IBM Tivoli Access Manager. WebSEAL 4.1 SA

Transcription

1 IBM Tivoli Access Manager WebSEAL 4.1 SA

2

3 IBM Tivoli Access Manager WebSEAL 4.1 SA

4 !, 55 5 ( ) GA Copyright International Business Machines Corporation 1999, All rights reserved.

5 v v v vi vi vi WebSEAL vii vii vii viii ix xi xi xi xii xii xii WebSEAL WebSEAL ADK WebSEAL WebSEAL WebSEAL ADK WebSEAL UNIX WebSEAL AIX WebSEAL HP-UX WebSEAL zseries Linux WebSEAL Solaris WebSEAL UNIX WebSEAL Copyright IBM Corp. 1999, 2003 iii

6 UNIX WebSEAL ADK AIX WebSEAL ADK HP-UX WebSEAL ADK zseries Linux WebSEAL ADK Solaris WebSEAL ADK Windows WebSEAL WebSEAL ADK Windows WebSEAL WebSEAL AIX WebSEAL HP-UX WebSEAL Solaris WebSEAL Windows WebSEAL WebSEAL AIX WebSEAL HP-UX WebSEAL zseries Linux WebSEAL Solaris WebSEAL Windows WebSEAL WebSEAL UNIX WebSEAL Windows WebSEAL AIX WebSEAL HP-UX WebSEAL zseries Linux WebSEAL Solaris WebSEAL Windows WebSEAL WebSEAL WebSEAL ADK WebSEAL ADK iv IBM Tivoli Access Manager: WebSEAL

7 IBM Tivoli Access Manager WebSEAL. WebSEAL policy. WebSEAL, policy. : IBM Tivoli Access Manager Tivoli SecureWay Policy Director. Tivoli SecureWay Policy Director policy. IBM Tivoli Access Manager WebSEAL Tivoli Access Manager WebSEAL,.. v v v IT v. v HTTP, TCP/IP, FTP telnet v v SSL(Secure Sockets Layer), SSL, ( ),, CA(Certificate Authority).. v 1 1 IBM Tivoli Access Manager Base. v 7 2 Copyright IBM Corp. 1999, 2003 v

8 WebSEAL WebSEAL ADK. v 15 3 WebSEAL. v WebSEAL WebSEAL v WebSEAL WebSEAL v 47 6 WebSEAL WebSEAL. Tivoli Access Manager. v v v vii WebSEAL v vii v vii v viii v IBM Tivoli Access Manager Read Me GA (am41_readme.pdf) Tivoli Access Manager. v IBM Tivoli Access Manager SA (am41_relnotes.pdf),. v IBM Tivoli Access Manager SA (am41_install.pdf) Web Portal Manager Tivoli Access Manager,. vi IBM Tivoli Access Manager: WebSEAL

9 v IBM Tivoli Access Manager SA (am41_admin.pdf) Tivoli Access Manager. pdadmin Web Portal Manager. WebSEAL v IBM Tivoli Access Manager WebSEAL SA (amweb41_install.pdf) WebSEAL WebSEAL,. v IBM Tivoli Access Manager WebSEAL SA (amweb41_admin.pdf) WebSEAL,. v IBM Tivoli Access Manager for WebSphere Application Server SA (amwas41_user.pdf) Tivoli Access Manager for IBM WebSphere Application Server,. v IBM Tivoli Access Manager for WebLogic Server SA (amwls41_user.pdf) Tivoli Access Manager for BEA WebLogic Server,. v IBM Tivoli Access Manager Plug-in for Edge Server SA (amedge41_user.pdf) IBM WebSphere Edge Server,. v IBM Tivoli Access Manager Plug-in for Web Servers User s Guide SC (amws41_user.pdf),. v IBM Tivoli Access Manager Authorization C API Developer s Reference SC (am41_authC_devref.pdf) vii

10 Tivoli Access Manager C API Access Manager Tivoli Access Manager. v IBM Tivoli Access Manager Authorization Java Classes Developer s Reference SC (am41_authJ_devref.pdf) API Java Tivoli Access Manager. v IBM Tivoli Access Manager Administration C API Developer s Reference SC (am41_adminC_devref.pdf) API Tivoli Access Manager. API C. v IBM Tivoli Access Manager Administration Java Classes Developer s Reference SC (am41_adminJ_devref.pdf) API Java Tivoli Access Manager. v IBM Tivoli Access Manager WebSEAL Developer s Reference SC (amweb41_devref.pdf) CDAS(Cross-domain Authentication Service), CDMF(Cross-domain Mapping Framework) Password Strength Module. v IBM Tivoli Access Manager Command Reference GC (am41_cmdref.pdf) Tivoli Access Manager. v IBM Tivoli Access Manager Error Message Reference SC (am41_error_ref.pdf) Tivoli Access Manager. v IBM Tivoli Access Manager Problem Determination Guide GC (am41_pdg.pdf) Tivoli Access Manager. v IBM Tivoli Access Manager Performance Tuning Guide SC (am41_perftune.pdf) IBM Directory Tivoli Access Manager. viii IBM Tivoli Access Manager: WebSEAL

11 Tivoli Access Manager. Tivoli Software Library white papers, datasheets, demonstrations, redbooks announcement letters Tivoli. Tivoli Software Library. Tivoli Software Glossary Tivoli. Tivoli Software Glossary. Tivoli Software Library( Glossary. IBM Global Security Kit Tivoli Access Manager IBM Global Security Kit(GSKit). GSKit IBM Tivoli Access Manager Base CD. GSKit, - ikeyman (gsk5ikm). Tivoli Information Center IBM Tivoli Access Manager. v Secure Sockets Layer Introduction and ikeyman User s Guide (gskikm5c.pdf) Tivoli Access Manager SSL. IBM DB2 Universal Database IBM DB2 Universal Database IBM Directory Server, z/os OS/390 LDAP. DB2 CD. v IBM AIX v Microsoft Windows v Sun Solaris Operating Environment DB2. ix

