Server <=0qP!qkzDr`XD<j#

d. T>rdCA;#!q2+T!n(#

e. S#f!n(,9C1!rB-Pm,4!qZOfD=hP4(Dr#%w

&C#

Z 3 B dC}L 23

*dC BEA WebLogic Server 8.1 49COf4(D Tivoli Access Manager r

(realm),9C BEA WebLogic Server XF(OD02+T1!n(4hC1!

r(domain)#


4. *bTB Access manager rGq}#$w,sÀ;0qP Access Manager D~

PZDC'Mi<j&|,4T Tivoli Access manager C'"amDu?#

Z 5 ?V:* BEA WebLogic Server %cG<xPdC

>Z8<zjI9C WebSEAL r Tivoli Access Manager Plug-in for Web Servers r

BEA WebLogic Server dC%cG<D}L#g{;#{5V%cG<&\,IvTK

Z#

WebSEAL M Tivoli Access Manager Plug-in for Web Servers T;,D==5V2+

TM%cG<,R9C;,D53e5a9#PX20 WebSEAL M plug-in for Web

servers DE",kND6IBM Tivoli Access Manager for e-business Web Security 20

8O7#PXdC WebSEAL D30E"Mj8E",kND6IBM Tivoli Access

Manager for e-business WebSEAL \m8O7#PXe~DYwMdCE",kND IBM

Tivoli Access Manager Plug-in for Web Servers Integration Guide#

y]zk*5VDe5a9,TBwZa)=SD WebSEAL Me~dCE",b)E

"TZr BEA WebLogic Server dC%cG<GXhD:

v :9C WebSEAL acdC%cG<;

v Z 25 3D:9C Tivoli Access Manager Plug-in for Web Servers dC%cG<;

9C WebSEAL acdC%cG<

*9C WebSEAL * BEA WebLogic Server a)%cG<\&,kZw\ WebSeal ~

qwD53OjITB=h:

1. r* WebSEAL dCD~ webseald.conf#

2. hCTBdCn:

basicauth-dummy-passwd = sso_pwd

K\kXkkZ4(rYwPtCD sso_pwd VND\k`%d#

3. #9"XBt/ WebSEAL,T9dC|Dz'#

4. 9C pdadmin |nI4( WebSEAL ac#

":IZ Tivoli Access Manager 2+rPDNNzwO4PK=h#;XZ

WebSEAL 53O4P#}g,ITZ Tivoli Access Manager policy server 5

3O4P#

qX9C -b !na)ac?j URL#TZ%cG<,bGXhD#

}g,w*;v,xD|nPdkTB|n:

pdadmin> server task webseald_server_name create -t tcp-p WebLogic_Server_listen_port -h WebLogic_Server-b supply junction_target


Bm(eKOv pdadmin |nPDd?:

m 2. pdadmin |nD!n

!n hv

webseald_server_name WebSEAL ~qwD{F#C{FI=?ViI:

webseald-WebSEAL_server_instance#T WebSEAL_server_instance

9 C 5 3 D w z { # } g , g { w z { * c r u z , r

webseald_server_name +G:webseald-cruz k"b:g{Z,;

(~qwO20K`v WebSEAL 5},z9h*8(~qw5

}#PX4(k`v~qw5}DacD8>E",kND

6IBM Tivoli Access Manager for e-business WebSEAL \m8

O7#

WebLogic_Server BEA WebLogic Server Dwz{#

WebLogic_Server_listen_port BEA WebLogic Server }ZdOl}DKZ#1!5* 7001#

-b supply TZ%cG<GXhD#7# WebSEAL +]1\k#

junction_target acD URL ?j

XZ4(M9C WebSEAL acDj{E",kND6IBM Tivoli Access Manager for

e-business WebSEAL \m8O7#

9C Tivoli Access Manager Plug-in for Web Servers dC%

cG<

*9%cG<}#$w,h*dC Tivoli Access Manager Plug-in for Web Servers 4

+y>O$7PD}7E"+]x IBM Tivoli Access Manager for WebLogic Server#

*o=K?D,y>O$h*w*e~dCD~PDZ(s#idC#

`-;Z plug-in_install_dir/etc ?<PD pdwebpi.conf dCD~,"+TB5m

S= [common-modules] Z:

[common-modules]post-authzn = BA

;sIZ [BA} ZP+ add-hdr M supply-password N}VphC* BA M sso_user

D\k#4:

[BA]add-hdr = supplysupply-password = sso_pwd

PXdC Tivoli Access Manager Plug-in for Web Servers D|È",kND IBM Tivoli

Plug-in for Web Servers Integration Guide#

Z 6 ?V:Z BEA WebLogic Server `~qw73(|(:/73)P

dC Tivoli Access Manager for WebLogic>ZkT BEA WebLogic Server 20Z`~qw73r:/73PDe5a9#*Z

BEA WebLogic Server `~qw73(|(:/73)PdC Tivoli Access Manager

for WebLogic:

Z 3 B dC}L 25

1. 9CZ 19 3D:Z 3 ?V:dC Tivoli Access Manager for WebLogic;MZ 22

3D:Z 4 ?V:dC Tivoli Access Manager r;PD8>E"4Z BEA

WebLogic Server \m~qwOdC Tivoli Access Manager for WebLogic "4(

Tivoli Access Manager r#

2. (}+ Tivoli Access Manager for WebLogic tTSKrD\m~qw4F=?v

?jzw(\\~qw)4Z\\~qw(|(:/I1)OtC Tivoli Access

Manager for WebLogic#tTD~;Z BEA_WLS_HOME/jdk_location/jre/amwls/,

&+b)tTD~4F=?v\\~qwOD,;;C#

Z 7 ?V:bTdC

(}jITB=h,i$GqT Tivoli Access Manager "am}7dCK Tivoli Access

Manager for WebLogic:

1. 9C BEA WebLogic Server XF(4("i$BDbTC'#

2. 4PTB pdadmin |n:

pdadmin> user show test_user

v i$ account-valid Gq* yes#

v i$ password-valid Gq* yes#

Tivoli Access Manager for WebLogic %cG<bv=8Jm(} WebSEAL 4P%;

O$=h,C=hr BEA WebLogic Server 8wXO$C'#IT(}KP]>&C

Lr7OGq}7dCKO$#C]>&CLrZZ 30 3D:9C]>&CLr;P

hv#


Z 4 B tC%cG<

9C Tivoli Access Manager WebSEAL xP%cG<

Tivoli Access Manager for WebLogic 'VSd| Tivoli Access Manager z7(}g

Tivoli Access Manager WebSEAL"Tivoli Access Manager Plug-in for Web Servers M

Tivoli Access Manager Plug-in for Edge Server)xPD Web %cG<#

WebSEAL M BEA WebLogic Server .dDENX5(}9CQdCD HTTP y>O

$ dummy \k4jI#K,yD=(2CZZT0D5V(F2+rSZD Tivoli

Access Manager for BEA WebLogic Server z7P4P%cG<#

Tivoli Access Manager HTTP frzm(}g WebSEAL);dC*+]C'{MQ*

D%cG<#\\k#K#\\kCZ7(CfrzmGqGIED#Tivoli Access

Manager Authorization Server i$K\ks,Ma*}ZksJ4DC'!C>$#

B<T>gN("ENX5Dj8E"#

O<T>TB=h:

1. C'9C WebSEAL 'VDNNO$zF(}g,C'{/\krM'z$i)4

r WebSEAL O$#;sC'a;T BEA WebLogic Server J4Dks#

2. WebSEAL Q-(}9C -b supply !n,dCP;v= BEA WebLogic Server D

ac#WebSEAL +ks+]x BEA WebLogic Server;CksZ,|,TBZ]

Dy>O$7:

v WebSEAL QO$DC'j6(Z<P* user-1)

v webseald.conf PD basicauth-dummy-passwd 5#|G0fa=DGv#\\k#

< 3. 9C Tivoli Access Manager WebSEAL xP%cG<


3. BEA WebLogic Server +KC'j6M#\\k+]x Tivoli Access Manager for

WebLogic O$a)LrTCZi$#

4. Tivoli Access Manager for WebLogic G<#i9C Tivoli Access Manager 4i$

x(D\kGqGkT Tivoli Access Manager for WebLogic QdCD WebSEAL

%cG<C'D#K\kDi$a)K WebSEAL M BEA WebLogic Server .d

DENX5#

g{=h 4 I&,r Tivoli Access Manager for WebLogic O$a)Lrr BEA

WebLogic Server O$x(C'j6#k"b9C#\\k(<P* ws-passwd)x

PDQdC WebSEAL %cG<C'DO$v4P;N,bGr*|_Y:fZ

Tivoli Access Manager for WebLogic G<#iP#K_Y:fIdCRI;XU#

Zr4(D}LPIhC SSO,+G,*V$tC SSO Tivoli Access Manager for

WebLogic:

1. 4( SSO C'#

2. Z amsspi.properties Tivoli Access Manager for WebLogic dCD~/P:

com.tivoli.amwls.sspi.Authentication.ssoEnabled = truecom.tivoli.amwls.sspi.Authentication.ssoTrustId = sso_username


Z 5 B \mNq

>B|,XZ Tivoli Access Manager for WebLogic DTBE":

v :Z Tivoli Access Manager Authorization server OtCZ(~q;

v Z 30 3D:(} Tivoli Access Manager for WebLogic xPDC'Mi\m;

v Z 30 3D:9C]>&CLr;

v Z 32 3D:9C<I;

v Z 32 3D:}N%wG<_T;

v Z 33 3D:>} Tivoli Access Manager r;

v Z 34 3D:!{dC Tivoli Access Manager for WebLogic;

v Z 34 3D:JOoO<I;

v Z 35 3D:V^;

