TAM-包含的内容---全面的指南--自IBM

http://www-03.ibm.com/certify/tests/obj039.shtml 

 

Section 1:Planning

1. Given access to the customer, gather customer requirements so that a high level solution design document is produced.
   With emphasis on performing the following tasks:
   
   1. Identify the Web resources to be protected.
   2. Classify applications that need to be integrated with WebSEAL. (integration requirements & by what method)
      1. Classify Web applications to be protected. (JEE vs those that use query_contents)
   3. Identify log on requirements.
      1. Identify current applications - authentication and authorization mechanism currently employed.
      2. Classify the log on method for single sign-on. (basic authentication vs. forms single sign-on vs. LTPA vs. TAI++)
      3. Classify the credential to be provided. (same as when logging on the WebSEAL vs. dummy password vs. global sign-on)
   4. Identify architecture of existing client network. (type of access)
   5. Classify User type - internal users (Intranet users)or external users. (Internet)
   6. Identify policy role and authorization requirements.
   7. Identify Platform or technology used for the application to be protected by Tivoli Access Manager/WebSEAL.
   8. Identify HA and Load balancing requirement.
   9. Understand future business needs and plan for the scalability.
   10. Determine the expectation of Tivoli Access Manager - Coarse grained vs fine grained authorization.
   11. Identify Audit and Reporting requirements.
   12. Obtain a blue print of the network security and system security polices of the client.
   13. Produce a high-level solution design document.
2. Given access to the current network configuration of the customer, determine the security set up which can be deployed so that a Deployment document can be produced.
   With emphasis on performing the following tasks:
   
   1. Determine the User Registry to be used.
      1. Identify the deployment of current LDAP stores or any other authentication mechanisms being used.
      2. Identify the customization (schema, attributes) needs.
      3. Determine the supported user registry which will be deployed.-Determine the EAI integration requirements.
      4. Determine the location and number of user registries to be used.
      5. Determine the User Registry replication requirements. (one server vs. multiple servers, peer to peer vs. single master)
      6. Determine the security requirements for the User Registry. (SSL vs Non-SSL)
      7. Determine the Directory Information Tree (DIT) structure - Standard vs Minimal Model.
   2. Determine the Web Security set up.
      1. Determine the Web Security mechanism to be used - WebSEAL vs Web Plug-in or a combination of both.
      2. Identify if multiple instances of WebSEAL will be required on the same server.
      3. Determine Security requirements for connection to backend servers.
      4. Identify if there is need to use stateful junctions.
      5. Identify need for step-up authentication.
      6. Determine federation requirements, if any.
      7. Determine Single Sign-on (SSO) requirements.
      8. Determine the Certificate to be used for Web Security. ( Self Signed vs Trusted CA implementation for WebSEAL client certificates)
      9. Determine the need for SSL Hardware Acceleration.
      10. Determine the need for Session Management Server.
   3. Determine the placement of Tivoli Access Manager components.
      1. Identify if Policy Proxy Server is required.
      2. Determine the need for Authorization Server.
      3. Identify the administration interface which will be used to administer the solution. (WPM vs pdadmin)
3. Given the high-level solution design document and access to the customer, determine hardware and operating system requirements so that the requirements are documented.
   With emphasis on performing the following tasks:
   
   1. Identify the memory, disk space, and CPU requirements.
   2. Confirm supported platforms and software levels.
   3. Confirm supported Java levels for the installation.
   4. Document the requirements.
4. Given access to the customer, identify the type of reporting functionality required so that the customer can achieve a common format of reports.
   With emphasis on performing the following tasks:
   
   1. Identify Security reporting.
   2. Identify Business Critical reporting.
   3. Identify User access or provisioning reporting.
   4. Identify Logging and auditing data reporting.
   5. Identify Content management reporting.
5. Given high level solution design document, determine infrastructure configuration for solution deployment so that a high level configuration document is produced.
   With emphasis on performing the following tasks:
   
