IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
WebSEAL
key
database
parameters
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 229
Using
the
iKeyman
certificate
management
utility
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 230
Configuring
CRL
checking
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 231
Configuring
the
CRL
cache
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 231
Setting
the
maximum
number
of
cache
entries
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 232
Setting
the
GSKit
cache
lifetime
timeout
value
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 232
Chapter
9.
Client
single
sign-on
solutions
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 233
Windows
desktop
single
sign-on
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 234
Windows
desktop
single
sign-on
concepts
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 234
SPNEGO
protocol
and
Kerberos
authentication
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 234
User
registry
and
platform
support
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 235
Compatibility
with
other
authentication
methods
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 235
Limitations
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 236
Windows
desktop
single
sign-on
configuration
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 237
Step
1:
Configure
WebSEAL
server
into
Active
Directory
domain
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 237
Step
2:
Map
Kerberos
principal
to
Active
Directory
user
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 238
Step
3:
Install
Kerberos
runtime
client
(UNIX
only)
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 240
Step
4:
Configure
Kerberos
client
(UNIX
only)
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 240
Step
5:
Verify
authentication
of
Web
server
principal
(UNIX
only)
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 241
Step
6:
Verify
WebSEAL
authentication
using
the
keytab
file
(UNIX
only)
.
.
.
.
.
.
.
.
.
.
.
. 242
Step
7:
Enable
SPNEGO
for
WebSEAL
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 242
Step
8:
Add
service
name
and
keytab
file
entries
(UNIX
only)
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 242
Step
9:
Restart
WebSEAL
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 243
Step
10:
Configure
the
Internet
Explorer
client
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 243
Troubleshooting
tips
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 243
Cross-domain
single
sign-on
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Customizing
single
sign-on
authentication
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Authentication
process
flow
for
CDSSO
with
CDMF
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 245
Configuring
CDSSO
authentication
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 247
CDSSO
conditions
and
requirements
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 247
Resolving
machine
names
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 247
CDSSO
configuration
summary
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 248
Configuring
default
CDSSO
token
create
functionality
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 248
Configuring
default
CDSSO
token
consume
functionality
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 248
1.
Enabling
and
disabling
CDSSO
authentication
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 249
2.
Configuring
the
single
sign-on
authentication
mechanism
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 249
3.
Encrypting
the
authentication
token
data
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 250
4.
Configuring
the
token
time
stamp
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 251
5.
Configuring
the
token
label
name
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 251
Creating
the
CDSSO
HTML
link
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 251
Protecting
the
authentication
token
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 252
UTF-8
encoding
of
tokens
for
cross
domain
single
sign-on
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 252
Enabling
compatibility
with
tokens
prior
to
Version
4.1
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 252
Enable
backwards
compatibility
for
Version
4.1
tokens
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 253
Specify
extended
attributes
to
add
to
token
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 253
Specify
extended
attributes
to
extract
from
token
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 254
e-community
single
sign-on
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 256
e-community
features
and
requirements
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 257
e-community
process
flow
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 258
Understanding
the
e-community
cookie
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 261
Understanding
the
″vouch
for″
request
and
reply
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 262
The
″vouch
for″
Request
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 262
The
″vouch
for″
Reply
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 262
Understanding
the
“vouch
for”
token
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 263
Configuring
e-community
single
sign-on
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 263
e-community
conditions
and
requirements
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 263
Resolving
machine
names
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 264
E-community
configuration
summary
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 264
Configuring
default
token
create
functionality
on
the
″vouch
for″
server
.
.
.
.
.
.
.
.
.
.
.
. 265
Configuring
default
token
consume
functionality
on
the
receiving
server
.
.
.
.
.
.
.
.
.
.
.
. 265
x
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide