Web access management

Web access management (WAM) is a form of identity management that controls access to web resources, providing authentication management, policy-based authorizations, audit and reporting services (optional) and single sign-on convenience.

Authentication management is the process of determining a user’s (or application’s) identity. This is normally done by prompting for a user name and a password. Additional methods of authentication can also include access tokens (which generate one-time passwords) and digital certificates.

Once a user's (or process') identity is confirmed, policy-based authorization comes into play. A web resource can have one or more policies attached to it that say e.g. "only allow internal employees to access this resource" and/or "only allow members of the Admin Group to access this resource." The requested resource is used to look up the policy, and then the policy is evaluated against the user’s identity. If the user passes the policy evaluation, she/he is granted access to the resource. If the user fails the evaluation, access is denied.

After an authentication or authorization policy decision is made, the outcome can be recorded for auditing purposes, such as:

As a benefit to the end user, a web access management product can then tie this security together (which is more of a benefit to IT and administrative staff), and offer single sign on, the process by which a user logs in only once to a web resource, and then is automatically logged into all related resources. Users can be inconvenienced when attempting to get authenticated to multiple websites throughout the course of a day (potentially each with different user names and passwords). A web access management product can record the initial authentication, and provide the user with a cookie that acts as a temporary token for authentication to all other protected resources, thereby requiring the user to log in only once.

Web access management products originated in the late 1990s, and were then known as single sign on. Five of the original products were Hewlett-Packard HP IceWall SSO, CA Technologies SiteMinder, Oblix Access Manager, Magnaquest Technologies Limited IAM (Identity and Access Management) and Novell iChain. These products were simple in their functional capabilities, but solved an important issue of the time – how to share user credentials across multiple domains without forcing the user to log in more than once. The challenge stemmed from the fact that cookies are domain-specific, so there was no simple way to seamlessly transfer a user from one website to another. The new term became known as web access management, because products added the functionality of controlling which resources (web pages) a user could access, in addition to authenticating them.

...
Wikipedia