12 IBM Directory Server IBM Directory Server, 4.1 zseries Linux IBM Tivoli Access Manager Base CD. S/390 Linux IBM Directory Server. IBM Directory Server,. IBM WebSphere Application Server IBM WebSphere Application Server, Advanced Single Server Edition Web Portal Manager CD Web Portal Manager. IBM WebSphere Application Server. IBM Tivoli Access Manager for Business Integration IBM Tivoli Access Manager for Business Integration, IBM MQSeries 5.2 IBM WebSphere MQ 5.3. IBM Tivoli Access Manager for Business Integration WebSphere MQSeries. WebSEAL IBM Tivoli Access Manager for Operating Systems, IBM Tivoli Access Manager for Business Integration IBM Tivoli Access Manager for e-business. IBM Tivoli Access Manager for Business Integration 4.1 Tivoli Information Center. v IBM Tivoli Access Manager for Business Integration (SA ) v IBM Tivoli Access Manager for Business Integration (GA ) v IBM Tivoli Access Manager for Business Integration Read Me(GA ) IBM Tivoli Access Manager for Operating Systems IBM Tivoli Access Manager for Operating Systems, UNIX policy. WebSEAL IBM Tivoli Access Manager for Business x IBM Tivoli Access Manager: WebSEAL

13 Integration, IBM Tivoli Access Manager for Operating Systems IBM Tivoli Access Manager for e-business. IBM Tivoli Access Manager for Operating Systems 4.1 Tivoli Information Center. v IBM Tivoli Access Manager for Operating Systems (SA ) v IBM Tivoli Access Manager for Operating Systems (SA ) v IBM Tivoli Access Manager for Operating Systems (SA ) v IBM Tivoli Access Manager for Operating Systems (GA ) v IBM Tivoli Access Manager for Operating Systems Read Me(GA ) Tivoli Software Library PDF HTML. Product manuals. Tivoli Software Information Center.,,,. : PDF, Adobe Acrobat ( )...., IBM Tivoli Software Support. xi

14 , IBM Software Support Guide. IBM Software Support. v v v,..,,,, Java.,,.,,,,,,. UNIX. Windows $variable %variable%, (/) (\). Windows bash, UNIX. xii IBM Tivoli Access Manager: WebSEAL

15 1 Tivoli Access Manager WebSEAL WebSEAL ADK(Application Developer Kit).. v v 2 v 2 v 2 v 4 IBM Tivoli Access Manager. Tivoli Access Manager WebSEAL Tivoli Access Manager WebSEAL ADK. v Sun Solaris v AIX v Red Hat Linux v S/390 zseries SuSE Linux Enterprise Server 7( 2.4.7, 31, glibc , gcc ) (Maintenance Patch-CD 1 ) v IBM zseries SuSE Linux Enterprise Server 7( , 64 (31 ), glibc , gcc ) v HP-UX i v Windows NT 4.0( 6a ) v Windows 2000 Advanced Server( 2 ) Copyright IBM Corp. 1999,

16 WebSEAL. v : 10MB Tivoli Access Manager Runtime(65MB), 75MB. WebSEAL 100MB. v : 64MB( : 256MB) 64MB Tivoli Access Manager Runtime 64MB. 256MB. IBM Tivoli Access Manager Web Security CD WebSEAL. v Tivoli Access Manager WebSEAL WebSEAL. v Tivoli Access Manager WebSEAL ADK Tivoli Access Manager CDAS(Cross-domain Authentication Service), Tivoli Access Manager CDMF(Cross-domain Mapping Framework) API Tivoli Access Manager Password Strength Module. Web Security CD ( IBM Tivoli Access Manager Base CD WebSEAL ). v Tivoli Access Manager Runtime v IBM Directory Client v IBM Global Security Kit(GSKit) v Tivoli Access Manager ADK WebSEAL. v 3 WebSEAL v 4 WebSEAL ADK 2 IBM Tivoli Access Manager: WebSEAL

17 : (UNIX) (Windows). 4. WebSEAL WebSEAL. v IBM Global Security Kit(GSKit) v IBM Directory Client v Tivoli Access Manager Runtime WebSEAL WebSEAL ADK Tivoli Access Manager. WebSEAL. v Tivoli Access Manager Policy Server v LDAP ( : IBM Directory Server) WebSEAL. 1. Tivoli Access Manager policy 2. Tivoli Access Manager policy WebSEAL policy. policy Tivoli Access Manager Runtime, IBM Directory Client GSKit. WebSEAL WebSEAL. WebSEAL.. v IBM Global Security Kit(GSKit) v IBM Directory Client v Tivoli Access Manager Runtime Tivoli Access Manager Runtime WebSEAL. 1 3

18 : WebSEAL Tivoli Access Manager. IBM Tivoli Access Manager Base. WebSEAL ADK WebSEAL ADK. v IBM Global Security Kit(GSKit) v IBM Directory Client v Tivoli Access Manager Runtime v Tivoli Access Manager ADK v Tivoli Access Manager WebSEAL WebSEAL ADK WebSEAL. Tivoli Access Manager ADK LDAP Tivoli Access Manager WebSEAL Active Directory Domino zseries Linux Tivoli Access Manager. Tivoli Access Manager WebSEAL ,. 4 IBM Tivoli Access Manager: WebSEAL

19 1. ( ) Tivoli SecureWay Policy Director, 3.8 Tivoli Access Manager, 3.9 WebSEAL WebSEAL WebSEAL. 1 5

20 6 IBM Tivoli Access Manager: WebSEAL

21 2 v IBM Tivoli Access Manager. v v ( ), (UNIX) (Windows). IBM Tivoli Access Manager. WebSEAL WebSEAL. pkgadd, installp, swinstall InstallShield.. WebSEAL, WebSEAL ADK.,.. (response)... WebSEAL. policy WebSEAL Tivoli Access Manager.,,. WebSEAL.,. WebSEAL ADK WebSEAL. Copyright IBM Corp. 1999,