Z Tivoli Access Manager Authorization server OtCZ(~q

1!ivB,Tivoli Access Manager for WebLogic 9C Tivoli Access Manager Policy

Server 4/@ Tivoli Access Manager \#$Ts}]bPD\#$Ts#+G,IZ

^(4F Tivoli Access Manager Policy Server RarK}k Tivoli Access Manager for

WebLogic %;JOc,yTKe5a9&vCZbT73#Kb,Z(~qyZZ?_

Y:f<ua)|QDKP1T\#Z(~qe5a9&\GCZzz73#

TBdC=h&vZ}7dC Tivoli Access Manager for WebLogic sE\4P# Tivoli

Access Manager for WebLogic 9C=VZ(~q,b=V~q<h*ZyPQdCD

Tivoli Access Manager Authorization server OtC:

v Tivoli Access Manager )9tTZ(~q

bGf Tivoli Access Manager Authorization Server V"D1!Z(~q#

v RBPF \#$Ts/@Z(~q

bGf Tivoli Access Manager for WebLogic V"DZ(~q#

*7# Tivoli Access Manager for WebLogic }Z9CZ(~q,k4PTB=h:

1. + rbpf_ent_pos_browser 2mbS Tivoli Access Manager for WebLogic wz

4F= Tivoli Access Manager Authorization Server wzO,"+|ECZ;Z53

PATH PDNb?<P# rbpf_ent_pos_browser 2mbIZ Tivoli Access Manager

for WebLogic wzDTB?<PR=:

UNIX /opt/PolicyDirector/lib

Windowsc:\Program Files\Tivoli\pdwls\bin

2. S Tivoli Access Manager Authorization wzOr* ivacld.conf D~,CD~;

Z:

UNIX /opt/PolicyDirector/etc

Windowsc:\Program Files\Tivoli\Policy Director\etc


3. +TB=PmSA [aznapi-entitlement-services] Z:

AZN_ENT_EXT_ATTR = azn_ent_ext_attrRBPF_POS_BROWSE = rbpf_ent_pos_browser

4. XBt/ Tivoli Access Manager Authorization Server#

5. S Tivoli Access Manager for WebLogic wz,r*;Z

java_home/amwls/WLS_Domain_Name/WLS_Realm_Name PD rbpf.properties D~ -

dP WLS_Domain_Name * BEA WebLogic Server r(domain)D{F,

WLS_Realm_Name * BEA WebLogic Server 2+r(realm)D{F#+TBtT

|B* true:

com.tivoli.pd.as.rbpf.UseEntitlements=true


;)b)=hI&jI,tC Tivoli Access Manager for WebLogic D BEA WebLogic

Server +9C Tivoli Access Manager Authorization Server 44PyP\#$Ts/@

(k Tivoli Access Manager Policy Server `T)#

(} Tivoli Access Manager for WebLogic xPDC'Mi\m

PK Tivoli Access Manager for WebLogic,I(}9C BEA WebLogic Server XF

(\mC'Mi#S BEA WebLogic Server XF(D2+T0q,9* Access Manager

<j,;sY9*r<j,TT>C'Mi<j#z}GSb)<j\m Tivoli Access

Manager for WebLogic 2+TDC'Mi#

!qC'<jT>C'\m3f#SK3fzIT:

v Pv Tivoli Access Manager for WebLogic C'#

v T>%vC'Dj8E"#

v 4(C'#

!qi<jT>i\m3f#SK3fzIT:

v Pvi#

v T>X(iDj8E"#

v 4(i#

I(}Z`XDXF()93fPdkCUqVtDPm,+`vC'mSAiP,

r+`vimSAC'P#

1PvC'ri1,g{4Zns5X}VNPdk;v5,r+T>yPzc#=

VNP8(Du~DC'ri#

9C]>&CLr

IT9C]>&CLri4;v_P=V`MZ(D>},"709C WebSEAL %c

G<&\#

b=V`MDZ(G:

v ywT

9C?phv{4+X(G+ZhC'Mi#

v F.T


S&CLr4zkZ4PG+li#

]>&CLrI;v Web i~M;v EJB i~iI#

IgBhv Web i~P=V6pD2+T:

v ywT:

web.xml ?phv{(e{* ServletRole D%vG+#weblogic.xml ?phv{

(e ServletRole M BankMembersServlet i.dDwe3d#web.xml ?ph

v{PD2+T<x7#C'Xk;Zh ServletRole G+TCJ Servlet DNN=

(#

v F.T:

doPost() =(_P=SD2+T,K1,F.T7#+ ServletRole ZhwC_#

b9CZ%v Web i~Z;+IbTF.T2+T9IbTywT2+T#

HTTPRequest.isUserInRole() =(CZxP(^li#

IgBhv EJB i~P}V6pD2+T:

v ywT2+T:

Z e j b - j a r . x m l ? p h v { P ( e { * E J B R o l e D % v G + #

weblogic-ejb-jar.xml ?phv{(e EJBRole M BankMembersEJB i.dD

we3d#ejb-jar.xml ?phv{PD=(mI(7#C'Xk;Zh EJBRole G

+TCJ getBalance() =(#

v F.T2+T:

getBalance() _Px;=D2+T,K1,F.T7#+ EJBRole ZhwC_#

EJBContext.isCallerInRole() =(CZxP(^li#

v yZJ'{DF.T2+T:

getBalance() =(7#ksDJ'{kwCwe{`%d#4,v Banker1 Ii4

Banker1 DJ'`n#

*KP]>&CLr,kjITB=h:

1. +]>&CLr PDDemoApp.ear 4F= WebLogic_domain_directory\applications#

k"b,K?<;GXh9CD#IT+ EAR D~EkD~53DNN?<P#]

>&CLrIZ /AMWLS_install_dir/demo PR=#

2. 9C BEA WebLogic Server XF(4(TBC':

Banker1Banker2Banker3Banker4URLUser1URLUser2URLUser3

3 . 4( 2 vi:BankMember sEJB M BankMember sSe rv l e t#mSC'

Banker1"Banker2"Banker3 M Banker4 AB4(Di#

XZ9C BEA WebLogic Server XF(D8>E",kND BEA WebLogic Server

D5#

4. 9C BEA WebLogic Server XF(?p]>&CLr#

5. *CJ]>&CLr,kCJTB URL:

http://WebLogic_Server_host:WebLogic_Server_listening_port/pddemo/PDDemo

Z 5 B \mNq 31

9CTO(eD Banker C'.;xPO$#

WebLogic_Server_host G BEA WebLogic Server 53Dwz{#

WebLogic_Server_listening_port G BEA WebLogic Server }ZdOxPl}DKZ#

6. i$Gq;P BankMembersServlet iPDC'EICJ servlet#

7. i$w* BankMembersEJB iPI1DQO$C'Gq;\i4{GT:D`

n,x;\i4d{NNC'D`n#

*bT WebSEAL %cG<,kjITB=h:

1. kCJTB URL:

https://webseald_server_name/junction_target/pddemo/PDDemo

WebSEAL +a>zxPO$#

XZd? webseald_server_name M junction_target D5w,kNDZ 26 3D:Z 7

?V:bTdC;#

":r*1! WebSEAL P*+h9(} HTTP xPy>ryZm%DO$,yT

ZK&9C HTTPS#

2. w*TO(eDC'.;xPO$#

K}L9C'\;%cG<= BEA WebLogic Server,"R+wC servlet x;h*

xPZ~NO$#1(} WebSEAL xPCJ1,PDDemo ]>&CLrT>DP

*+k1SCJ BEA WebLogic Server 1T>DP*`,#

3. i$QO$C'Gq;\i4{GT:D`n,x;\i4NNd{C'D`n#

9C<I

1. ZTb?C'tC%cG<1kqX<CD2+T_}#7#vI WebSEAL ~q

w4PO$#*o=K?D,h{CZ?C'T BEA WebLogic Server xPDC

J;4,G);9C WebSEAL CJ BEA WebLogic Server DC'#I(}9C

xg,S}KwjIKYw#,S}Kw9z\;Zxg6p#$J4,x;G(

}9CG+4^FCJ#

2. h*KbDG,Tivoli Access Manager M WebLogic Server <azY'\DO$"

T#b=vz7wT<a,$;v2+TdChC,ChC8(ZbxC'J'.

0JmDns'\"T}#+y]b=vhCPO!D;vbxC'#}g,g{

WebLogic Server dC*JmeNG<'\,x Tivoli Access Manager dC*;J

m}NG<'\,r}NG<'\s+bxC'#

}N%wG<_T

}N%wG<_T(CZyZ LDAP D Tivoli Access Manager 20)9z\;(}8

(G<"T'\DnsN}MM#x(1d4@9Fcz\k%w#K_T4(Kb

y;V4v,4C'ZxP|`N'\DG<"T0,XkH};N1d#}g,_

TIf( 3 N"T'\sXkH} 180 kw*M##bV`MDG<_TI@9Z;

kZ"zm`NDfz"FczzIDG<"T#

}N%wG<_Th*=v pdadmin _T|nhCD2,wC:


v G<"T'\DnsN}

policy set max-login-failures

v ,}G<"T'\hCDM#

policy set disable-time-intervalM#hCI|(J'x(1ddtrJ'Dj+{C#

g{G<_ThC*(w*>})}N"T'\sMaPX(Dx(1dM#,rZ

DN"T(}7rms)a<B;vms3f,C3fywIZ\k_TJ'QY1

;IC#

1ddtTk*%;8( - (iDn!1ddt* 60 k#

g{ disable-time-interval _ThC* disable,rJ'TKC'x(,RKC'D

LDAP account valid tT;hC* no#\m1(} Web Portal Manager XBtC

CJ'#

":+ disable-time-interval hC* disable a<BnbD\m*z#Z+ accountvalid E"4F=e~1zI\a[l=SY#Kiv!vZzD LDAP 73#K

b,IZ account valid D|BYw,3) LDAP 5VDT\I\aB5#vZ

b)-r,(iz9C,11ddt#

TB pdadmin |nvJCZ LDAP "am#

m 3. pdadmin LDAP G<_T|n

|n hv

policy set max-login-failures {number|unset} [-user username]

policy get max-login-failures [-user username]

\mXFZ5)M#0yJmDnsG<"T'\N}

D_T#K|n!vZZ policy set disable-time-interval

|nPhCDM##

w*\m1,zIT+K_T&CZX(C',2IT

+K_T+V&CZ LDAP "amPPvDyPC'#

1!hC* 10 N"T#

policy set disable-time-interval {number|unset|disable} [-user username]

policy get disable-time-interval [-user username]

