IBM Security Verify Access - Extended Trust Association Interceptor (ETAI)

Download Description

This adapter enables single sign-on (SSO) to WebSphere Application Server by configuring WebSphere Application Server to allow trust associations.

The traditional Trust Association Interceptor++ (TAI++) accepts an iv-creds HTTP request header from IBM Security Access Manager for Web and a trust password in a Basic Authentication header. The traditional TAI++ embedded with WebSphere authenticates the trust password and consumes the iv-creds HTTP request header to build the credential of the original user.

The Extended Trust Association Interceptor++ (ETAI) includes more capabilities:

• Removes the need for any Security Access Manager configuration on WebSphere Application Server.
• Map the credential attributes of the original user to different registry formats or add no credentials at all.
• Process Tivoli Federated Identity Manager security tokens.
• More trust mechanism based on mutual authentication over SSL and validation of incoming certificate chain.
• Works with iv-user only, in the absence of iv-creds.
• Propagate rich identity to JAX-WS, LTPA, RMI/IIOP in the form of Security Access Manager binary security token.
• Propagate Security Access Manager security attributes to the JAAS authorization that uses a login module.
• Consume SAML 2.0 security tokens without requiring iv-creds or iv-user header.
• Signature validation of SAML 2.0 assertions that uses a local keystore and remote Security Token Service (STS) such as Tivoli Federated Identity Manager.