22 WebSEAL 2 IBM Tivoli Access Manager Web Security CD. : UNIX (.bat ) Windows. 2. ezinstall_pdweb WebSEAL. v IBM Global Security Kit v IBM Directory Client v Tivoli Access Manager Runtime ezinstall_pdwebadk v Tivoli Access Manager WebSEAL WebSEAL. v IBM Global Security Kit v IBM Directory Client v Tivoli Access Manager Runtime v Tivoli Access Manager ADK(Application Development Kit) v Tivoli Access Manager WebSEAL ezinstall_pdauthadk v Tivoli Access Manager WebSEAL ADK(Application Development Kit) Tivoli Access Manager. v IBM Global Security Kit v IBM Directory Client v Tivoli Access Manager Runtime install_pdrte v Tivoli Access Manager ADK(Application Development Kit) Tivoli Access Manager Runtime. v IBM Global Security Kit v IBM Directory Client v Tivoli Access Manager Runtime WebSEAL. v 9 WebSEAL v 9 WebSEAL ADK 8 IBM Tivoli Access Manager: WebSEAL

23 WebSEAL ezinstall_pdweb. v WebSEAL Tivoli Access Manager, Tivoli Access Manager policy WebSEAL. policy ezinstall_pdmgr. ezinstall_pdmgr policy. ezinstall_pdmgr IBM Tivoli Access Manager Base CD., IBM Tivoli Access Manager. v policy WebSEAL, Tivoli Access Manager WebSEAL. ezinstall_pdweb. WebSEAL. v Tivoli Access Manager WebSEAL, WebSEAL policy, policy. policy IBM Tivoli Access Manager runtime. WebSEAL. WebSEAL ezinstall_pdweb. WebSEAL ADK ezinstall_pdwebadk. v WbSEAL Tivoli Access Manager WebSEAL, Tivoli Access Manager policy, WebSEAL WebSEAL ADK. policy ezinstall_pdmgr. ezinstall_pdmgr policy. ezinstall_pdwebadk WebSEAL WebSEAL ADK. : Windows NT ezinstall_pdweb.bat WebSEAL ezinstall_pdwebadk.bat WebSEAL ADK. Windows 2000 UNIX WebSEAL WebSEAL ADK ezinstall_pdwebadk.bat. 2 9

24 WebSEAL ADK Tivoli Access Manager ADK. IBM Tivoli Access Manager Web Security CD ezinstall_pdauthadk. ADK, ezinstall_pdwebadk ezinstall_pdauthadk. v policy WebSEAL, Tivoli Access Manager WebSEAL WebSEAL. ezinstall_pdwebadk. ADK, ezinstall_pdauthadk WebSEAL WebSEAL ADK. : Windows NT ezinstall_pdweb WebSEAL ezinstall_pdwebadk WebSEAL ADK. Windows 2000 UNIX WebSEAL WebSEAL ADK ezinstall_pdwebadk. v Tivoli Access Manager WebSEAL WebSEAL, WebSEAL WebSEAL ADK policy, policy. policy IBM Tivoli Access Manager. WebSEAL. WebSEAL ADK IBM Tivoli Access Manager ADK. ezinstall_pdwebadk.. IBM Global Security Kit IBM Directory Client Tivoli Access Manager Runtime Tivoli Access Manager ADK Tivoli Access Manager WebSEAL WebSEAL ADK. : Windows NT ezinstall_pdweb WebSEAL ezinstall_pdwebadk WebSEAL ADK. Windows 2000 UNIX WebSEAL WebSEAL ADK ezinstall_pdwebadk. 10 IBM Tivoli Access Manager: WebSEAL

25 WebSEAL.. (response)... v 11 v 12 WebSEAL WebSEAL ADK. WebSEAL WebSEAL ADK. WebSEAL Tivoli Access Manager policy., policy. IBM Tivoli Access Manager Base CD. 3 WebSEAL WebSEAL ADK... : WebSEAL WebSEAL IBM Global Security Kit. IBM Directory Client. LDAP. Tivoli Access Manager Runtime LDAP : Ldap

26 3. ( ) LDAP : 389 Tivoli Access Manager policy LDAPGSO LDAP DN LDAP SSL LDAP SSL LDAP SSL DN LDAP SSL... No. LDAP SSL : 636 Access Manager policy SSL : 7135 policy CA Tivoli Access Manager ADK. Tivoli Access ManagerWebSEAL Security Master LDAP SSL LDAP SSL SSL SSL... UNIX: /opt/pdweb Windows: C:\Program Files\Tivoli\Policy Director.... No... : /var/ldap/keytabs/pd_ldapkey. kdb.. LDAP SSL : 636 Tivoli Access Manager WebSEAL ADK.. UNIX. /var/tmp/ezinstall_pdweb.rsp /var/tmp/ezinstall_pdwebadk.rsp Windows. %TEMP%\ezinstall.rsp 12 IBM Tivoli Access Manager: WebSEAL

27 .. WebSEAL v v SSL ( ) WebSEAL LDAP SSL.. v WebSEAL v WebSEAL WebSEAL ezinstall_pdweb. TCP HTTP TCP 80 HTTPS HTTPS 443 UNIX: /opt/pdweb/www/docs Windows: C:\Progam Files\Tivoli\PolicyDirector\PDWeb\www\docs 2 13

28 14 IBM Tivoli Access Manager: WebSEAL

29 3 Tivoli Access Manager WebSEAL. WebSEAL. : Tivoli Access Manager WebSEAL, WebSEAL WebSEAL. WebSEAL. v WebSEAL v WebSEAL ADK WebSEAL ADK WebSEAL. WebSEAL ADK, WebSEAL. WebSEAL WebSEAL ADK Tivoli Access Manager Runtime. WebSEAL ADK Tivoli Access Manager ADK. : Tivoli Access Manager Runtime Tivoli Access Manager ADK IBM Tivoli Access Manager. UNIX WebSEAL WebSEAL ADK. WebSEAL ADK UNIX WebSEAL UNIX. Windows WebSEAL WebSEAL ADK. : WebSEAL. v 16 UNIX WebSEAL v 22 UNIX WebSEAL ADK Copyright IBM Corp. 1999,