\mM#_T,C_TXFZo=G<"T'\Dns

N}1&C{CJ'D1d$H#

w*\m1,zIT+KM#_T&CZX(C',2

IT+K_T+V&CZ LDAP "amPPvDyPC

'#

1!hC* 180 k#

>} Tivoli Access Manager r

*>} Tivoli Access Manager r:

1. 7# BEA WebLogic Server Qt/#

Z 5 B \mNq 33

2. 9CXF(,|D1!r,by|M;aG Tivoli Access Manager for WebLogic

create_realm Yw4(Dr#


4. *9CXF(>} Tivoli Access Manager r:

a. S BEA WebLogic Server <=8r* Access Manager <j#

b. %wr<j#T>rdC3f#

c. %w>}#T>>}rdC3f#

d. %w7(#T>xPUVND4(r3f#

5. *9C|nP>} Tivoli Access Manager r,r9C AMWLSConfigure -action

delete_realm#PXk AMWLSConfigure -action delete_realm |n;p9CD!

nDj8E",kNDZ 49 3D=< B, :|nlYN<;#

":g{ZD~b9}LP4+ Tivoli Access Manager for WebLogic 20=(iD;

C,r7#+ AMWLSConfigure E>PD AMSSPI_DIR d?hC*5J20?<

D;C#`FX,g{4+ WebLogic 20Z1!;C,rZ ALWLSConfigureE>P9C WebLogic.jar D}7;C|B WLS_JAR d?#

!{dC Tivoli Access Manager for WebLogic*!{dC Tivoli Access Manager for WebLogic:

1. 7# BEA WebLogic Server Qt/#

2. 7# Tivoli Access Manager rQ>}#kNDZ 33 3D:>} Tivoli Access

Manager r;#

3. *9CXF(!{dC Tivoli Access Manager for WebLogic:

a. %w Access Manager D~P#T>dC3f#

b. %w>}#T>!{dC3f#

c. dk Tivoli Access Manager sec_master \k"%w7(#

d. T>xPUVNDdC3f#

4. *S|nP!{dC Tivoli Access Manager for WebLogic,r9C AMWLSConfigure

-action unconfig |n#PXk AMWLSConfigure -action unconfig |n;p9

CD!nDj8E",kNDZ 49 3D=< B, :|nlYN<;#

JOoO<I

wbw}:

v :9CyZm%DG<1D%cG<'\;

v Z 35 3D:WebLogic Server WvZfl#;

9CyZm%DG<1D%cG<'\

1C'Q(}yZm%DG<xPKO$,""TCJ{GTd;_PmI(DJ4

1,aT>TBms{":

^(S WebSEAL "a{"

r*495JOITO$C',{G2;_PCJ Web ]wP servlet DmI(,yT

a"zKiv#


g{Z9Cy>O$1"zKiv,+XBa>C'dkO$j8E",x;GT>

Ov3f#bG1!D BEA WebLogic Server P*,g{C'1SCJr(}

WebSEAL CJ3f1,+4=Kiv"z#

WebLogic Server WvZfl#

Jb:Wv java.lang.OutofMemory l##

5w:1KPs?D Access Manager for WebLogic Server a01,BEA WebLogic

Server I\aC!QUd#

bv=(:Z startWebLogic E>Pvs Java ibz(JVM)DnsQs!!n#}

g:

%JAVA_HOME%\bin\java -ms64m -mx128m -xms200m -xx:MaxPermSize=128m

ky]&CLre5a9"wz53OKPD{Ds?ZfDxLD}?T0 BEA

WebLogic Server Df>,N< BEA z7D5Tq!FvDQs!#&1T&CLr

xP?HbT,T7(kTd73D`&Qs!#

V^

1. Tivoli Access Manager for WebLogic ;'V]ii1Jq(iPDi)#

2. Tivoli Access Manager for WebLogic 'V`v Tivoli Access Manager r,+G?

vrD sec_master C'Xk;F* sec_master#4,TZ?v Tivoli Access Manager

r,10;PICZ|DKC'{D!n#

3. Z BEA WebLogic Server 8.1 P,IZZi{P;'V0-1V{,rK9C anyother

4zf any-other w*i{#

4. 1T Active Directory dC Tivoli Access Manager for WebLogic 1,IZ

administrators iQ-fZZ Active Directory PRdC+a'\,rKh*+

AdminGroupProp=Administrators hC|D*d|hC#ZdC Tivoli Access

Manager for WebLogic "4( Tivoli Access Manager for WebLogic r.04PK

YwGG#X*D#

5. 19C Tivoli Access Manager for WebLogic XF(44(G+M_T1,1d^

F;\'V#z;\,1+C'rimS=_TMG+#z;\ZG+M_T.d

9C0OR1,0AND1G;\'VD#

6. 1!ivB,Tivoli Access Manager _Y:fC'>$D1d* 2 !1#I(}|

B PdPerm.properties PD appsvr-credcache-life tT4dCK1d5#

7. ;'VS WebSEAL r Tivoli Access Manager Plug-in for Web Servers = WebLogic

Server XF()9D%cG<#+G,IZ WebLogic Server XF(TZSrXx

CJDC'(#G;ICD,rKb;GvsJb#

Z 5 B \mNq 35

Q*JbMd(=(

1. 1?p$i&CLr1,9C Active Directory C'"amxPD20I\av=J

b#KJbiLZ Administrator iM53C'D2`kG+3d#Z Active

Directory P,Administrator iM53C'<G$H(eD,R;\;}%#*}%

b)ms"7#+}7D2+TCZ$i&CLr,r`- certificate.war Web

&CLrD?phv{,}%b)3d,;smSk5JD Administrator iM53

C'`&D3d#

2. ;Jm Tivoli Access Manager for WebLogic SXF(4P_T|BDJbfZZ

BEA WebLogic Server V8.1 P#KJbD BEA WebLogic Server |Dks(CR)

E* CR125113#1=Z BEA WebLogic Server 8.1 service pack PTKJbxP

^)s,E'V9CXF(xP_T|B#


Z 6 B }%8>E"

>BhvgN}% IBM Tivoli Access Manager for WebLogic Server#

kjITBwZ.;PD8>E":

v :S Solaris }%;

v :S Windows }%;

v Z 38 3D:S AIX }%;

v Z 38 3D:S HP-UX }%;

S Solaris }%

ZLxxP Tivoli Access Manager for WebLogic D}%.0,7#Q>} Tivoli Access

Manager r"!{dC Tivoli Access Manager for WebLogic#PX4Pb)NqDj

8E",kNDZ 33 3D:>} Tivoli Access Manager r;MZ 34 3D:!{dC

Tivoli Access Manager for WebLogic;#

Z Solaris O9C pkgrm }% Tivoli Access Manager for WebLogic#kjITB8

>E":

1. w* root C'G<#

2. *}% Tivoli Access Manager for WebLogic,kdkTB|n:

# pkgrm PDWLS

T>a>,*sz7O}%!(m~|#dkV8 y#

3. T>/f,(*zZ}%}LPT,6C'mI(4PE>#dkV8 y#

+vV4,{"Pv?v}%DD~#Zs}%E>KP.s,+vV;u4,{

",8>QI&}%m~|#pkgrm 5CLrKv#

Tivoli Access Manager for WebLogic m~|D}%QjI#

g{k*}% IBM Tivoli Access Manager Base Hvu~(Tivoli Access Manager Base

runtime environment"Tivoli Access Manager Base Java runtime environment T0I!

D Tivoli Access Manager &CLr*"$_/),kq-6IBM Tivoli Access Manager

Base 208O7PD8>E"#

S Windows }%





9C Windows0mS/>}Lr1<jgfI}% Tivoli Access Manager for WebLogic

D~#kjITB8>E":


1. w*_P\m1X(D Windows C'G<#

2. +wmS/>}Lr<j#

3. !q Access Manager for WebLogic Application Server#

4. %w|D/>}#

Tivoli Access Manager for WebLogic D~;}%#

+vV0,$jI1T0r#

5. %w7(#

Tivoli Access Manager for WebLogic D}%QjI#




Base 208O7PD8>E"#

S AIX }%





9C installp 5CLrI}% Tivoli Access Manager for WebLogic for AIX m~|#




Base 208O7PD8>E"#

S HP-UX }%





9C swremove I}% Tivoli Access Manager for WebLogic D~#kjITB8>

E":

1. w* root C'G<#

2. *}% Tivoli Access Manager for WebLogic,kdkTB|n:

# swremove PDWLS

+vV;5P4,{"#+vV;u4,{",8>VvWNQI&#swremove 5

CLr+S2L}% Tivoli Access Manager for WebLogic D~#

1}%YwjI1,swremove 5CLrKv#

Z HP-UX O}% Tivoli Access Manager for WebLogic VZQjI#





Base 208O7PD8>E"#

Z 6 B }%8>E" 39


=< A. tTD~N<

ZdC Tivoli Access Manager for WebLogic "4(r1dkD}]f"ZtTD~P#

b)tTD~ICZ|D Tivoli Access Manager for WebLogic DP*#

tTD~fZZ java_home/amwls/wls_domain_name/wls_realm_name/ P#dP

wls_domain_name *zdCD BEA WebLogic Server r(domain)D{F,

wls_realm_name *Kr(domain)ZzdCD BEA WebLogic Server r(realm)D{

F#

P}vtTD~:

v amsspi.properties

|,X(Z BEA WebLogic Server D SSPI wv=fDdCtT#

v rbpf.properties

|, Tivoli Access Manager for WebLogic DdCtT,}g,_Y:fhC"G+

tTM Tivoli Access Manager \#$TsUd]w{#

v amwlsjlog.properties

KD~PDN}XF Tivoli Access Manager for WebLogic DU>G<MzY,|(

4PDzY/{"+]?#k"b$nzYaT Tivoli Access Manager for WebLogic

DT\zz0l#RG(iv1"T7(JbD-r1E$nzY#

TBwZ|,T?vtTD~PvVDN}Dhv#

jG{0***1m>;ZdC Tivoli Access Manager for WebLogic 1dkDtT#b

)tTZdC1;hC*1!5#g{zk*+b)5hC*;,Z1!5Dd|

5,rh*ZdC"4(r.0,Z`&D .in D~P|DtT5# config M

create_realm Yw9C .in D~PD544( ACL M Tivoli Access Manager \#

$Ts,rKZdCr4(rs;\|Db)5#TBwZP;PC0***1jGDt

TIZdCs\]WX|D#

.in D~IZ /pdwls_install_dir/etc PR=#

amsspi.properties>ZPv"hvK amsspi.properties D~PvVDtT#

com.tivoli.amwls.sspi.config.DeployerGroupProp***1!5* Deployers#1!ivB,BEA WebLogic Server P 4 v\mi,K

tTJmC'+ Deployers \miD{F|D*d|G Deployers D{F#

com.tivoli.amwls.sspi.config.MonitorGroupProp***1!5* Monitors#1!ivB,BEA WebLogic Server P 4 v\mi,K

tTJmC'+ Monitors \miD{F|D*d|G Monitors D{F#

com.tivoli.amwls.sspi.config.OperatorGroupProp***1!5* Operators#1!ivB,BEA WebLogic Server P 4 v\mi,K

tTJmC'+ Operators \miD{F|D*d|G Operators D{F#


com.tivoli.amwls.sspi.config.AdminGroupProp***1!5* Administrators#1!ivB,BEA WebLogic Server P 4 v\mi,

