Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

Chapter 2. Planning 49

The integration is transparent to the J2EE applications because no coding or

deployment changes are needed at the application level.

2.4.6 Access Manager for BEA WebLogic Server

Tivoli Access Manager for WebLogic Version 6.0 provides a full security

framework for BEA WebLogic Server using the Security Service Provider

Interface (SSPI).

BEA WebLogic Server provides SSPI for third-party security providers, such as

Tivoli Access Manager for WebLogic, to seamlessly integrate their security

functions into the BEA WebLogic Server architecture.

Access Manager Security Service Provider Interface components

Tivoli Access Manager for WebLogic replaces the default security realm created

with each BEA WebLogic Server secure domain and provides the following BEA

WebLogic Server Security Providers:

򐂰 Authentication Provider

򐂰 Authorization Provider

򐂰 Role Mapping Provider

Tivoli Access Manager for WebLogic uses the default BEA WebLogic Server

Credential Mapping security provider and the default keystore.

Each of the providers listed also contains a Management Bean (MBean) that

enables configuration editing through the WebLogic console. The following

sections detail the functionality supplied by each of these providers and MBeans.

Tivoli Access Manager provides the following integration points with BEA

WebLogic Server:

򐂰 Authentication Provider

The Tivoli Access Manager for WebLogic Authentication Provider implements

BEA WebLogic Server simple authentication. In simple authentication, a user

attempts to authenticate to a BEA WebLogic Server with a user name and

password combination. This user name and password are checked by Tivoli

Access Manager using the Tivoli Access Manager Java runtime component.

Tivoli Access Manager for WebLogic also provides its own Login Module that

is used to provide WebSEAL or Tivoli Access Manager Plug-in for Web

Servers single sign-on functionality.

򐂰 Authorization Provider

Authorization Providers supply an interface between BEA WebLogic Server

and the external authorization service. The Authorization Provider determines