76
Novell Access Manager 3.1 SP2 J2EE Agent Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
Update-Connection
:URL, in RFC 2255 format, of the LDAP server/store on which group
membership should be established for readout by WebSphere Portal Server.Values for this
property would typically look like ldap://localhost:1389. The port section of the URL is
optional, and only plain-text LDAP is currently supported.
Update-User:
Distinguished name of the user that logs in to the LDAP group server.
Update-Password:
Password of the user that logs in to the LDAP group server.
Debug-Level:
Debug level for the textual output generated by the TAI. It can be Off, Severe,
Warning, Info, Config, Fine, Finer, Finest, or All.
Selective Deployment
By selectively leaving out specific configuration properties from the TAI's configuration, the TAI
can be configured to refrain from certain activities.
When presentation-roles or presentation-container is left unspecified, the TAI does not
formulate a WSCREDENTIAL_GROUPS attribute for WebSphere Application Server.
When update-user or update-password is left unspecified, the TAI can connect to an LDAP
store to manipulate group membership for read-out by WebSphere Portal Server, but does not
authenticate (bind) across that connection. Instead, it performs what amounts to an anonymous
login. This approach decreases security but improves performance.
When update-connection or update-container is left unspecified, the TAI performs no updates
at all. For example, there would be no need for the TAI to update groups within an LDAP store
if it is deployed in an environment where only WebSphere Application Server (and not
WebSphere Portal Server) is used in conjunction with Access Manager..
Update Behavior
One of the TAI's key pieces of functionality is the establishment of group memberships for the
currently logged-in user (as identified by Access Manager.) within an LDAP store that is queried by
WebSphere Portal Server. Here, the LDAP store (normally an instance of Novell eDirectory) is used
as a means of indirect communication between Access Manager and the WebSphere Portal Server.
Before control is passed on to WebSphere Application Server (which in turn calls upon
WebSphere Portal Server), the TAI ensures that the group situation in the LDAP store is in line with
the role definition as provided by Access Manager., through WebSphere Application Server.
Through its configuration, the TAI has been notified of the names of roles that can be mapped
directly to LDAP groups, which give TAI access to a virtual catalog of roles and group objects. Each
separate service request (initiated by Access Manager and delivered to the TAI by WebSphere
Application Server ) lists the roles to which Access Manager. believes the identified user belongs.
From that actual list of roles, the TAI derives whether or not the user should be a member of each of
the groups it knows. It then needs to proceed with implementing the group membership, which can
include the following:
Adding the user's distinguished name to the member attribute of group objects.
Removing the user's distinguished name from the member attribute of group objects.
Adding information to or removing information from the groupMembership attribute of the
user object.
The TAI could also simply replace the previous member and groupMembership values for all
objects involved. However, that would require a great number of writes to the LDAP store,
operations that (in terms of time) are much more costly than reads. The TAI therefore performs a
Содержание Access Manager 3.1 SP 2
Страница 4: ...4 Novell Access Manager 3 1 SP2 J2EE Agent Guide novdocx en 16 April 2010...
Страница 8: ...8 Novell Access Manager 3 1 SP2 J2EE Agent Guide novdocx en 16 April 2010...
Страница 44: ...44 Novell Access Manager 3 1 SP2 J2EE Agent Guide novdocx en 16 April 2010...
Страница 83: ...Preparing the Applications and the J2EE Servers 83 novdocx en 16 April 2010...
Страница 108: ...108 Novell Access Manager 3 1 SP2 J2EE Agent Guide novdocx en 16 April 2010...