KtTJmC'+ Administrator \miD{F|D*d|G Administrators D

{F#IZ Windows Q-_P;v{* Administrators D\mi,KtTXk

|B,rKTZ9C Active Directory D53,KtTG\X*D#

com.tivoli.amwls.sspi.Authentication.GroupRegistryDelete1!5* true#KtT7(1>} Tivoli Access Manager i1Gq>}Wc?

<PDi#KtTkr*/XU -registry j>(19C pdadmin >}i1)

yp=DwCG`,D#

com.tivoli.amwls.sspi.Authentication.UserRegistryDelete1!5* true#KtT7(1>} Tivoli Access Manager C'1Gq>}Wc

?<PDC'#KtTkr*/XU -registry j>(19C pdadmin >}

C'1)yp=DwCG`,D#

com.tivoli.amwls.sspi.Authentication.ssoEnabled1!5* false#KtTtC/{CS WebSEAL r Tivoli Access Manager

Plug-in for Web Servers = BEA WebLogic Server D%cG<#

com.tivoli.amwls.sspi.Authentication.ssoTrustIdCZ("k WebSEAL r Tivoli Access Manager Plug-in for Web Servers D

ENX*44P%cG<DC'#

com.tivoli.amwls.sspi.Authentication.ssoPasswdExpiry1!5* 120(VS)#KtT8(_Y:f SSO ENj6O$D1d$H(T

VS*%;),;)KNax,rZB;N SSO "T1T Tivoli Access

Manager O$K SSO C'#

com.tivoli.amwls.sspi.RoleMapper.EnableWebProgRolecheck1!5* true#KtTtCr{C Web F.TG+li#KtT9C\m1\

;XU Web &CLrDF.T2+T#

com.tivoli.amwls.sspi.RoleMapper.EnableEjbProgRolecheck1!5* true#KtTtCr{C EJB F.TG+li#KtT9C\m1\

;XU EJB DF.T2+T#

com.tivoli.amwls.sspi.Authentication.GroupDNPrefixTZ LDAP,1!5* cn=#KtTJm\m1ZSXF()94(i1|D

0:#

com.tivoli.amwls.sspi.Authentication.UserDNPrefixTZ LDAP,1!5* cn=#KtTJm\m1ZSXF()94(C'1|

D0:#

rbpf.properties>ZPv"hvK rbpf.properties D~PvVDtT#

com.tivoli.pd.as.rbpf.ProductName1!5* PDWLS#KtTCZZ4( Tivoli Access Manager TsM ACL 1

D"MMhv#

com.tivoli.pd.as.rbpf.RoleContainerName***1!5* Roles#dCs,KtT|D*


Roles/$WLS_Domain_Name/$WLS_Realm_Name#dP WLS_Domain_Name *dC

D BEA WebLogic Server r(domain)D{F,WLS_Realm_Name *dCD

BEA WebLogic Server r(realm)D{F#

com.tivoli.pd.as.rbpf.ResourceContainerName***1 ! 5 * R e s o u r c e s # d C s , K t T | D *

Resources/$WLS_Domain_Name/$WLS_Realm_Name#dP WLS_Domain_Name *

dCD BEA WebLogic Server r(domain)D{F,WLS_Realm_Name *d

CD BEA WebLogic Server r(realm)D{F#

com.tivoli.pd.as.rbpf.PosRoot***1!5* WebAppServer#KtT* Tivoli Access Manager for WebLogic Py

PG+MJ4DTsUdDxTy#

com.tivoli.pd.as.rbpf.ProductId***1!5* WLS#KtTk PosRoot 5aOTNIyPG+MJ4DTsUd

Dy#

com.tivoli.pd.as.rbpf.AMActionGroup***1!5* WebAppServer#KtT*YwiD1!{F,KYwiCZf"Yw

T8 Tivoli Access Manager for WebLogic CJv(li#

com.tivoli.pd.as.rbpf.AMAction***1!5* i,TCZwC#1 Tivoli Access Manager for WebLogic 4PCJ

v(1liKYw,|+;mSA AMActionGroup#

com.tivoli.pd.as.cache.EnableDynamicRoleCaching1!5* true#KtTtCr{C/,G+_Y:f#/,G+_Y:fCZ_

Y:fyPU(DG+,4G\mG+DG+#|_Y:f}fM:fG+I

1#

com.tivoli.pd.as.cache.DynamicRoleCache1!5* com.tivoli.pd.as.cache.DynamicRoleCacheImpl#KtTGCZ4P/,

G+_Y:fD`#g{X*,I5VzT:D/,G+_Y:f#I(}5

V com.tivoli.pd.as.cache.IDynamicRoleCache SZ4o=K?D#

com.tivoli.pd.as.cache.DynamicRoleCache.NumBuckets1!5* 20#KtT8(Wc"Pm(K"PmCZf"/,G+_Y:fu

?)P&9CDf"xD}?#

com.tivoli.pd.as.cache.DynamicRoleCache.MaxUsers1!5* 100000#KtT*_Y:fPyPf"xDu?\}#+K}V}T

NumBuckets 47(?v%@Df"xDnss!#

com.tivoli.pd.as.cache.DynamicRoleCache.RoleLifetime1!5* 20#KtT8(}fM:f/,G+_Y:fv_Z_Y:fP#t

D1d$H(Tk*%;)#

com.tivoli.pd.as.cache.DynamicRoleCache.PrincipalLifeTime1!5* 10#KtT8(we>$f"Z Tivoli Access Manager for WebLogic

_Y:fPD1d$H(TVS*%;)#k"b,PdPerm.properties 5

(appsvr-credcache-life)7(Z PDJRTE P_Y:f>$D1d#Tivoli Access

Manager for WebLogic S PDJRTE q!yPD>$,rK,g{K5!Z

appsvr-credcache-life,rZ Tivoli Access Manager for WebLogic S PDJRTE

lw;_Y:fD>$1M2GKK5#

=< A. tTD~N< 43

com.tivoli.pd.as.cache.EnableStaticRoleCaching1!5* true#KtTtCr{C2,G+_Y:f#2,G+_Y:fCZ_

Y:f\mG+D}fM:fG+I1#}u?;}Zb,K_Y:fk/,

G+_Y:f`,#IZ\mG+DI1;&|D,bMa_Kb)G+DT

\#

com.tivoli.pd.as.cache.StaticRoleCache1!5* com.tivoli.pd.as.cache.StaticRoleCacheImpl#KtTGCZ4P2,G

+_Y:fD`#g{X*,I5VzT:D2,G+_Y:f#I(}5V

com.tivoli.pd.as.cache.IStaticRoleCache SZ4o=K?D#

com.tivoli.pd.as.cache.StaticRoleCache.Roles1!5* Admin, Operator, Monitor, Deployer#KtT]I;PT:EVtD

\mG+#+KPmPDG+I1mS=2,G+_Y:f(x;G/,G+

_Y:f)P#Z/,G+_Y:fP_Y:fyPd|G+I1#

com.tivoli.pd.as.cache.EnableObjectCaching1!5* true#KtTtCr{CTs_Y:f#Ts_Y:fCZ_Y:fy

P Tivoli Access Manager Ts,|(|GD)9tT#bMJmKD)G+D

_Y:f;Z(CJD) BEA WebLogic Server J4;rx{}K*?vJ4

ksi/ Tivoli Access Manager Authorization server Dh*#

com.tivoli.pd.as.cache.ObjectCache1!5* com.tivoli.pd.as.cache.ObjectCacheImpl#KtTGCZ4PTs_Y:

f D ` # g { X * , I 5 V z T : D T s _ Y : f # I ( } 5 V

com.tivoli.pd.as.cache.IObjectCache SZ4o=K?D#

com.tivoli.pd.as.cache.ObjectCache.NumBuckets1!5* 20#KtT8(Wc"PmPC4f"Ts_Y:fu?DDf"x

D}?#

com.tivoli.pd.as.cache.ObjectCache.MaxResources1!5* 10000#KtT8(_Y:fPyPf"xDu?\}#+K}V}T

NumBuckets 47(?vf"xDnss!#

com.tivoli.pd.as.cache.ObjectCache.ResourceLifeTime1!5* 20#KtT8(Ts#tZTs_Y:fPD1d$H(TVS*%

;)#

com.tivoli.pd.as.rbpf.UncheckedRoles1!5* Unchecked, AmasUnckeched, Anonymous#KtT8(;PT:EVt

D J2EE 4liG+#g{Z(PvG+PDNN;vCJ BEA WebLogic

Server J4,r;[,SDGD)U(G+,<aZ(yPC'CJKJ4#;