   1. Determine Network zone requirements.
      1. Identify geography of LANs.
      2. Identify firewalls.
      3. Identify Internet, Intranet and DMZ.
   2. Determine logical configuration and integrate with other applications.
      1. Determine number, replication type and location of user registries.
      2. Identify number and type of IBM Tivoli Access Manager for e-Business servers.
      3. Identify the requirements for an SMS server.
      4. Identify number of load balancers.
      5. Identify replicated Web servers.
      6. Identify secure domains and ACLs.
      7. Identify password policies in Tivoli Access Manager (also in LDAP if required).
      8. Determine WebSEAL cluster is required.
   3. Determine physical configuration.
      1. Identify location of IBM Tivoli Access Manager for e-business servers.
      2. Identify location of load balancers.
      3. Identify location of Web servers and relationship to firewalls.
      4. Identify location of SMS server.
      5. Identify the WebSEAL to WebSEAL junction replication.
      6. Identify the install location and ports to use for the environment.

Section 2:Installation

1. Given the high-level solution design document, the IBM Tivoli Access Manager for e-business V6.1.1 (Tivoli Access Manager) release notes, and access to the servers where Tivoli Access Manager will be installed, verify the software and hardware prerequisites so that the servers are ready for Tivoli Access Manager installation.
   With emphasis on performing the following tasks:
   
   1. Identify the required operating system in the high-level solution design document.
   2. Identify the current OS and hardware configuration of the server.
      1. Identify the hardware configuration on Windows.
      2. Identify the hardware configuration on Linux.
      3. Identify the hardware configuration on AIX.
      4. Identify the OS level and patches on Windows.
      5. Identify the OS level and patches on Linux.
      6. Identify the OS level and patches on AIX.
   3. Upgrade the operating system if required.
      1. Upgrade the operating system on Windows.
      2. Upgrade the operating system on Linux.
      3. Upgrade the operating system on AIX.
2. Given all the required software packages, and a supported platform, install Tivoli Access Manager components so that Tivoli Access Manager is successfully installed.
   With emphasis on performing the following tasks:
   
   1. Install IBM Global Security Kit (GSKit).
   2. Install IBM Tivoli Directory Server client base.
   3. Install Tivoli Security Utilities.
   4. Install Access Manager License.
   5. Install Tivoli Access Manager Runtime.
   6. Install Tivoli Access Manager Policy server.
   7. Install Tivoli Access Manager Authorization server.
   8. Install Tivoli Access Manager Web Security Runtime.
   9. Install Tivoli Access Manager WebSEAL.
   10. Install plug-in for Web servers.
   11. Install Web Portal Manager.
   12. Install Session management server.
   13. Install CARS.

Section 3:Configuration

1. Given access to customer's computer with installed software, registry server information is available, and low level design document, configure IBM Tivoli Access Manager for e-business V6.1.1 (Tivoli Access Manager) components so that a working set up of Tivoli Access Manager is available.
   With emphasis on performing the following tasks:
   
   1. Set up a Runtime system.
   2. Set up the policy server.
   3. Set up the authorization server.
   4. Set up a Web Portal Manager system.
   5. Set up policy proxy servers if required.
2. Given a primary instance of each component and secondary hardware systems, configure Tivoli Access Manager HA environment so that HA Tivoli Access Manager components are configured.
   With emphasis on performing the following tasks:
   
   1. Configure LDAP replicas.
   2. Configure HACMP/replicated Policy Servers.
   3. Set up and configure replicated WebSEAL.
   4. Configure multiple failover authorization servers for Java applications.
   5. Configure Java applications in locale mode for policy cache.
3. Given access to installed WebSEAL, network connectivity with appropriate firewall policy for backend systems, configure WebSEAL so that backend Web servers are protected by WebSEAL.
   With emphasis on performing the following tasks:
   