30 v 26 Windows WebSEAL WebSEAL ADK UNIX WebSEAL WebSEAL UNIX. v 16 AIX WebSEAL v 17 HP-UX WebSEAL v 18 zseries Linux WebSEAL v 19 Solaris WebSEAL WebSEAL, WebSEAL. v 20 UNIX WebSEAL AIX WebSEAL WebSEAL. installp AIX. Tivoli Access Manager pdconfig WebSEAL. : WebSEAL, WebSEAL WebSEAL. AIX WebSEAL. 1. root. 2. AIX. IBM Tivoli Access Manager. 3. Tivoli Access Manager Runtime. Tivoli Access Manager Policy Server Tivoli Access Manager,. 4.. v, 5. v Tivoli Access Manager Runtime, IBM Tivoli Access Manager. 5. AIX IBM Tivoli Access Manager Web Security CD, WebSEAL. installp -c -a -g -X -d /dev/cd0 PDWeb.Web 16 IBM Tivoli Access Manager: WebSEAL

31 -c. -a.. -c. -g. -X. -d.,. /dev/cd0 6. WebSEAL.. 7. WebSEAL 20 UNIX WebSEAL. HP-UX WebSEAL WebSEAL. swinstall HP-UX. Tivoli Access Manager pdconfig WebSEAL. : WebSEAL, WebSEAL WebSEAL. HP-UX WebSEAL. 1. root. 2. HP-UX. IBM Tivoli Access Manager. 3. HP-UX IBM Tivoli Access Manager Web Security CD. 4., pfs_mountd pfsd. pfs_mount CD.,. /usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cdrom /dev/dsk/c0t0d0 CD /cdrom. 5. Tivoli Access Manager Runtime. Tivoli Access Manager Policy Server,. 3 17

32 6.. v, 7. v Tivoli Access Manager Runtime, IBM Tivoli Access Manager. 7. WebSEAL. swinstall -s /cdrom/hp PDWeb /cdrom/hp PDWeb WebSEAL... CD.. swinstall. 8. WebSEAL 20 UNIX WebSEAL. zseries Linux WebSEAL WebSEAL. rpm zseries Linux. Access Manager pdconfig WebSEAL. : WebSEAL, WebSEAL WebSEAL. zseries Linux WebSEAL. 1. root. 2. zseries Linux. IBM Tivoli Access Manager. 3. zseries Linux Access Manager WebSEAL rpm. zseries Linux CD.. v zseries Linux WebSEAL. ftp zseries Linux. 18 IBM Tivoli Access Manager: WebSEAL

33 v zseries Linux IBM Tivoli Access Manager CD. NFS zseries Linux CD. WebSEAL CD. /zseries 4. Tivoli Access Manager Runtime. Tivoli Access Manager Policy Server Tivoli Access Manager,. 5.. v, 6. v, IBM Tivoli Access Manager. 6. WebSEAL. rpm -i PDWeb-PD s390.rpm CD. rpm. 7. WebSEAL 20 UNIX WebSEAL. Solaris WebSEAL WebSEAL. pkgadd Solaris. Tivoli Access Manager pdconfig WebSEAL. : WebSEAL, WebSEAL WebSEAL. Solaris WebSEAL. 1. root. 2. Solaris. IBM Tivoli Access Manager. 3. Solaris IBM Tivoli Access Manager Web Security CD /cdrom/cdrom

34 4. /cdrom/cdrom0/solaris. 5. Tivoli Access Manager Runtime. Tivoli Access Manager Policy Server,. 6.. v, 7. v Tivoli Access Manager Runtime, IBM Tivoli Access Manager. 7. WebSEAL. pkgadd -d. PDWeb setuid/setgid?. 8. y Enter. y Enter. CD. WebSEAL. pkgadd. 9. WebSEAL 20 UNIX WebSEAL. UNIX WebSEAL Tivoli Access Manager pdconfig WebSEAL UNIX. WebSEAL UNIX. UNIX WebSEAL. 1. root UNIX. pdconfig Access Manager for e-business. Access Manager for e-business x. [x] IBM Tivoli Access Manager: WebSEAL

35 Access Manager for e-business. Access Manager for e-business 1. Access Manager WebSEAL x. Access Manager for e-business [x]. 3. Access Manager WebSEAL. Access Manager WebSEAL for e-business. Access Manager WebSEAL for e-business x. [x] Enter. Tivoli Access Manager. 5. sec_master. :, :.,, 5 pdconfig. WebSEAL LDAP SSL. 6. y( ) n( ) Access Manager LDAP SSL. Access Manager LDAP SSL (y/n) [y]? WebSEAL LDAP SSL 7. WebSEAL LDAP SSL WebSEAL LDAP SSL y( ). ( Enter ). LDAP SSL : SSL ( ): LDAP SSL : LDAP SSL : 3 21

36 . LDAP. LDAP. LDAP Enter. LDAP SSL WebSEAL LDAP SSL n( ). Enter. 9..., TCP HTTP? 2. HTTP HTTPS? 4. HTTPS /opt/pdweb/www/docs a. x. : : (IBM HTTP Server ), TCP HTTP WebSEAL TCP HTTP., pdconfig. 10. a. Enter. WebSEAL. WebSEAL. 11. Enter. Access Manager WebSEAL for e-business. 12. Enter x. : Tivoli Access Manager WebSEAL WebSEAL. WebSEAL IBM Tivoli Access Manager WebSEAL. UNIX WebSEAL ADK UNIX WebSEAL ADK. WebSEAL ADK Tivoli Access Manager ADK. 22 IBM Tivoli Access Manager: WebSEAL

