Installation Guides › Implementation Guide › Architectural Considerations › Implementation Considerations › Policy Management Models

Policy Management Models

SOA Security Manager access management models let you define access permissions for applications and their respective user populations. An access management model establishes the following:

• What resource is protected.
• Who can access the resource.
• What type of access user populations have.
• What happens when SOA Security Manager grants access to the resource.
• What happens when SOA Security Manager denies access to a resource.

Almost all SOA Security Manager functionality is available, regardless of which model you use. The primary difference between the models is the level of SOA Security Manager knowledge required to configure each. The following Administrative UI objects represent the policy management models:

• Application objects
• SOA Security Manager policy domains and policy objects

Note: The following SOA Security Manager core objects are required to configure an application or SOA Security Manager policy object:

• A host configuration object
• An agent configuration object
• An agent object
• A user directory object

  For more information about these objects, see the [set the co variable for your book].

Policy Management Using Application Objects

The recommended method for creating and managing new security policies for your SOA environment is to define application objects that represent one or more related web services and then generate the component and resource settings that define what to protect from associated WSDL files.

Note: Application objects do not support policy expressions using variable objects. Content-based authorization using variables must be implemented using policy domains and policies.

Policy Management Using Policy Domains and Policies

For Policy Server administrators already comfortable with SOA Security Manager r12.0 or TransactionMinder, policy management using policy domains and domain objects (realms, rules, responses, policies, and so on) — can still be used to perform manual configuration of security policies for web service resources.

Domains and domain objects must also be used in the following situations:

• To modify policies created traditionally and migrated from a previous SOA Security Manager deployment or to implement content-based authorization using variables.
• To implement content-based authorization using variables