\+C'MimS=b)G+#b)G+zmK;V*yPC'(|(4O$

DC')Z(CJX(J4DP'==#IZ Tivoli Access Manager for

WebLogic dC+ Anonymous G+mSx8vy> BEA WebLogic Server J

4,rKC4liDG+&\GtZKPmP#KtT;h*ZdC0hC,

+G;)hCKM;I|D#

com.tivoli.pd.as.rbpf.ExcludedRoles1!5* Excluded, AmasExcluded#KtT8(;PT:EVtD J2EE E}

G+#rK,g{+b)G+PNN;v,S=3vJ4,r;[,SDGD


)U(G+,;PC'a;Z(CJKJ4#b) J2EE E}G+zmK;V

\xyPC'CJX(J4DP'==#KtT;h*ZdC0hC,+G;

)hCKM;I|D#

com.tivoli.pd.as.rbpf.GrantUnprotectedAccess1!5* true#KtT8(GZh9G\xT;ksJ4(CJ4;\#$)D

CJ;4,;P;ZhNNG+DTs#

com.tivoli.pd.as.rbpf.CopyParentRole***1!5* false#KtTJm\m18(Z4(&Z|X(6pDG+(}g,

Z&CLr6pDG+)1Gq&4FZO_6p(}g,+VG+)(eD

G+I1#Z Tivoli Access Manager P,bf0=+,SD ACL(Z+V6

pO)DyPI14F=,S=TsD ACL(Z&CLr6pO)#KtTxh

\m1Z4(BG+1+LPEn&CZG+I1D\&#(#KtT5&h

C*k PropogateChileRole `,D5#

com.tivoli.pd.as.rbpf.PropagateChildRole***1!5* false#KtTJm\m18(GqTSG+(}g,Z&CLr6p

DG+)wvkZO_6p(}g,+VG+)(eDG+I1,yD|D#

2MG5,+ userA mSx+VG+ RoleA D,1,2+ userA mSxK&

CLr6pD RoleA#KtTZ|BG+I11v?K CopyParentRole "x

;=&CKG+I1LP#(#,KtT5&hC*k CopyParentRole `,

D5#

com.tivoli.pd.as.rbpf.UseEntitlements1!5* false#KtT8> Tivoli Access Manager Authorization Server PD

Z(~qGq&CZU/PXD)G+;Z(CJD)J4DE"#K1!5

* false,rKzIThC9 Tivoli Access Manager for WebLogic KPD Tivoli

Access Manager ~qDn!}?#+G,IZTZ Tivoli Access Manager Policy

Server P%;JOc,rKKtTZbT73Pv\hC* false#KZ(~q

2ZyZZ?Ts_Y:fDO_6pO4P#rK,Zzz73PK5&\

GhC* true#

com.tivoli.pd.as.rbpf.EntitlementsUser1!5* Tivoli Access Manager for WebLogic remote-acl-user#KtT]IC

49CZ(~q4PTsiRDC'#KZ(~q7#}ZS Tivoli Access

Manager \#$TsUdksTsDC';Zh Server Admin Generic0s1m

I(#Z config }LP,+ remote-acl-user mS= iv-admin i,"+KmI

(Zh|#I(}|D}ZksTsDC'4|B|,+G,zh*7#Z

Tivoli Access Manager \#$TsUdPD Resources ]wOZhKBC'0s1

mI(#

com.tivoli.pd.as.rbpf.IgnorePasswordPolicyOnUserCreate1!5* false#KtTJm\m1Z(} BEA WebLogic Server XF(4(

B Tivoli Access Manager C'1vT\k_T#

com.tivoli.pd.as.rbpf.DeleteBaseRoleRecursive1!5* true#KtT8>Z>}8G+1Gq>}yPSG+#

amwlsjlog.propertiesamwlsjlog.properties D~*j< JLog tTD~#|CZXF Tivoli Access Manager

for WebLogic T0 PDJRTE PD{"+]MzY#

=< A. tTD~N< 45

IZ amwlsjlog.properties D~P|,Ds`}tTkRGD?D^X,rK>Z;

PPvyPtT#+G,}GSKD~tCr{C{"+]MzY#

amwlsjlog.properties D~PDu?Z>JOGVcD#I"4*}vi~r*U>G

<,2I*%vi~r*U>G<#

*r*U>G<,;h*+ isLogging tTmS=zk**.tCU>G<Di~#

TBPvDi~* Tivoli Access Manager for WebLogic 'VDyPzYM{"+]i

~#I*b)PvDtT.;tCzY/{"+],2I*yPtTtCzY/{"

+]#TB*?vi~y4PDYwDrLhv#

i~ hv

zY

AmasRBPFTraceLogger T Tivoli Access Manager for WebLogic Z?

YwDzY#

AmasCacheTraceLogger TyP Tivoli Access Manager for WebLogic _

Y:fDzY#

AMSSPICfgTraceLogger T Tivoli Access Manager for WebLogic D

config Yw(}g,G+4()DzY#

AMSSPIAuthzTraceLogger T Tivoli Access Manager for WebLogic DZ

(a)LrDzY#

AMSSPIAuthnTraceLogger T Tivoli Access Manager for WebLogic DO

$a)LrDzY#

AMSSPIRoleMapperTraceLogger T Tivoli Access Manager for WebLogic DG

+3da)LrDzY#

AMSSPIResourceManagerTraceLogger

T Tivoli Access Manager for WebLogic ZJ

4\mwDzY#

{"+]

AmasCacheMessageLogger Tivoli Access Manager for WebLogic Z?Yw

D{"+]#

AmasRBPFMessageLogger yP Tivoli Access Manager for WebLogic _

Y:fD{"+]#

AMSSPICfgMessageLogger Tivoli Access Manager for WebLogic D configYw(}g,G+4()D{"+]#

AMSSPIAuthzMessageLogger Tivoli Access Manager for WebLogic DZ(a

)LrD{"+]#

AMSSPIAuthnMessageLogger Tivoli Access Manager for WebLogic DO$a

)LrD{"+]#

AMSSPIRoleMapperMessageLogger

Tivoli Access Manager for WebLogic DG+3

da)LrD{"+]#

AMSSPIResourceManagerMessageLogger

Tivoli Access Manager for WebLogic ZJ4\

mwD{"+]#

TO?vi~)9K baseGroup traceLogger M baseGroup messageLogger#r

K,ZtTD~P,|GDtT+aMK>}`F:

baseGroup.AMSSPIAuthnMessageLogger.isLogging=true


TO>}tCK Tivoli Access Manager for WebLogic DO$a)Lr?VD{"+]#

g{k*T}Z(a)LrbDyPi~tCzY,&mSTBP:

baseGroup.TraceLogger.isLogging=truebaseGroup.AMSSPIAuthzMessageLogger.isLogging=false

4,d|yPzYi~+Sy>G<wr%LP true 5#+GZ(G<waC false 5

2G ture 5#

=< A. tTD~N< 47


=< B. |nlYN<


AMWLSConfigure –action configdC Tivoli Access Manager for WebLogic Server#

o(

AMWLSConf igure –act ion conf ig –domain_admin doma in_admin

–domain_admin_pwd domain_admin_password –remote_acl_user remote_acl_user

–sec_master_pwd sec_master_pwd –pdmgrd_host pdmgrd_host –pdacld_hostpdacld_host [–deploy_extension {true|false}] [–wls_server_url wls_server_url][–am_domain am_domain] [–pdmgrd_port pdmgrd_port] [–pdacld_port pdacld_port][–amwls_home amwls_home] [–verbose {true|false}]

N}

–am_domain am_domain

8( Tivoli Access Manager rD{F#1!r* Default#

–amwls_home amwls_home

8(= Tivoli Access Manager for WebLogic Server 20?<D76#

–deploy_extension {true|false}1hC* true 1,?p Tivoli Access Manager Web Logic Server V5.1 XF()

9#1!5* true#

–domain_admin domain_admin

8( WebLogic r\m1#

–domain_admin_pwd domain_admin_password

8( WebLogic r\m1\k#

–pdacld_host pdacld_host

8( Tivoli Access Manager authorization server wz{#

–pdacld_port pdacld_port

8( Tivoli Access Manager authorization server KZE#1!KZE* 7136#

–pdmgrd_host pdmgrd_host

8( Tivoli Access Manager policy server wz{#

–pdmgrd_port pdmgrd_port

8( Tivoli Access Manager policy server KZE#1!KZE* 7135#

–remote_acl_user remote_acl_user

8(* authorization server 4(D Tivoli Access Manager we#

–sec_master_pwd sec_master_pwd

8( Tivoli Access Manager \mC'\k((#G sec_master)#

–verbose {true|false}1hC* true 1,tCj8dv#1!5* false#

–wls_server_url wls_server_url

8(>X WebLogic Server D URL#1!5*

t3://localhost:7001


ICT

K|n;ZTB1!20?<:

v UNIX 53:

/opt/pdwls/sbin/

v Z Windows 53O:

C:\Program Files\Tivoli\pdwls\sbin\

1!qKG1!?<D20?<1,K5CLr;Z20?<BD sbin ?<P(}g,

install_dir\sbin\)#

5Xk

I5XTBKv4,k:

0 |nI&jI#

1 |n'\#

1|n'\s,T>;ums{"#PXJbD|`j8hv,kND IBM Tivoli

Access Manager Error Message Reference#

=< B. |nlYN< 51

AMWLSConfigure –action unconfig!{dC Tivoli Access Manager for WebLogic Server#

o(

AMWLSConfigure –action unconfig –domain_admin_pwd domain_admin_pwd

–sec_master_pwd sec_master_pwd [–verbose {true|false}]

N}

–domain_admin_pwd domain_admin_pwd

8( Tivoli Access Manager for WebLogic Server r\m1\k#

–sec_master_pwd sec_master_pwd

8( Tivoli Access Manager \mC'\k((#G sec_master)#


ICT

K|n;ZTB1!20?<:

v UNIX 53:

/opt/pdwls/sbin/

v Z Windows 53O:



install_dir\sbin\)#

5Xk

I5XTBKv4,k:

0 |nI&jI#

1 |n'\#




AMWLSConfigure –action create_realmZ WebLogic Server P4(2+r#

o(

AMWLSConfigure –action create_realm –realm_name realm_name

–domain_admin_pwd domain_admin_pwd –user_dn_suffix user_dn_suffix

–group_dn_suffix group_dn_suffix –admin_group admin_group [–user_dn_prefixuser_dn_prefix] [–group_dn_prefix group_dn_prefix] [–sso_enabled {true|false}][–sso_user sso_user] [–sso_pwd sso_pwd] [–verbose {true|false}]