37 : WebSEAL ADK WebSEAL. WebSEAL, 16 UNIX WebSEAL. WebSEAL ADK. v 23 AIX WebSEAL ADK v 24 HP-UX WebSEAL ADK v 24 zseries Linux WebSEAL ADK v 25 Solaris WebSEAL ADK AIX WebSEAL ADK AIX WebSEAL ADK. 1. WebSEAL. WebSEAL, 16 AIX WebSEAL. 2. root AIX IBM Tivoli Access Manager Web Security CD CD. 3. WebSEAL ADK Tivoli Access Manager ADK. Tivoli Access Manager ADK. ADK,. installp -c -a -g -X -d /dev/cd0 PD.AuthADK ADK.. -c. -a.. -c. -g. -X. -d.,. /dev/cd0 4. WebSEAL ADK. installp -c -a -g -X -d. PDWeb.ADK WebSEAL ADK

38 WebSEAL ADK. WebSEAL ADK. HP-UX WebSEAL ADK HP-UX WebSEAL ADK. 1. WebSEAL. WebSEAL, 17 HP-UX WebSEAL. 2. root. 3. HP-UX IBM Tivoli Access Manager Web Security CD. 4., pfs_mountd pfsd. pfs_mount CD.,. /usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cdrom /dev/dsk/c0t0d0 CD /cdrom. 5. WebSEAL ADK Tivoli Access Manager ADK. Tivoli Access Manager ADK. ADK. swinstall -s /cdrom/hp PDAuthADK y Enter. CD. Tivoli Access Manager ADK. swinstall. 6. WebSEAL ADK. swinstall -s /cdrom/hp PDWebADK y Enter. CD. WebSEAL ADK. swinstall. WebSEAL ADK. WebSEAL ADK. zseries Linux WebSEAL ADK WebSEAL ADK. 1. WebSEAL. WebSEAL, 18 zseries Linux WebSEAL. 24 IBM Tivoli Access Manager: WebSEAL

39 2.. v root. v zseries Linux IBM Tivoli Access Manager Web Security CD rpm. CD zseries Linux. 16 UNIX WebSEAL. CD /zseries. 3. WebSEAL ADK Tivoli Access Manager ADK. Tivoli Access Manager ADK. ADK. rpm -i PDAuthADK*.rpm CD. rpm. 4. WebSEAL ADK. rpm -i PDWebADK-PD s390.rpm CD. rpm. WebSEAL ADK. WebSEAL ADK. Solaris WebSEAL ADK Solaris WebSEAL ADK. 1. WebSEAL. WebSEAL, 19 Solaris WebSEAL. 2.. v root. v Solaris IBM Tivoli Access Manager Web Security CD /cdrom/cdrom0. v /cdrom/cdrom0/solaris. 3. WebSEAL ADK Tivoli Access Manager ADK. Tivoli Access Manager ADK. ADK. pkgadd -d. PDAuthADK 3 25

40 y Enter. CD. Tivoli Access Manager ADK. pkgadd. 4. WebSEAL ADK. pkgadd -d. PDWebADK y Enter. CD. WebSEAL ADK. pkgadd. WebSEAL ADK. WebSEAL ADK. Windows WebSEAL WebSEAL ADK WebSEAL. InstallShield WebSEAL. pdconfig WebSEAL. : WebSEAL, WebSEAL WebSEAL. Windows WebSEAL. 1. Windows Windows. 2. Windows. IBM Tivoli Access Manager. 3. Windows IBM Tivoli Access Manager Web Security CD. 4.. Policy Server,. 5.. v, v, IBM Tivoli Access Manager. 26 IBM Tivoli Access Manager: WebSEAL

41 WebSEAL ADK, Tivoli Access Manager ADK. IBM Tivoli Access Manager. 6. WebSEAL InstallShield ( E: CD ). E:\Windows\PolicyDirector\Disk Images\Disk1\WebSEAL\Disk Images\Disk 1\setup.exe. 7.. InstallShield v PDWeb WebSEAL.. v PDWebADK WebSEAL ADK.. PDAuthADK PDWebADK. PDAuthADK PDWebADK InstallShield. 14. WebSEAL 27 Windows WebSEAL. Windows WebSEAL WebSEAL. WebSEAL ADK. 1. Windows Windows. 3 27

42 2. Access Manager for e-business. Access Manager for e-business. 3. Access Manager WebSEAL. Access Manager WebSEAL for e-business. 4. WebSEAL. Access Manager. 5. sec_master. :, :.,, LDAP SSL. WebSEAL LDAP SSL 7. WebSEAL LDAP SSL WebSEAL LDAP SSL. a. LDAP SSL. v SSL v v v b.. c. HTTP WebSEAL LDAP SSL.. HTTP TCP HTTP. TCP HTTP,., 80., pdconfig. 10. HTTPS. HTTPS,., 443., pdconfig.. 28 IBM Tivoli Access Manager: WebSEAL

43 Tivoli Access Manager WebSEAL.. Access Manager WebSEAL for e-business Access Manager for e-business Windows WebSEAL. : Tivoli Access Manager WebSEAL WebSEAL. WebSEAL IBM Tivoli Access Manager WebSEAL. 3 29

44 30 IBM Tivoli Access Manager: WebSEAL

45 WebSEAL Tivoli Access Manager Tivoli Access Manager WebSEAL. WebSEAL : WebSEAL Tivoli IBM Tivoli Access Manager. WebSEAL Tivoli Access Manager 4.1. v IBM Global Security Kit(GSKit) v IBM Directory Client v Tivoli Access Manager Runtime 4.1 IBM Tivoli Access Manager. AIX WebSEAL AIX WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. policy IBM Tivoli Access Manager. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL.. /usr/bin/pdweb stop 4. AIX IBM Tivoli Access Manager Web Security CD. Copyright IBM Corp. 1999,

