IBM Security Access Manager for Web, Version 7.0

Administering the Security Access Manager Base

base_administration The IBM Security Access Manager for Web Administration Guide provides a comprehensive set of procedures and for managing Security Access Manager servers and resources. This guide also provides you with valuable background and conceptual information about the wide range of Security Access Manager functionality.

Administration Guide PDF
Security Access Manager overview
Security Access Manager is an authentication and authorization solution for corporate web, client/server, and existing applications. Use Security Access Manager to control user access to protected information and resources. By providing a centralized, flexible, and scalable access control solution, Security Access Manager builds secure and easy-to-manage network-based applications and infrastructure.
Web Portal Manager
Security Access Manager has both command-line and graphical interface interfaces for managing domains, users, groups, permissions, policies, and other resources in your enterprise.
Security Access Manager administration
Administering Security Access Manager includes tasks such as installing and configuring resource managers, defining users and groups, and implementing security policies.
Default security policy
Security Access Manager establishes a default security policy to protect all objects in a domain. A set of administrative users and groups is established and granted a predefined set of permissions. This chapter describes the default security policy.
Manage domains
An administrator in the management domain can create additional domains. You must specify a unique name and an administrator when you create the domain. Domain administrators can do administrative tasks only within their own domains and do not have the authority to do tasks in other domains.
Manage object spaces
Security Access Manager represents resources to be protected with a virtual representation of the object space that is called the protected object space.
Manage protected objects
An object is a logical representation of a system resource. To protect objects, you must apply security policies. Security policies are the combination of access control list (ACL) policies, protected object policies (POPs), and authorization rules that you can attach to an object.
Manage access control
A domain administrator can use access control list (ACL) policies to control access to objects.
Protected object policy management
The access control list (ACL) policies provide the authorization service with information to make a yes or no answer on a request to access a protected object and do some operation on that object. A protected object policy (POP) contains additional conditions on the request. The conditions are passed back to the resource manager along with the yes ACL policy decision from the authorization service.
Authorization rules management
These topics provide information about Security Access Manager authorization rules. Authorization rules are conditions contained in an authorization policy that are used to make access decisions based on attributes such as user, application, and environment context.
Manage users and groups
An initial domain administrator is created when a new domain is created.
Certificate and password management
To securely transfer information between servers and clients, you can configure Security Access Manager to use various server-side and client-side certificates, key files, and stash files for authentication. During the initial configuration, you can configure the settings for the default lifetime of the certificates and the key file passwords.
Server management
This chapter provides detailed information about general administration and configuration tasks on the Security Access Manager servers.
High availability of the policy server
This chapter provides information about ensuring that Security Access Manager provides high availability for the policy server in case a server failure occurs.
Multiple-tenancy policy server
A multiple-tenancy server is a server that supports the hosting of multiple customers on a single server instead of on multiple client systems.
Delegated administration
Security Access Manager allows high-level administrators to delegate management responsibilities of the domain to lower-level administrators.
Diagnostics and auditing
Security Access Manager provides ways to collect events that you can use for diagnostic and auditing purposes of the servers.
Guidelines for changing configuration files
These guidelines are provided to help you change the Security Access Manager configuration files.
Configuration file reference
The way you use configuration files controls the operation of the Security Access Manager servers.
Configuration file stanza reference
Within configuration files, stanza labels occur within brackets, such as [stanza-name].
User registry differences
Each user registry presents unique concerns when integrated with Security Access Manager. This release of Security Access Manager supports the specified LDAP and URAF user registries.
pdadmin to Web Portal Manager equivalents
This appendix shows the mapping of the administration pdadmin commands to Web Portal Manager.
Managing user registries
This appendix contains a subset of user registry tasks that are specific to installing Security Access Manager.

Feedback