N}

–admin_group admin_group

8(CZZ?dC?DD Tivoli Access Manager i#


8( WebLogic r\m1\k#

–group_dn_prefix group_dn_prefix

8(Z4(i1*9CD(P{F(DN)0:#

–group_dn_suffix group_dn_suffix

8(Z4(i1*9CD(P{F(DN)s:#

–realm_name realm_name

8(}Z4(D WLS rD{F#

–sso_enabled {true|false}1hC* true 1,tC%cG<'V#1!5* false#

–sso_pwd sso_pwd

*%cG<C'(sso_user)8(\k#

–sso_user sso_user

8(CZ4(k Tivoli Access Manager D%cG<ENX*DC'#

–user_dn_prefix user_dn_prefix

8(Z4(C'1*9CD(P{F(DN)0:#

–user_dn_suffix user_dn_suffix

8(Z4(C'1*9CD(P{F(DN)s:#


ICT

K|n;ZTB1!20?<:

v UNIX 53:

/opt/pdwls/sbin/

v Z Windows 53O:


=< B. |nlYN< 53


install_dir\sbin\)#

5Xk

I5XTBKv4,k:

0 |nI&jI#

1 |n'\#




AMWLSConfigure –action delete_realmS WebLogic Server >}2+r#

o(

AMWLSConfigure –action delete_realm –domain_admin_pwd domain_admin_pwd

[–registry_clean {true|false}] [–verbose {true|false}]

N}


8( WebLogic r\m1\k#

–registry_clean {true|false}}%ZdC}LP4(DC'Mi#1!5* false#


ICT

K|n;ZTB1!20?<:

v UNIX 53:

/opt/pdwls/sbin/

v Z Windows 53O:



install_dir\sbin\)#

5Xk

I5XTBKv4,k:

0 |nI&jI#

1 |n'\#



=< B. |nlYN< 55


=< C. yw

>E"G*Z@za)Dz7M~q`4D#IBM I\Zd{zRrXx;a)>D5

PV[Dz7"~qr&\XT#PXz10yZxrDz7M~qDE",krz

1XD IBM zmI/#NNT IBM z7"Lrr~qD}C"GbZw>r5>;

\9C IBM Dz7"Lrr~q#;*;V8 IBM D*6z(,NN,H&\Dz

7"Lrr~q,<ITzf IBM z7"Lrr~q#+G,@@Mi$NNG IBM

z7"Lrr~q,rIC'TP:p#

IBM +>I\Q5Pr}Zjkk>D5yvZ]PXDwn({#a)>D5"4Z

hC'9Cb)({DNNmI#zITCif==+mIi/Dy:

IBM Director of Licensing

IBM Corporation

500 Columbus Avenue

Thornwood, NY 10594

U.S.A

PX+VZ(DBCS)E"DmIi/,kkzyZzRrXxD IBM *6z(?E*

5,rCif==+i/Dy:

IBM World Trade Asia Corporation

Licensing

2-31 Roppongi 3-chome, Minato-ku

Tokyo 106, Japan

>un;JC"zrNNbyDunk1X(I;;BDzRrXx:International

Business Machines Corporation04V41a)>vfo,;=PNNV`D(^[Gw

>D9G5,D)#$,|(+;^Z5,DPXGV("JzMJCZ3VX(C

>D#$#3)zRrXxZ3);WP;Jmb}w>r5,D#$#rK>un

I\;JCZz#

>E"PI\|,<u=f;;<7DX=r!"ms#K&DE"+(Z|D;b

)|D+`k>vfoDBf>P#IBM ITf1T>vfoPhvDz7M/rLr

xPDxM/r|D,x;mP(*#

>E"PTG IBM Web >cDNN}C<;G*K=cp{Ea)D,;TNN==

d1TG) Web >cD#$#G) Web >cPDJO;G IBM z7JOD;?V,

9CG) Web >cx4DgU+IzTPP##

IBM IT4|O*J1DNN==9CrV"zya)DNNE"x^kTzP#NN

pN#

>LrD;mI=g{*KbPXLrDE"To=gB?D:(i)JmZ@"4(

DLrMd{Lr(|(>Lr).dxPE";;,T0(ii)JmTQ-;;DE

"xP`%9C,kkBPX7*5:


IBM Corporation

2Z4A/101

11400 Burnet Road

Austin, TX 78758

USA

;*qXJ1Du~Mun,|(3)iNBD;(}?D6Q,<IqCb=fD

E"#

>JOPhvDmILr0dyPICDmIJOyI IBM @] IBM M'-i"IBM

zJm~mI-irNN,H-iPDuna)#

K&|,DNNT\}]<GZ\X73PbCD#rK,Zd{Yw73PqCD

}]I\aPwTD;,#P)b?I\GZ*"6D53OxPD,rK;#$k

;cIC53OxPDb?a{`,#Kb,P)b?G(}Fcx@FD,5Ja

{I\aPnl#5Ja{IkK;,#>D5DC'&1i$dX(73DJC}

]#

f0G IBM z7DE"ISb)z7D)&L"dvf5wrd{I+*qCDJO

Pq!#IBM ;PTb)z7xPbT,2^(7OdT\D+7T"f]TrNNd

{XZG IBM z7Dyw#PXG IBM z7T\DJb&1rb)z7D)&La

v#

yPXZ IBM 44=rrbrDyw<If1|DrUX,x;mP(*,|Gvv

m>K?jMb8xQ#

>E"|,U#L5KwP9CD}]M(fD>}#*!I\mvj{,b)>}

|,vK"+>"7FMz7D{F#yPb){V<Gi9D,g{k5JL5s

59CD{FMX7PNN`F.&,?tIO#

g{z}Tm=4q=i4>E",<,MJ+<}I\^(T>#

Lj

TBuoG International Business Machines Corporation Z@zM/rd{zRrXx

DLjr"aLj:

AIX

DB2

IBM

IBM Uj

SecureWay

Tivoli

Tivoli Uj

Microsoft"Windows"Windows NT M Windows UjG Microsoft Corporation Z@z

M/rd{zRrXxDLj#

Java MyPyZ Java DLjMUjG Sun Microsystems,Inc. Z@zMd{zRrX

xDLjr"aLj#


UNIX G The Open Group Z@zMd{zRrXxD"aLj#

d{+>"z7M~q{FI\Gd{+>DLjr~qjG#

=< C. yw 59


Jcm

2A3

2+\m(security management): ;V\m<x,+

3i/D\&/PZXFTCi/DI&\X|D&CL

rM}]yxPDCJ#

2+WSVc(secure sockets layer,SSL): a)(

E#\TD;V2+T-i#SSL 9M'z/~qw&C

Lr\;T3VhFC4@9T}"\DM1l{"D=

=xP(E#SSL GI Netscape Communications Corp. M

RSA Data Security, Inc *"D#

2B3

s((bind): 9j6kLrPDm;vTs`X;}

g,9j6k3v5"X7rm;vj6`X,r_9N

=N}k5JN}`X*#

#$6p(quality of protection): }]2+TD6

p,IO$"j{TM#\Tu~DiO7(#

2C3

Yw(action): ;VCJXFm(ACL)mI(tT#

m{CJXFm(access control list,ACL)#

_T(policy): &CZ\\J4D;ifr#

, D > + d - i ( h y p e r t e x t t r a n s f e rprotocol,HTTP): rXx-i/PCZ+d"T>,D

>D5D-i#

2D3

%cG<(single signon,SSO): C'G<;NM\

CJ`v&CLr"x^hVpG<=?v&CLrD\

&#m{+V"a(global signon)#

]}=O$(step-up authentication): ;V\#$T

s_T(POP),|@5Z$HdCDO$6pcNa

9,"y]J4OhCD_T5)X(6pDO$#]}

=O$ POP ;?FC'9C`vO$6pxPO$SxC

JNNx(J4,+*sC'AY9Ck#$CJ4D_

Ty*sD,HO$6pxPO$#

`74CzmLr(multiplexing proxy agent,MPA):

a)`vM'zCJD;VxX#1`vM'z9C WAP

CJ32+r1,b)xXP1;F*^_CJ-i

(Wireless Access Protocol,WAP)xX#xX("(r4

~qwD%vO$(@,"(}K(@dMyPM'zk

sMl&#

`rSO$(multi-factor authentication): ?FC'

9C=vr`vO$6pxPO$D;V\#$Ts_T

(POP)#}g,T3\#$J4DCJXFIT*sC

',19CC'{/\kMC'{/nF(PzkxPO

$#m{\#$Ts_T(protected object policy)#

2F3

CJXFm(access control list,ACL): ZFcz2

+TPk3vTs`X*D;vPm,|8vG)\;C

JCTsDyPweT0|GDCJ(#}g,CJXF

mG;vk3vD~`X*DPm,|8vITCJCD

~DC'"8vC'TCD~DCJ(#

CJXF(access control): ZFcz2+TP,7#

Fcz53DJ4;\IZ(C'TZ(==CJD}

L#

CJmI((access permission): JCZ{vTsD

CJX(#

~q(service): I~qwy4PDYw#~qITGT

*"Mrf"D}]xPDr%ks(}gTD~~q

w"HTTP ~qw"gSJ~~qwM8k~qwDk

s),2ITG|*4SDYw,}gr!~qwrxL

~qwDYw#

1>~qw(replica): |,m;v~qw;vr`v?

<D1>D~qw#1>~qw8]w~qw,Tcv?