46 5.. mount_point/usr/sys/inst.images 6. Tivoli Access Manager migrate.conf. CD. mount_point/usr/sys/inst.images/migrate/migrate.conf a. migrate.conf. /tmp/migrate.conf b. migrate.conf sec_master. pdadmin-login = sec_master pdadmin-pwd = sec_master_password migrate.conf. 7. inst.images. cd mount_point/usr/sys/inst.images 8. WebSEAL. installp -c -a -X -F -d. PDWeb.Web CD.. installp. WebSEAL. 9. WebSEAL ADK. WebSEAL ADK Tivoli Access Manager ADK. ADK Web Security CD. Tivoli Access Manager ADK 4.1,. installp. installp -c -a -X -F -d. PDAuthADK installp -c -a -X -F -d. PDWebADK CD.. installp. IBM Tivoli Access Manager ADK WebSEAL ADK. AIX WebSEAL. pdconfig WebSEAL. WebSEAL 3.8. webseald.conf IBM Tivoli Access Manager: WebSEAL

47 HP-UX WebSEAL HP-UX WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. b. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL stash. cp /var/pdweb/www/certs/pdsrv.kdb /temporary_directory cp /var/pdweb/www/certs/pdsrv.sth /temporary_directory 4.. cd /opt/pdweb/.configure touch upgrade38 5. WebSEAL.. /usr/bin/pdweb stop 6. HP-UX IBM Tivoli Access Manager Web Security CD. /usr/sbin/pfs_mount mount_device mount_point,. /usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cdrom 7. Tivoli Access Manager migrate.conf. CD. mount_point/hp/migrate/migrate.conf a. migrate.conf. /tmp/migrate.conf b. migrate.conf sec_master. pdadmin-login = sec_master pdadmin-pwd = sec_master_password migrate.conf WebSEAL 33

48 8. hp. cd mount_point/hp 9. swinstall WebSEAL. swinstall -s mount_point/hp PDWeb. CD.. swinstall. 10. WebSEAL ADK.,. WebSEAL ADK Tivoli Access Manager ADK. ADK Web Security CD. a. swinstall Tivoli Access Manager ADK. swinstall -s /mount_point/hp PDAuthADK... swinstall. Tivoli Access Manager ADK. b. swinstall WebSEAL ADK. swinstall -s /mount_point/hp PDWebADK... swinstall. WebSEAL ADK. 11. WebSEAL 3.8 WebSEAL. cp /temporary_directory/pdsrv.kdb /opt/pdweb/www/certs/pdsrv.kdb cp /temporary_directory/pdsrv.sth /opt/pdweb/www/certs/pdsrv.sth 12. WebSEAL. cd /opt/pdweb/sbin PDWeb_upgrade :, swlist Policy Director WebSEAL WebSEAL IBM Tivoli Access Manager: WebSEAL

49 Tivoli Access Manager ADK WebSEAL ADK. HP-UX WebSEAL. pdconfig WebSEAL. WebSEAL 3.8. webseald.conf 4.1. Solaris WebSEAL Solaris WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. b. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL.. /usr/bin/pdweb stop 4. Solaris IBM Tivoli Access Manager Web Security CD. /cdrom/cdrom0 5.. /cdrom/cdrom0/solaris 6. Tivoli Access Manager migrate.conf. CD. mount_point/solaris/migrate/migrate.conf a. migrate.conf. /tmp/migrate.conf b. migrate.conf sec_master. pdadmin-login = sec_master pdadmin-pwd = sec_master_password WebSEAL 35

50 migrate.conf. 7. solaris. cd mount_point/solaris 8. WebSEAL. pkgadd -a /mount_point/solaris/pddefault -d. PDWeb CD.. WebSEAL. pkgadd. WebSEAL. 9. WebSEAL ADK. WebSEAL ADK Tivoli Access Manager ADK. ADK Web Security CD. Tivoli Access Manager ADK 4.1,. pkgadd. pkgadd -a mount_point/solaris/pddefault -d. PDAuthADK pkgadd -a mount_point/solaris/pddefault -d. PDWebADK CD. WebSEAL ADK. pkgadd. IBM Tivoli Access Manager ADK WebSEAL ADK. Solaris WebSEAL pdconfig WebSEAL. WebSEAL 3.8. webseald.conf 4.1. Windows WebSEAL Windows WebSEAL. 1. Windows Windows. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server IBM Tivoli Access Manager: WebSEAL

51 b. Tivoli Access Manager policy. pdadmin.,. MSDOS> pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL. WebSEAL. 4. Windows IBM Tivoli Access Manager Web Security CD. 5. Tivoli Access Manager migrate.conf Web Security CD. CD. E:\Windows\migrate\migrate.conf a. migrate.conf. %TEMP%\migrate.conf %TEMP%, migrate.conf %TMP%. b. migrate.conf sec_master. pdadmin-login = sec_master pdadmin-pwd = sec_master_password migrate.conf. 6. WebSEAL ( E: CD ). MSDOS> E:\Windows\PolicyDirector\Disk Images\Disk1\WebSEAL\Disk Images\Disk1\setup.exe. 7.. InstallShield. 8.. WebSEAL. Windows WebSEAL. pdconfig WebSEAL. WebSEAL 3.8. webseald.conf WebSEAL 37

52 38 IBM Tivoli Access Manager: WebSEAL

53 WebSEAL Tivoli Access Manager Tivoli Access Manager WebSEAL. WebSEAL : Access Manager WebSEAL Tivoli IBM Tivoli Access Manager. WebSEAL Tivoli Access Manager 4.1. v IBM Global Security Kit(GSKit) v IBM Directory Client v Tivoli Access Manager Runtime 4.1 IBM Tivoli Access Manager. AIX WebSEAL AIX WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. b. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list policy IBM Tivoli Access Manager., WebSEAL.. 3. WebSEAL.. Copyright IBM Corp. 1999,

