Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

Chapter 2. Planning 41

2.3 Management components

Access Manager for e-business provides three management tools that can be

used for the administration of your Access Manager system. Those tools are:

򐂰 The

pdadmin utility, which provides a command line interface (CLI) for

performing administrative functions such as adding users or groups. It is a

C-based application that is installed as part of the Access Manager run time

environment (PDRTE) client component.

򐂰 The

Web Portal Manager (WPM), which provides a browser-based capability

for performing most of the same functions provided by the pdadmin utility.

򐂰 The previous two utilities are built using the Tivoli Access Manager

administration API, which enables the CLI and WPM interfaces for

program-initiated administrative functions and queries. The administration API

may also be used by custom applications to perform various Access Manager

administrative functions.

2.3.1 Web Portal Manager

The Access Manager Web Portal Manager provides a browser-based graphical

user interface (GUI) for Access Manager administration.

A key advantage of the Web Portal Manager over the pdadmin command line

utility is the fact that it is a browser-based application that can be accessed

without installing any Access Manager-specific client components on the

administrator’s local machine or requiring special network configuration to permit

remote administrator access. In fact, the authorization capabilities of WebSEAL

can be used to control access to the Web Portal Manager. This means greater

flexibility for administrators’ locations with respect to the physical systems they

are managing.

Administrative functionality

The Web Portal Manager was designed to be an alternative to the pdadmin

command line interface (CLI) for many administrative functions. However, not all

pdadmin functions are supported (such as the retrieval of server statistics) and

the command line interface will still be required in certain cases. In other cases,

such as exporting Access Manager authorization data, Web Portal Manager is

required. Web Portal Manager also offers some key functional benefits over

pdadmin, such as cloning and cut/paste functionality.

Migration of data using WPM

Web Portal Manager allows for the migration of data from one Access Manager

environment to another. Data is exported from the master authorization database

42 Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

and placed into an XML file with optional encryption. It can then be transported to

a new Access Manager environment and imported.

This functionality allows for the export of one or more of the following items:

򐂰 Access Control Lists (ACLs)

򐂰 Protected Object Policies (POPs)

򐂰 Authorization Rules (Rules)

򐂰 Objects and object spaces including attached ACLs, POPs, and Rules

The export of data ensures a smooth transition from one Access Manager

environment to another, such as migrating from a test or staging environment to

production.

Delegated administration

The Web Portal Manager also provides a delegated user administration

capability. This enables an Access Manager administrator to create delegated

user groups and assign delegate administrators to these groups.

The initial aim of the Web Portal Manager delegate function is to enable multiple

independent enterprises to manage their own user population in a single Access

Manager secure domain. This functionality could be used when a service

provider that uses Access Manager to provide access control to Web resources

wants to allow its customers to define and manage their own user population.

Depending on their assigned roles, the delegated administrators can perform a

subset of the administration functions. There are four different levels of

administration in Access Manager, with the basic fields of action shown in

Table 2- 1 .

Table 2-1 Delegated administration roles in Access Manager

Action/role Domain

admin

Senior

admin

Admin Support Any other

View user X X X X X

Reset password X X X X

Add existing Access Manager user

as an administrator

XXX

Create domain user X X

Remove user X X

Domain control X