   1. Configure Web Security Runtime.
   2. Configure additional WebSEAL instances on the same computer.
   3. Configure LDAP failover.
   4. Configure http or https.
   5. Configure thread limits (global and per junction).
   6. Configure time out for various components.
   7. Configure authentication mechanism.
   8. Configure junctions.
   9. Configure Dynurl.
   10. Configure JMT.
   11. Configure MIME cache settings.
   12. Configure HTTP compression setting for MIME types.
   13. Configure WebSEAL virtual host junction configuration.
   14. Configure OCSP or CRL.
   15. Configure http header authentication.
   16. Configure IP authentication.
   17. Configure Setup authentication.
   18. Configure eCSSO or CDSSO.
   19. Configure P3P compact policy.
   20. Configure Dynamic ADI Entitlement Services.
   21. Set up the Access Manager Attribute Retrieval Service.
4. Given a running Tivoli Access Manager base environment and supported J2EE application servers are running, set up Web security so that Web security is configured for backend servers.
   With emphasis on performing the following tasks:
   
   1. Set up the plug-in for Edge Server.
   2. Set up the plug-in for Web servers.
   3. Set up session management system installation.
   4. Set up a Web security development system.
   5. Propagate J2EE configuration from a backend server to Tivoli Access Manager.
   6. Import roles from WAS apps to Tivoli Access Manager if needed.
   7. Configure Tivoli Access Manager to provide JACC services to WAS.
   8. Set up an Access Manger Runtime for Java system.
5. Given the security policy of the customer organization, create and configure policies in the Tivoli Access Manager policy database so that the policy database in Tivoli Access Manager is configured.
   With emphasis on performing the following tasks:
   
   1. Create Tivoli Access Manager groups.
   2. Create and configure Access Control lists (ACL).
   3. Create and Configure protected object policies (POP).
   4. Create and configure Authorization Rules.
   5. Configure account and password management policies.
   6. Update object space.
6. Given a high-level Design document, system installation, and customer access, configure the Tivoli Access Manager registry so a user can be created, modified, and policy can be set in the secure domain.
   With emphasis on performing the following tasks:
   
   1. Update schema.
   2. Configure SSL or SASL.
   3. Create suffix.
   4. Update ACLs for Tivoli Access Manager access.
   5. Import users and groups.
   6. Configure domains and user registry type.
   7. Configure Tivoli Directory Server password policy.
   8. Configure Tivoli Directory Server replication.
7. Given an installed Tivoli Access Manager system and the Tivoli common directory log properties file, configure log rotation and log archive so that log rotation and archiving is configured for Tivoli Access Manager components.
   With emphasis on performing the following tasks:
   
   1. Identify the Tivoli common directory folders.
   2. Edit the Log property file appropriately.
   3. Specify the logging format.
   4. Specify the maximum size of log files.
   5. Specify the fully qualified log file name and path.
   6. Specify the maximum number of files.
8. Given a running WebSEAL and backend EAI application, configure Tivoli Access Manager for EAI server so that WebSEAL is configured for EAI.
   With emphasis on performing the following tasks:
   
   1. Configure unauth junction to EAI server.
   2. Configure trigger URL in WebSEAL config.
   3. Configure EAI with http or https.
   4. Review demo EAI application.
   5. Configure response headers as required by WebSEAL.
   6. Determine multi-step authentication requirement.
9. Given the high-level solution design document, access to the Tivoli Access Manager server, and access to the backend servers, create junctions so that WebSEAL will be configured to allow access to the backend servers.
   With emphasis on performing the following tasks:
   