54 /usr/bin/pdweb stop 4. AIX IBM Tivoli Access Manager Web Security CD. 5. inst.images. cd mount_point/usr/sys/inst.images 6. WebSEAL. installp -c -a -X -F -d. PDWeb.Web CD.. installp. WebSEAL. 7. WebSEAL ADK. WebSEAL ADK Tivoli Access Manager ADK. ADK Web Security CD. Tivoli Access Manager ADK 4.1,. installp. installp -c -a -X -F -d. PDAuthADK installp -c -a -X -F -d. PDWebADK CD.. installp. Tivoli Access Manager ADK WebSEAL ADK. AIX WebSEAL. pdconfig WebSEAL. WebSEAL 3.9. webseald.conf 4.1. HP-UX WebSEAL HP-UX WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server IBM Tivoli Access Manager: WebSEAL

55 b. Tivoli Access Manager policy. pdadmin.,. # pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL stash. cp /var/pdweb/www/certs/pdsrv.kdb /temporary_directory cp /var/pdweb/www/certs/pdsrv.sth /temporary_directory 4.. cd /opt/pdweb/.configure touch upgrade39 5. WebSEAL.. /usr/bin/pdweb stop 6. HP-UX IBM Tivoli Access Manager Web Security CD. /usr/sbin/pfs_mount mount_device mount_point,. /usr/sbin/pfs_mount /dev/dsk/c0t0d0 /cdrom 7. hp. cd mount_point/hp 8. swinstall WebSEAL. swinstall -s mount_point/hp PDWeb. CD.. swinstall. 9. WebSEAL ADK(Application Developer Kit).,. WebSEAL ADK Tivoli Access Manager ADK. ADK WebSEAL CD. a. swinstall Tivoli Access Manager ADK. swinstall -s /mount_point/hp PDAuthADK... swinstall WebSEAL 41

56 Tivoli Access Manager ADK. b. swinstall WebSEAL ADK. swinstall -s /mount_point/hp PDWebADK... swinstall. WebSEAL ADK. 10. WebSEAL 3.9 WebSEAL. cp /temporary_directory/pdsrv.kdb /opt/pdweb/www/certs/pdsrv.kdb cp /temporary_directory/pdsrv.sth /opt/pdweb/www/certs/pdsrv.sth 11. WebSEAL. cd /opt/pdweb/sbin PDWeb_upgrade :, swlist Policy Director WebSEAL WebSEAL Tivoli Access Manager ADK WebSEAL ADK. HP-UX WebSEAL. pdconfig WebSEAL. WebSEAL 3.9. webseald.conf 4.1. zseries Linux WebSEAL zseries Linux WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server IBM Tivoli Access Manager: WebSEAL

57 b. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL stash. cp /var/pdweb/www/certs/pdsrv.kdb /tmp cp /var/pdweb/www/certs/pdsrv.sth /tmp 4.. cd /opt/pdweb/.configure touch upgrade39 5. WebSEAL.. /usr/bin/pdweb stop 6. zseries Linux Access Manager WebSEAL rpm. zseries Linux CD.. v zseries Linux WebSEAL. ftp zseries Linux. v zseries Linux IBM Tivoli Access Manager CD. NFS zseries Linux CD. WebSEAL CD. /zseries 7. rpm WebSEAL. rpm -U PDWeb-PD s390.rpm CD. rpm. 8. WebSEAL ADK(Application Developer Kit).,. WebSEAL ADK Tivoli Access Manager ADK. ADK WebSEAL CD. a. rpm Tivoli Access Manager ADK. rpm -U PDAuthADK-PD s390.rpm. rpm. Tivoli Access Manager ADK WebSEAL 43

58 b. rpm WebSEAL ADK. rpm -U PDWebADK-PD s390.rpm. rpm. WebSEAL ADK. 9. WebSEAL 3.9 WebSEAL. cp /temporary_directory/pdsrv.kdb /opt/pdweb/www/certs/pdsrv.kdb cp /temporary_directory/pdsrv.sth /opt/pdweb/www/certs/pdsrv.sth 10. WebSEAL. cd /opt/pdweb/sbin./pdweb_upgrade. 11. WebSEAL../pd_start status Access Manager Servers webseald Solaris WebSEAL Solaris WebSEAL. 1. root. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. b. Tivoli Access Manager policy. pdadmin.,. pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL.. /usr/bin/pdweb stop 4. Solaris IBM Tivoli Access Manager Web Security CD. /cdrom/cdrom0 5. solaris. 44 IBM Tivoli Access Manager: WebSEAL

59 cd mount_point/solaris 6. WebSEAL. pkgadd -a /mount_point/solaris/pddefault -d. PDWeb CD.. WebSEAL. pkgadd. WebSEAL. 7. WebSEAL ADK. WebSEAL ADK Tivoli Access Manager ADK. ADK Web Security CD. Tivoli Access Manager ADK 4.1,. pkgadd. pkgadd -a mount_point/solaris/pddefault -d. PDAuthADK pkgadd -a mount_point/solaris/pddefault -d. PDWebADK CD. WebSEAL ADK. pkgadd. Tivoli Access Manager ADK WebSEAL ADK. Solaris WebSEAL pdconfig WebSEAL. WebSEAL 3.9. webseald.conf 4.1. Windows WebSEAL Windows WebSEAL. 1. Windows. 2. Tivoli Access Manager WebSEAL. a. Tivoli Access Manager Policy Server 4.1. b. Tivoli Access Manager policy. pdadmin., WebSEAL 45

60 MSDOS> pdadmin login -a sec_master -p password pdadmin> acl list, WebSEAL.. 3. WebSEAL. WebSEAL. 4. Windows IBM Tivoli Access Manager Web Security CD CD. 5. WebSEAL ( E: CD ). MSDOS> E:\Windows\PolicyDirector\Disk Images\Disk1\WebSEAL\Disk Images\Disk1\setup.exe. 6.. InstallShield. 7.. WebSEAL. Windows WebSEAL. pdconfig WebSEAL. WebSEAL 3.9. webseald.conf IBM Tivoli Access Manager: WebSEAL

