Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

Chapter 4. Configuration and customization 111

Action groups

Tivoli Access Manager provides 18 predefined permissions for immediate use.

These permissions are stored in the predefined action group named

primary.

Each permission is associated with an action bit. These predefined permissions

are described in “Using ACL policies with the authorization service” on page 101

As additional resource managers are installed, additional action groups might be

created. A domain administrator can create additional action groups and add

new actions to previously created action groups as needed.

Resource manager software typically contains one or more operations that are

performed on protected resources. Tivoli Access Manager requires these

applications to make calls into the authorization service before the requested

operation is allowed to progress. This call is made through the authorization

application programming interface (authorization API) for both Tivoli Access

Manager services and other applications.

The authorization service uses the information contained in the ACL to provide a

simple yes or no response to the question: Does this user (group) have the r

permission (for example) to view the requested resource?

The authorization service has no knowledge about the operation requiring the r

permission. It is merely noting the presence, or not, of the r permission in the

ACL entry of the requesting user or group. The authorization service is

completely independent of the operations being requested. This is why it is easy

to extend the benefits of the authorization service to other applications.

4.1.5 Default security policy

When initially installed, Tivoli Access Manager establishes a predefined default

set of ACL policies to protect all objects in a domain. Those policies are placed

on different parts of the default protected object space tree shown in Figure 4-2

on page 95. A typical object space begins with a single explicit security policy

attached to the root container object. The root ACL must always exist and can

never be removed. Normally, this is an ACL with very little restriction. All objects

located in the object space inherit this ACL. Table 4-3 shows default ACL policies

and their positions in the object space.

Table 4-3 Default ACLs

ACL policy Permissions Position in object space

default-root group iv-admin TcmdbvaBR

any-other T

unauthenticated T

/ (root)

112 Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

This table shows that the /Management region of the protected object space

contains multiple container objects that each require a specific set of

permissions. If you want to modify default permissions you need to be aware of

the impact of ACL options on the /Management region in the object space. For

example, if you want users who are members of the PolicyAudit group to have

permission to find where the ACL “salary” is placed in the object tree, they need

permission to execute the following command:

pdadmin > acl find salary

This command can only be executed if the PolicyAudit group has the v

permission on the /Management/ACL object space. If this group needs to be

allowed to create and modify ACLs, then the additional permission m needs to

be assigned to this group.

Table 4-3 shows that there is no default ACL policy, but the inherited

default-management policy describes that, by default, members of the iv-admin

group have permission to manipulate ACLs.

default-management group iv-admin TcmdbsvaBtNWAR

group ivmgrd-servers Ts

any-other Tv

/Management

default-replica group iv-admin TcbvaBR

group ivmgrd-servers m

group secmgrd-servers mdv

group ivacld-servers md

/Management/Replica

default-config Group iv-admin TcmdbsvaBR

Any-other Tv

Unauthenticated Tv

/Management/Config

default-gso group iv-admin TcmdbvaBNR

any-other Tv

unauthenticated Tv

/Management/GSO

default-policy group iv-admin TcmdbvaBNR

any-other Tv

unauthenticated Tv

/Management/Policy

default-domain group iv-admin TcmdbvaBNR

group ivmgrd-servers v

/Management/Domain

default-management-proxy group iv-admin Tcbv

group ivmgrd-servers Tg

/Management/Proxy

ACL policy Permissions Position in object space