Step-up authentication in Tivoli Access Manager

Very basic usage of setp-up authentication is in a scenario where there is a requirement of elevated access to particular resource protected by WebSEAL. For example there are two applications behind WebSEAL App1 and App2. Forms authentication is setup in the WebSEAL and every user in TAM registry logs in to App1 using forms authentication. But a user can access App2 only if he authenticates using token. How it happens in TAM is like this:

1. user accesses http://webseal/app1


2. webseal sends 401 response to user and ask for form based authentication


3. user provides userid and password


4. Webseal validates user


5. Webseal creates user credentials


6. Webseal check whether user is authorize to access app1


7. request is send to app1 and response from app1 is sent to user

Now at this point webseal has user credentials in cache. When user tries to access any other resource on webseal on same session webseal will not ask user to authenticate again as user credentials already exists.
In webseal it is possible to define levels of authentication. It means you can say token authentication is at higher level than forms based authentication or vice versa. Coming back to the flow

8. User tries to access http://webseal/app2


9. WebSEAL check that user is authenticated with forms based and required authentication level for app2 is token authentication. Also level defined for token authentication is higher than forms based authentication.


10. WebSEAL forces user for token authentication and upon successful authentication user is granted access.

Now assuming user had authenticated with token based authentication in first place, webseal will grant access to app1 without forcing forms based authentication, because user had already authentication mechanisam which is defined at higher level than required for app1.

Few practical requirements which I have been given by my clients are:

1. There are two URLs (VIPs) url1 and url2 pointing to same webseal. Now webseal is configured to authentication using SPNEGO for url1 only (why url2 was not configured for SPNEGO was some specific requirements). Now when user in intranet access url2 they get NTLM error page from webseal. This is expected as in the IE "Enable Integrated Windows authentication" is checked and when webseal tried to negotiate for authentication it fails to find url2 in webseals kdb file. We can not ask user to go and change browser setting every time he access url2. So solution is define authentication levels and attach the authentication level for forms authentication with the resource. As result of this when user will access url2 webseal will not negotiate with IE and simply send form for forms based authentication.


2. We configured Desktop Single Sign on for webseal. There was an application to which access was restricted to administrators. Client had a concern that if some administrator walked away from his machine and does not lock the workstation, someone can breach security and access that secured application without any authentication. So basic requirement is to enforce forms base or basic authentication when user tries to access restricted applications for rest of application it shall single sign on. Solution is same as define in first requirement, define auth levels and attach auth level to the resource.

How to setup step-up authentication in TAM:
1) Define authenitcation level in webseald-default.conf file under

authentication-levels

stanza
[authentication-levels]
level = authentication scheme
2) Create a POP and set authentication level in the POP.
Create POP:
pop create pop_name
Modify POP to define authentication level:
pop modify pop_name set ipauth anyothernw level

3) Apply POP to the required resource.
pop attach object_name pop_name