61 6 WebSEAL WebSEAL WebSEAL ADK. : WebSEAL WebSEAL junction.. WebSEAL Tivoli Access Manager Runtime.. IBM Tivoli Access Manager. WebSEAL. pdconfig WebSEAL. WebSEAL. WebSEAL. v UNIX WebSEAL v 48 Windows WebSEAL WebSEAL. v 49 AIX WebSEAL v 50 HP-UX WebSEAL v 50 zseries Linux WebSEAL v 51 Solaris WebSEAL v 52 Windows WebSEAL UNIX WebSEAL pdconfig WebSEAL. 1. root. 2. pdconfig. pdconfig Access Manager for e-business. Access Manager for e-business Copyright IBM Corp. 1999,

62 3. x. [x] Access Manager for e-business. 4. Access Manager WebSEAL. Access Manager WebSEAL for e-business Access Manager WebSEAL for e-business. 6. WebSEAL 1. : WebSEAL WebSEAL.. Tivoli Access Manager. 7. sec_master... WebSEAL. 8. Enter.. Access Manager WebSEAL for e-business. 9. x pdconfig. 10. UNIX WebSEAL. Windows WebSEAL pdconfig WebSEAL. Windows WebSEAL WebSEAL ADK. 1. Windows. 2. Access Manager for e-business. Access Manager for e-business. 3. Access Manager WebSEAL. Access Manager WebSEAL for e-business. 48 IBM Tivoli Access Manager: WebSEAL

63 4. WebSEAL. Access Manager. 5. sec_master.. WebSEAL. Access Manager WebSEAL for e-business. 6. WebSEAL. WebSEAL. 7.. Access Manager for e-business Windows WebSEAL. AIX WebSEAL installp AIX WebSEAL. : WebSEAL ADK WebSEAL ADK. 1. root. 2.. v WebSEAL ADK. installp -u PDWeb.ADK v WebSEAL. installp -u PDWeb.Web -u. : PDWeb PDWebADK. 3. WebSEAL.. WebSEAL. Tivoli Access Manager Runtime IBM Tivoli Access Manager. 6 WebSEAL 49

64 HP-UX WebSEAL swremove HP-UX WebSEAL. : WebSEAL ADK WebSEAL ADK. 1. root. 2.. v WebSEAL ADK. swremove PDWebADK v WebSEAL. swremove PDWeb : WebSEAL ADK WebSEAL. WebSEAL ADK WebSEAL. WebSEAL ADK... swremove WebSEAL. swremove. HP-UX WebSEAL. Tivoli Access Manager Runtime IBM Tivoli Access Manager. zseries Linux WebSEAL rpm zseries Linux WebSEAL. : WebSEAL ADK WebSEAL ADK. 1. root. 2.. v WebSEAL ADK. rpm -e PDWebADK-PD : WebSEAL ADK WebSEAL. v WebSEAL. rpm -e PDWeb-PD IBM Tivoli Access Manager: WebSEAL

65 v WebSEAL ADK WebSEAL ( ). rpm -e PDWebADK-PD PDWeb-PD rpm.. Tivoli Access Manager Runtime IBM Tivoli Access Manager. Solaris WebSEAL pkgrm Solaris WebSEAL. : WebSEAL ADK WebSEAL ADK. 1. root. 2.. v WebSEAL ADK. pkgrm PDWebADK v WebSEAL. pkgrm PDWeb : PDWeb PDWebADK. v WebSEAL WebSEAL ADK. pkgrm PDWeb PDWebADK. 3. y.?. 4. y.. postremove. pkgrm.. Tivoli Access Manager Runtime IBM Tivoli Access Manager. 6 WebSEAL 51

66 Windows WebSEAL Windows WebSEAL WebSEAL WebSEAL ADK. WebSEAL ADK. WebSEAL WebSEAL ADK.. v 52 WebSEAL WebSEAL ADK v 52 WebSEAL ADK WebSEAL WebSEAL ADK Windows /. Windows WebSEAL WebSEAL ADK. 1. /. 2. Access Manager WebSEAL. 3. / WebSEAL. WebSEAL ADK WebSEAL. Tivoli Access Manager Runtime IBM Tivoli Access Manager. WebSEAL ADK WebSEAL WebSEAL ADK. : WebSEAL ADK WebSEAL ADK. Windows WebSEAL ADK. 52 IBM Tivoli Access Manager: WebSEAL

67 1. /. 2. Tivoli Access Manager WebSEAL. 3. / PDWebADK. : InstallShield. 7.. WebSEAL ADK. 8.. Windows WebSEAL ADK. 6 WebSEAL 53

68 54 IBM Tivoli Access Manager: WebSEAL

69 .. IBM,. IBM. IBM, IBM,. IBM,,. IBM,. IBM ,.. : (DBCS) IBM. IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan. IBM, (, ).,..,. IBM ( ) ( ). Copyright IBM Corp. 1999,

70 IBM,. IBM. IBM. (1) ( ) (2) ,.. (, ). IBM IBM, IBM (IPLA)....,.. IBM,. IBM IBM,,. IBM. IBM..,,.. 56 IBM Tivoli Access Manager: WebSEAL

71 :. (API),,,.. IBM,. IBM (API),,,.. ( ) ( ). IBM Corp.. Copyright IBM Corp. _ _. All rights reserved.. IBM Corporation. AIX DB2 IBM IBM Tivoli Tivoli Microsoft, Windows, Windows NT Windows Microsoft Corporation. Java Java Sun Microsystems, Inc.. UNIX Open Group.,.. 57

72 58 IBM Tivoli Access Manager: WebSEAL

73 ix Copyright IBM Corp. 1999,

74 60 IBM Tivoli Access Manager: WebSEAL

75

76 Printed in Denmark by IBM Danmark A/S SA