   1. Create junctions using pdadmin or the Web Portal Manager
      1. Standard (TCP or SSL)
      2. Stateful
      3. Transparent path
      4. Virtual Host
      5. Kerberos
   2. Create SSL junctions.
      1. Locate the junction file.
      2. Obtain the certificate from the backend server.
      3. Import the certificate to the junction file.
      4. Create the junction using pdadmin or Web Portal Manager to create SSL junctions.
   3. Create junctions that use basic authentication to log on to the back end server.
      1. Create junctions that log on with the user name and password provided to WebSEAL using pdadmin or the Web Portal Manager.
      2. Create junctions that log on with the user name and a dummy password using pdadmin or the Web Portal Manager.
      3. Create junctions can use a GSO resource to log on to a back end servers using pdadmin or the Web Portal Manager.
      4. Create junctions that log on to the back end server using a log on form.
      5. Customize an FSSO file.-Identify the log on form.-Fill out the FSSO file for the log on form.
      6. Create a junction that uses FSSO using pdadmin or the Web Portal Manage.
   4. Create junctions that connect to multiple backend servers.
      1. Add a host to an existing junction using pdadmin or the Web Portal Manager.
      2. Remove a host from an existing junction using pdadmin or the Web Portal Manager.
10. Given access to Customer Network Architecture and Tivoli Access Manager component placement, propose firewall policies so that Tivoli Access Manager components can communicate successfully.
    With emphasis on performing the following tasks:
    
    1. Open the appropriate port for non-SSL to LDAP communication from WebSEAL in DMZ.
    2. Open the appropriate port for SSL to LDAP communication from WebSEAL in DMZ.
    3. Open the appropriate port for SSL communication to Policy server from WebSEAL in DMZ.
    4. Open the appropriate port for SSL communication to WebSEAL instances from Policy server.
    5. Open appropriate HTTP/HTTPS Ports for WebSEAL to Backend server communication.
    6. Open appropriate HTTP/HTTPS Ports for Client to WebSEAL communication.
11. Given Multiple replicated WebSEAL instances configured with failover cookie and load balancer configured in load distribution mode, Configure Load Balancing for Tivoli Access Manager WebSEAL so that WebSEAL allows high availability of the backend servers and minimizes disruption.
    With emphasis on performing the following tasks:
    
    1. Configure WebSEAL for load balancing:
       1. Sticky ( or stateful/ server affinity)
       2. Non-sticky /stateless server affinity)
    2. Confirm if extended attribute to be stored in failover cookie.
    3. Configure non-sticky failover.
    4. Configures sticky failover.
12. Given a working set up of Tivoli Access Manager and WebSEAL, perform certificate management at WebSEAL to ensure secure communication between WebSEAL and Clients, Backend and User Registry.
    With emphasis on performing the following tasks:
    
    1. Import certificates from backend servers for SSL junctions.
    2. Import certificate from User registry for secure LDAP communication.
    3. Import CA certificates to set up secure communication between Browser and WebSEAL.

Section 4:Administration

1. Given access to a IBM Tivoli Access Manager for e-business V6.1.1 (Tivoli Access Manager) environment, perform backup and restore activity so that service disruption is minimized.
   With emphasis on performing the following tasks:
   
   1. Configure pdbackup utility.
   2. Back up WebSEAL policies, policies, configuration files, key databases.
   3. Restore Policy Server, WebSEAL from backup.
2. Given the list of Tivoli Access Manager data export or backup with the same level of setup, export data from one environment and import in another so that user successfully exports Tivoli Access Manager data for other Tivoli Access Manager environments. 
   With emphasis on performing the following tasks:
   
   1. Define the list file appropriately for Tivoli Access Manager components to be backup or export or use default file for migration process.
   2. Identify the fully qualified location for archive files.
   3. Use the PDBACKUP utility with appropriate parameters option for exporting or backup the Tivoli Access Manager components.
   4. Verify the exporting ITivoli Access Manager Data and transfer to QA/Production environment.
   5. Use the PDBACKUP utility with appropriate parameters option to restore the data in QA/Production.
   6. Verify appropriately, the data successfully restored.
3. Given organization audit requirements, set up and configure auditing so that log files are produced for events and authorizations.
   With emphasis on performing the following tasks:
   
   1. Structure and enable the Tivoli Access Manager audit processes.
   2. Manage the size of audit files.
   3. Capture audit and statistical data with information gathering tool.
   4. Analyze and interpret log and audit reports.
4. Given the organization's security requirements, a working Tivoli Access Manager system, and the Secure Domain Admin password, configure delegated administration to create accounts so that they are able to perform the subset of administrative activities as required by the organization
   With emphasis on performing the following tasks:
   
   1. Identify whether to use enterprise domains or subdomains.
   2. Create enterprise domains.
   3. Create subdomains.
   4. Identify the correct permission level for an administrator in a subdomain.
   5. Create subdomain administrators.
5. Given all the required compatible software packages and fix pack levels, upgrade Tivoli Access Manager so that Tivoli Access Manager is successfully upgraded.
   With emphasis on performing the following tasks:
   
   1. Upgrade IBM Tivoli Directory Server.
   2. Upgrade the Runtime.
   3. Upgrade the Policy server.
   4. Upgrade the Authorization server.
   5. Upgrade the WebSEAL.
   6. Upgrade the Runtime for Java.
   7. Upgrade the Policy Proxy server.
   8. Upgrade the Session management server.
   9. Upgrade the Session management command line.
   10. Upgrade the Session management Web interface.
   11. Upgrade a plug-in for Web servers.
   12. Upgrade Web Portal Manager.
6. Given third-party CA certificates and intermediate CA certificates configure WebSEAL with third-party Certificate for client authentication so that WebSEAL is configured to accept third-party client certificates.
   With emphasis on performing the following tasks:
   
   1. Configuring Java and then iKeyman.
   2. Change key database password.
   3. Request and receive CA root certificate.
   4. Update CA and intermediate CA certificate in WebSEAL KDB.
7. Given access Tivoli Access Manager base components are running, server with WebSEAL installed and a valid WebSEAL backup is available, restore the WebSEAL Server so that maximum availability in the WebSEAL environment is ensured.
   With emphasis on performing the following tasks:
   
   1. Set up new or existing server and OS for restoration.
   2. Use pdbackup to restore WebSEAL data from an archive file.
   3. Extract the archived WebSEAL Data.
8. Given access to the high level configuration document, configure response pages so that a WebSEAL response is configured.
   With emphasis on performing the following tasks:
   
   1. Configure static HTML server response pages.
   2. Configure server response page locations.
      1. Configure account management page location.
      2. Configure error message page location.
   3. Configure server response page modification.
      1. Define macro resources for customizing HTML response page.
      2. Adding macros in a template.
      3. Handling response pages from old releases of WebSEAL.
   4. Configure account management page.
      1. Configure stanza entries and values.
      2. Configuring the account expiration error message.
   5. Configure error massage page.
      1. Configure time of day error page.
      2. Create new HTML error message pages.
      3. Handling error pages from old releases of WebSEAL.
   6. Configure multi-locale support for server responses.
   7. Configure the location URL format in redirect responses.
   8. Configure local response redirection.
      1. Specifying the URI for local response redirection.
      2. Specifying the operation for local response redirection.
      3. Specifying macro support for local response redirection.
9. Given a running WebSEAL and a WebSphere Application Server instance, install, configure and administer reporting to generate the reports required by the enterprise.
   With emphasis on performing the following tasks:
   
   1. Install CAS on WAS.
   2. Install TCR.
   3. Configure TCR to read from the correct database.
   4. Download the Tivoli Access Manager reports from IBM's site.
   5. Import the Tivoli Access Manager reports into TCR.
   6. Configure WebSEAL to send events to CAR.
   7. Stage audit information in the database.
   8. Select the appropriate report.
   9. Generate reports.
   10. Archive and delete old information.
   11. Prune the staging tables.
   12. Troubleshooting reporting.
       1. Verify that CAS is running.
       2. Verify that entries are written to the XML data store in the database.
       3. Verify that entries are staged.
10. Given that Tivoli Access Manager components are running and customer encounters problem, perform Tivoli Access Manager tracing and log collection so that Tivoli Access Manager tracing and debugging information is available for problem troubleshooting
    With emphasis on performing the following tasks:
    