T\ruLl&1d,"7#}]j{T#

2G3

+2xXSZ(common gateway interface,CGI): (

eX(E>DrXxj<,b)E>(} HTTP ksS

Web ~qwr&CLr+ME",4.`;# CGI E>G

;vCng PERL .`DE>`FoT`4D CGI Lr#

+C\?(public key): Fcz2+TPyPK<IC

D;V\?#k(C\?(private key)`T#

\m~q(administration service): ;VZ( API K

P1e~,IC4T Tivoli Access Manager J4\mw&

CLr4P\mks#\m~q+l& pdadmin |n"v

D6Lks,T4PngZ\#$TswPPvX(Zc


B D T s . ` D N q # M ' I T 9 C Z (

ADK(Authorization ADK)*"b)~q#

\mr(management domain): ;v1!r,dP

Tivoli Access Manager ?F4PO$"Z(MCJXFD

2+_T#Cr4(ZdC policy server 1#m{r

(domain)#

fr(rule): ;urù_-od,b)od9B~~

qw\;6pB~.dDX5(B~`X),T0`&X

4PT/l&#

2H3

s:(suffix): j6>X#fD?<cNa9P%cu?

D;V(P{F#IZa?6?<CJ-i(LDAP)P

y9CD`T|{#=,Ks:JCZC?<cNa9P

D?vd|u?#;v?<~qwIT_P`vs:,?

;vs:<j6>X#fD?<cNa9#

2J3

y>O$(basic authentication): ;VO$=(,Z

ZhC'T32+Z_J4DCJ(.0*sC'dkP

'DC'{M\k#

yZxgDO$(network-based authentication): y

]C'DxJ-i(IP)X7XFTTsDCJD;V\

#$Ts_T(POP)#m{\#$Ts_T(protected

object policy)#

S\(encryption): ZFcz2+TP+}]*;*;

V^(bADN=D}L,9CK=(+^(q!-<}

]r_vI9Cb\}Lq!-<}]#

G+$n(role activation): TG+&CCJmI(D

}L#

G+8((role assignment): *C'8(G+D}L,

Sx9CC'_PTCG+y(eTsD`&DCJmI

(#

xLd(E(interprocess communication,IPC): (1)

Lrd%`(E",=dn/yhzDxL#Ej"EE

MZ?{"SPGxLd(ED#{=(# (2) ;VYw5

3zF,|CxL\;Z,;FczZr(}xgZ`%

.dxP(E#

2,20(silent installation): ;rXF("M{",

xGZU>D~Pf"{"MmsD;V20#Kb,2

,20IT9Cl&D~w*}]dk#m{l&D~

(response file)#

2K3

IluT(scalability): xg53T;Ov$DCJJ

4DC'}wvl&D\&#

IEy(trusted root): 2+WSVc(SSL)PO$P

D(CA)D+C\?T0X*D(P{F#

grO$~q(cross domain authent ica t ionservice,CDAS): a)2mbzFD;V WebSEAL ~

q,9z\;+1!D WebSEAL O$zFf;*r

WebSEAL 5X Tivoli Access Manager m]D(FxL#

m{ WebSEAL#

g r 3 d r \ ( c r o s s d o m a i n m a p p i n gframework,CDMF): ;V`LSZ,9*"_Z9C

WebSEAL gSgx SSO &\1\;TC'm]D3dT

0C'tTD&mxP(F#

2L3

,S(connection): (1) Z}](EP,("Z&\%

*.dCZ+ME"D;VX*# (2) Z TCP/IP P,Z

=v-i&CLr.da)I?}]w+]~qD;V7

6#ZrXxP,,SS;v53OD TCP &CLrSl

=m;v53OD TCP &CLr# (3) Z53(EP,I

TZ=v53.dr53kh8.d+]}]D;V_

7#

*a(junction): 0K WebSEAL ~qwMsK Web

&CLr~qw.dD;V HTTP r HTTPS ,S#

WebSEAL 9C*a4zmsK~qwa)#$TD~q#

nF(token): (1) VrxPD;V(^{E,|S;v

}]>,x+]=m;v>,T8>C>]1XF+di

J#?v}]><Pzaq!"9CnFTXFiJ#n

FGm>}+MmI(D;uX({"r;#=# (2) Vr

x(LAN)PX+diJS;vh8+]=m;vh8D

;rP#1nFs7S}]1,nFMI*!#

7ID~(routing file): |,XF{"dCD|nD;

V ASCII D~#

V/(polling): ;vxL,(}KxL(Z/J}]

b,T7(Gqh*+M}]#

2M3

E'x>(portal): ;V/ID Web >c,|y]X(

C'DCJmI(,/,zIICZCX(C'D Web J

4(}g4S"Z]r~q)D(FPm#

\k(cipher): ;VS\}],Z9C\?+d*;*

wk}](b\).0;IA#


\?T(key pair): Fcz2+TPD+C\?M(C

\?#1\?TCZS\1,"M=+9C+C\?TE

"xPS\,xSU=+9C(C\?TCE"xPb

\#1\?TCZ){1,){=+9C(C\?TE"

D3Vm>xPS\,xSU=+9C+C\?TCE"

DKVm>xPb\,Sxi$){#

\?7(key ring): Fcz2+TPD;VD~,|,

+C\?"(C\?"IEyM$i#

\?}]bD~(key database file): N{\?7(key

ring)#

\?D~(key file): N{\?7(key ring)#

\?(key): Fcz2+TPD;V{ErP,CZT}

]xPS\rb\D\kc(#N{(C\?(private

key)M+C\?(public key)#

#=(schema): T}](eoTm>D;iod,b)

odj{Xhv}]bDa9#ZX5}]bP,#=(

eKm"?vmPDVNMVNkm.dDX5#

?<#=(directory schema): ITZ?<PvVDP

'DtT`MMTs`#b)tT`MMTs`(eC?

<DtT5Do("XkfZDtTT0I\fZDt

T#

2P3

dC(configuration): (1) E"&m53Dm2~Di

/k%,==# (2) iI53"S53rxgDzw"h8

MLr#

>$^)~q(credentials modification service): ;

VIC4^D Tivoli Access Manager >$DZ( API K

P1e~#IM'Zb?*"D>$^)~qv^ZS>

$tTPm4PmSr}%Yw,"Rv^ZG)O*I

^DDtT#

>$(credential): ZO$}LPqCDj8E",hv

C'"NNiX*T0d|k2+T`XDm]tT#>

$ITCZ4Ps?~q,}gZ("sFM/I#

2Q3

(F(migration): 203LrDBf>rB"PfSx

f;OgDf>r"Pf#

a ? 6 Z } = O $ ( l i g h t w e i g h t t h i r d p a r t yauthentication,LTPA): ;VO$r\,JmZrXx

rPD;i Web ~qwZxP%cG<#

a?6?<CJ-i(lightweight directory accessprotocol,LDAP): {OTBu~D*E-i:(a)9

C TCP/IP a)T'V X.500 #MD?<DCJ,R(b)

;}"T|*4SD X.500 ?<CJ-iDJ4*s#9

C LDAP D&CLr(F*tC?<D&CLr)IT+

?<w*+2}]f"9C,2IT+dCZlwXZv

Kr~qDE",}ggSJ~X7"+C\?rX(Z

~qDdCN}#LDAP nuGZ RFC 1777 P8(D#

LDAP V3 GZ RFC 2251 P8(D,R IETF 9ZLx

*"=SDj<&\#3) IETF (eD LDAP j<#=

ITZ RFC 2256 PR=#

+V"a(global signon,GSO): ;VinD%cG

<bv=8,9C'\rsK Web &CLr~qwa)8

CC'{M\k#+V"a+Z(C'(}%;G<CJ

QZ(d9CDFcJ4# GSO G*3)sMs5hF

D,b)s5I&Zl9DV<=Fc73D`v53M

&CLr9I,GSO 9C';X\m`vC'{M\k#

m{%cG<(single signon)#

2R3

O$PD(certificate authority,CA): )"$iDi

/#O$PDT$iyP_m]T0Z(CyP_9CD

~qxPO$")"B$i"x)VP$i,T07zt

Z;YZ(dLx9C$iDC'D$i#

O$(authentication): (1) ZFcz2+TP,TC'

m]rC'CJTsDJqDi$# (2) ZFcz2+T

P,i${"GqP4|Drp5# (3) ZFcz2+T

P,CZi$E"53r\#$J4DC'D}L#m{

`rSO$(multi-factor authentication)"yZxgDO$

(network-based authentication)M]}=O$(step-up

authentication)#

]wTs(container object): +TsUdi/*;,

D&\xrDa9/8(#

2S3

X$xL(daemon): ;v^KU\KPDLr,CZ

4P,xDr\ZTD"536'ZDNq,gxgX

F#P)X$xL\T/%"4PdNq;xP)r\Z

TKw#

\#$Ts_T(protected object policy,POP): ;

V2+_T,+=Su~?SZ ACL _TJmDYw,T

CJ\#$DTs#J4\mw:p?F4P POP u~#

m{CJXFm(access control list,ACL) "\#$Ts

(protected object)M\#$TsUd(protected object

space)#

Jcm 63

\#$TsUd(protected object space): 5J53

J4DibTsm>,|CZ&C ACL M POP T0Z(

C'CJ#m{\#$Ts(protected object)M\#$T

s_T(protected object policy)#

\#$Ts(protected object): 5J53J4D_-

m>,|CZ&C ACL M POP T0Z(C'CJ#m{

\#$Ts_T(protected object policy)M\#$TsU

d(protected object space)#

Z(~qe~(authorization service plug-in): ;v

I/,0kDb(DLL r2mb),ITI Tivoli Access

Manager Z( API KP1M'zZu</WN0k,T4

PZZ( API P)9~qSZDYw#10ICD~qS

Z|(\m"b?Z(">$^D"Z(M PAC &mS

Z#M'IT9CZ( ADK(Authorization ADK)*"b

)~q#

Z(~q(entitlement service): ;VICZSwer

u~/Db?45XZ(DZ( API KP1e~#Z((

#GX(Z&CLrD}],|+IJ4\mw&CLr

T3VN=9C,rmSAweD>$P,TcZZ(x

LPx;=9C#M'IT9CZ( ADK(Authorization

ADK)*"b)~q#

Z(fr(authorization rule): kNDfr(rule)#

Z((authorization): (1) ZFcz2+TP,ZhC

'k3Fcz53(Er9C3Fcz53D(^# (2) Z

hC'T3vTs"J4r&\Dj+r^FCJ(D}

L#

Z((entitlement): |,_e/D2+_TE"D}]

a9#Z(|,9CX(&CLrImbD==xPq=

/D_T}]M\&#

tTPm(attribute list): |,CZxPZ(v_D)

9E"D4SPm#tTPmGI;i name = value Ti

ID#

}V){(digital signature): ZgSLqP7S=3

}]%*rG3}]%*-}\k*;xID;V}],

9C}]%*DSU=\;i$C%*D4Mj{T"6

pI\vVD1l}]#

2T3

X(tT$i~q(privilege attribute certificateservice): +$(q=D PAC *;* Tivoli Access

Manager >$(4.`;)D;VZ( API KP1M'z

e~#b)~q2ITCZ*+d=2+rDd|I1x

T Tivoli Access Manager >$xPb0r}]`k#M'

IT9CZ( ADK(Authorization ADK)*"b)~q#

m{X(tT$i(privilege attribute certificate)#

X(tT$i(privilege attribute certificate): |,

weDO$"Z(tTMwe\&D}VD5#

3;J4j6(uniform resource identifier,URI): C

ZZrXxOj6Z]DV{.,|(J4{F(?<{

MD~{)"J4;C(?<{MD~{yZDFcz)

T0gNCJJ4(-i,}g HTTP)# URI D>}G

3;J4(;w,r URL#

3;J4(;w(uniform resource locator,URL):

m>FczOrxg(}grXx)PE"J4DV{r

P#KV{rP|,:(a)CZCJCE"J4D-i

Dr4{F,T0(b)C-iCZ(;KE"J4DE

"#}g,ZrXxOBDP,TBb)GCZCJwV

E " J 4 D 3 ) - i D r 4 { F :

http"ftp"gopher"telnet M news;xTBbvrG IBM w

3D URL:http://www.ibm.com#

2W3

b?Z(~q(external authorization service): ;V

Z( API KP1e~,IC49X(Z&CLrr73D

Z(v_I* Tivoli Access Manager Z(v_4D;?

V#M'IT9CZ( ADK(Authorization ADK)*"b

)~q#

xJ-i(Internet Protocol,IP): rXx-i/PD

;V^,S-i,(}xgr%,xg7I}],"d1

O_-ickomxg.dD=i#

D~+d-i(file transfer protocol,FTP): ZrX

x-i/P,9C+dXF-i(TCP)M Telnet ~qZ

zwrwz.d+dz?}]D~D;V&CLrc-

i#

2X3

l&D~(response file): |,TLryaJbD;i

$(eXpDD~,9CKD~M^h?NdkG)5P

.;#

ibw\(virtual hosting): Web ~qwD;V\&,

9d\;TrXxmV*`vwz#

mI((permission): CJ\#$Ts(}gD~r?

<)D\&#TsmI(D}?M,eGICJXFm

(ACL)(eD#m{CJXFm(access contro l

list,ACL)#

2Y3

5qZ((business entitlement): C'>$D9dt

T,CtThvICZTJ4DZ(ksD+8u~#


rXx-i/(Internet suite of protocols): *Zr

XxO9Cx*"D;i-i,(}rXx$LNqi/

(Internet Engineering Task Force,IETF)Tj<]8

(RFC)D=="<#

C'"am(user registry): N{"am(registry)#

C'(user): 9CId|Tsya)~qDNNvK"

i/"xL"h8"Lr"-ir53#

r{(domain name): rXx-i/Pwz53D{

F#r{I;PT(gV{VtDS{iI#}g,g{

w z 5 3 D + ^ ( r { ( F Q D N ) G

as400.rchland.vnet.ibm.com,rTB?v{F<Gr{:

as400.rchland.vnet.ibm.com"vnet.ibm.com"ibm.com#

r(domain): (1) 2m+2~qR(#p+2C>wC

DC'"53MJ4D_-Vi# (2) FczxgD;?

V , Z d P } ] & m J 4 S \ + 2 X F # m { r {

(domain name)#

*}](metadata): hvyf"}]DXwD}]#

KP1(run time): 4PFczLrD1dN#KP1

73G;V4P73#

2Z3

$i(certificate): Fcz2+TPD;V}VD5,|

++C\?s(=$iyP_m],Sx9$iyP_\

;;O$#$iGIO$PD)"D#

wz(host): ,S=3vxg(}grXxr SNA x

g)"a)=CxgDCJcDFcz#Kb,wzIT

y]73a)TxgD/PXF#wzITGM'z"~

qwr,1w*M'zM~qw#

"am(registry): |,C'"53Mm~DCJ0dC

E"D}]f"#

(C\?(private key): Fcz2+TPvyP_*~

D;V\?#k+C\?(public key)`T#

(P{F(distinguished name,DN): (;j6?<

Pu?D{F#(P{FItT:5TiI,ddC:EV

t#

J4Ts(resource object): 5JxgJ4(}g~

q"D~MLr)Dm>#

T"a(self-registration): G;V}L,ZdPC'I

Tdk*sD}]"I* Tivoli Access Manager D"aC

',x^h\m1DNk#

A

ACL: N{CJXFm(access control list,ACL)#

B

BA: N{y>O$(basic authentication)#

blade: a)X(Z&CLrD~qMi~D;Vi~#

C

CA: N{O$PD(certificate authority)#

CDAS: N{grO$~q(Cross Domain Authentication

Service)#

CDMF: N{gr3dr\(Cross Domain Mapping

Framework)#

CGI: N{+2xXSZ(common gateway interface)#

cookie: ~qwf"ZM'zORZfsDa0}LPC

JDE"#cookie 9~qw\;G!XZM'zDX(E

"#

D

DN: N{(P{F(distinguished name)#

E

EAS: N{b?Z(~q(External Authorization

Service)#

G

GSO: N{+V"a(global signon)#

H

HTTP: N{,D>+d-i(Hypertext Transfer

Protocol)#

I

IP: N{xJ-i(Internet Protocol)#

IPC: N{xLd(E(Interprocess Communication)#

Jcm 65

L

LDAP: N{a?6?<CJ-i(Lightweight Directory

Access Protocol)#

LTPA: N{a?6Z}=O$(lightweight third party

authentication)#

M

management server: QOz#N{ policy server#

P

PAC: N{X(tT$i(privilege attribute certificate)#

policy server: ,$XZ2+rPd|~qwD;CE"

D Tivoli Access Manager ~qw#

POP: N{\#$Ts_T(protected object policy)#

R

RSA S\(RSA encryption): CZS\MO$D+C

\?S\53#K53GI Ron Rivest"Adi Shamir M

Leonard Adleman Z 1977 j"wD#K53D2+T!v

Z+=vsJ}DK}Vb*rSDQH#

S

SSL: N{2+WSVc(Secure Sockets Layer)#

SSO: N{%cG<(Single Signon)#

U

URI: N{3;J4j6(uniform resource identifier)#

URL: N{3;J4(;w(uniform resource locator)#

W

Web Portal Manager(WPM): ;VyZ Web D<N

&CLr,CZZ2+rP\m Tivoli Access Manager

Base M WebSEAL 2+T_T# pdadmin |nPgfD

fzgf,K GUI 'V6L\m1CJ,"9\m1\;

4(/IDC'r,"8(/I\m1xb)r#

WebSEAL: ;V Tivoli Access Manager blade Lr#

WebSEAL G;V_T\"`_LD Web ~qw,|+2

+T_T&C=\#$TsUd#WebSEAL \;a)%c

G<bv=8,"+sK Web &CLr~qwJ4iO=

2+T_TP#

WPM: N{ Web Portal Manager#


w}

[A]20 14

Z AIX O 14

Z HP-UX O 14

Z Solaris O 15

Z Windows O 16

[C]_T

G< 32

}%8>E"

AIX 38

HP-UX 38

Solaris 37

Windows 37

}% Tivoli Access Manager for WebLogic

gN 37

4(

WebSEAL ac

9C pdadmin 24

EL*s 9

[D]%cG< 10

9C]>&CLrbT 32

G<_T 32

[G]JOoO

Zf;cJb 35

O$ 34

[J]y>O$

QdCC' 5

F.TZ( 30

ac

dC 24

V^

\m J2EE J4 35

iPDi 35

java.security.ACL SZ 35

[N]Zf*s 9

[R]O$

;9C WebSEAL 6

9C WebSEAL 5

b?C' 5

Access Manager 5

[S]ywTZ( 30

5CLr

AMWLSConfigure -action config 50

AMWLSConfigure -action create_realm 53

AMWLSConfigure -action delete realm 55

AMWLSConfigure -action unconfig 52

9C<I 32

Z(

F.T 30

ywT 30

\'V=( 9

[W]Jb7( 34

[X]Hvu~

m~ 10

`Xvfo viii

[Y]]>&CLr 30

QdCC' 5, 32

oT|

G"o 19

AAccess Manager

2+T#M 1

Java runtime environment 11, 17

pdjrtecfg 17


Access Manager (x)

policy server 10

WebSEAL 10

AIX

20 14

}% 38

AMWLSConfigure -action config 50

AMWLSConfigure -action create_realm 53

AMWLSConfigure -action delete realm 55

AMWLSConfigure -action unconfig 52

CCLASSPATH

*0PoT|D startWebLogic hC 19

* startWebLogic hC 18

HHP-UX

20 14

}% 38

Iinstallp 14

JJava

AIX ODKP1 11

Ppdadmin

4( WebSEAL ac 24

pdjrtecfg

|nP 17

pkgadd 15

pkgrm 37

policy server 10

SSMIT 38

Solaris

20 15

}% 37

startWebLogic

|n;C 19

startWebLogic,hC CLASSPATH 18

swinstall 14

swremove 38

WWebLogic Server

~q| 9

f]T== 9

Security Service Provider Interface 9

V7.0 'V 9

WebSEAL 1, 10

%cG< 10, 24

O$ 5

QdCC' 5

WebSEAL ac

dC 24

Windows

20 16

}% 37


��

Pz!"

S152-0811-00

Documents

IBM Tivoli Access Manager for e-businesspublib.boulder.ibm.com/tividd/td/ITAME/SC32-1366... · IBM WebSphere Application Server, Advanced Single Server Edition 5.0 |,ZT&Z Z{DYw53D