#### Subjects

A subject defines the user or collection of users (for instance, a group or those who possess a specific role) that the policy affects. The general rule for subjects is that the policy would apply only if the user is a member of at least one subject in the policy. The default subjects are:

OpenSSO Identity Subject

  This subject implies that the identities you create and manage under the Realms Subject tab can be added as a member of the subject.

Authenticated Users

  This subject type implies that any user with a valid SSOToken is a member of this subject.

  All authenticated users would be member of this Subject, even if they have authenticated to a realm that is different from the organization in which the policy is defined. This is useful if the resource owner would like to give access to resources that is managed for users from other organizations. If you want to restrict access to resources being protected to members of a specific organization, please use the Organization subject.

Web Services Clients

  his subject type implies that a web service client (WSC) identified by the SSOToken is a member of this subject, if the DN of any principal contained in the SSOToken matches any selected value of this subject. Valid values are the DNs of trusted certificates in the local JKS keystore, which correspond to the certificates of trusted WSCs. This subject has dependency on the Liberty Web Services Framework and should be used only by Liberty Service Providers to authorize WSCs.

  Make sure that you have created the keystore before you add this Subject to a policy. Information on setting up the keystore can be found in the following location:

  ``OpenSSO-base`` `/SUNWam/samples/saml/xmlsig/keytool.html`

The following additional subjects are available by selecting them in the Policy Configuration service of the realm:

OpenSSO Roles

  This subject type implies that any member of an OpenSSO role is a member of this subject. An OpenSSO role is created using OpenSSO running in legacy mode.

LDAP Groups

  This subject type implies that any member of an LDAP group is member of this subject.

LDAP Roles

  This subject type implies that any member of an LDAP role is a member of this subject. An LDAP Role is any role definition that uses the Directory Server role capability. These roles have object classes mandated by Directory Server role definition. The LDAP Role Search filter can be modified in the Policy Configuration service to narrow the scope and improve performance.

LDAP Users

  This subject type implies that any LDAP user is a member of this subject.

Organization

  This subject type implies that any member of a realm is a member of this subject