    1. Configure message logging through config files.
    2. Configure Tivoli common directory logging.
    3. Gather MustGather for each required Tivoli Access Manager component.
    4. Edit the routing file for per process tracing and restart Tivoli Access Manager components.
    5. Enable pdweb tracing through pdadmin.
    6. Enable core collection for crash analysis.
    7. Collect debug information using Tivoli Access Manager trace facilities.
    8. Consult knowledge base.
    9. Trace HTTP connections in WebSEAL debug and snoop trace for troubleshooting.
    10. Install and Deploy ISA.
    11. Disable tracing using routing file or/and pdadmin.
11. Given a working set up of Tivoli Access Manager, analyze the current settings of the directory server on the UNIX operating system environment so that a report of the current settings and suggested parameters which can be tuned is available.
    With emphasis on performing the following tasks:
    
    1. Analyze the operating system parameters of each server where Tivoli Access Manager component is deployed.
       1. Analyze the operating system parameters like process limit, memory allocation, and environmental variables.
       2. Analyze unlimited.
    2. Analyze the User Registry parameters.
       1. Analyze User Registry parameters like cache, connection time out.
       2. Analyze the DB2 buffer pool if using Tivoli Directory Server.
12. Given access to the customer, identify the OS environment and other limitation for installation so that user determines the mode of installation.
    With emphasis on performing the following tasks:
    
    1. Identify the OS environment and any other limitations for installation.
    2. Review the modes of installation:
       1. Graphical mode
       2. Text-based (non-graphical) console mode
       3. file (silent) mode
    3. Select the appropriate mode.

Section 5:Performance Tuning and Problem Determination

1. Given access to an installed and configured IBM Tivoli Access Manager for e-business V6.1.1 (Tivoli Access Manager) system, Tivoli Access Manager Performance tuning Guide and Result of Load testing, perform tuning of Tivoli Access Manager so that the Tivoli Access Manager environment is optimized.
   With emphasis on performing the following tasks:
   
   1. Analyze the current settings of the directory server and the operating system components.
   2. Performance tuning of Operating system.
   3. Performance tuning of User registry.
   4. Performance tuning of IRA cache on Tivoli Access Manager servers.
   5. Performance tuning for each Tivoli Access Manager components.
   6. Configuring environment variables and variables in the Tivoli Access Manager startup scripts.
   7. Tune the Directory Server caches and DB2 buffer pools.
   8. Configure Java heap settings.
   9. Configure WebSEAL worker threads.
   10. Configure WebSEAL time-outs and MIME cache settings.
2. Given a configured Tivoli Access Manager system, configure and analyze log reports so that statistical information on Tivoli Access Manager components is available.
   With emphasis on performing the following tasks:
   
   1. Identify components to collect stats upon.
   2. Enable statistics on the required component.
      1. Enable using static method.
      2. Enable using dynamic method.
   3. Disable statistics.
   4. Gather statistical information for Tivoli Access Manager components.
3. Given a working WebSEAL and backend server, measure the load on the Web Server to produce load measurements.
   With emphasis on performing the following tasks:
   
   1. Enable statistics collection.
   2. Get the total values.
   3. Get the values for a specific junction.
   4. Interpret the values.
4. Given running Tivoli Access Manager components and alternate routing file input, enable environment variables for tracing without restarting Tivoli Access Manager so that trace output redirected to alternative output file without restarting Tivoli Access Manager.
   With emphasis on performing the following tasks:
   
   1. Identify the location of routing file.
   2. Identify the routing file for each component appropriately.
   3. Set the $PD_SVC_ROUTING_FILE Environment variable for alternative routing file.