IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

This
value
corresponds
to
the
number
of
concurrent
login
sessions.
When
the
cache
size
reaches
this
value,
entries
are
removed
from
the
cache
according
to
a
least
recently
used
algorithm
to
allow
new
incoming
logins.
The
default
number
of
concurrent
login
sessions
is
4096:
[session]
max-entries
=
4096
For
performance
considerations,
see
the
IBM
Tivoli
Access
Manager
for
e-business
Performance
Tuning
Guide.
Setting
the
cache
entry
lifetime
timeout
value
The
timeout
parameter,
located
in
the
[session]
stanza
of
the
WebSEAL
configuration
file,
sets
the
maximum
lifetime
timeout
value
for
all
user
sessions
stored
in
the
WebSEAL
session/credentials
cache.
WebSEAL
caches
credential
information
internally.
The
session
cache
timeout
parameter
dictates
the
length
of
time
authorization
credential
information
remains
in
memory
on
WebSEAL.
The
parameter
is
not
an
inactivity
timeout.
The
value
maps
to
a
″credential
lifetime″
rather
than
a
″session
inactivity
timeout″.
Its
purpose
is
to
enhance
security
by
forcing
the
user
to
reauthenticate
when
the
specified
timeout
limit
is
reached.
The
default
session
cache
entry
lifetime
timeout
(in
seconds)
is
3600:
[session]
timeout
=
3600
Note:
This
parameter
is
not
appropriate
for
basic
authentication
(BA).
BA
supplies
authentication
data
with
each
request,
thereby
repeatedly
resetting
the
timeout
value.
Setting
the
cache
entry
inactivity
timeout
value
The
inactive-timeout
parameter,
located
in
the
[session]
stanza
of
the
WebSEAL
configuration
file,
sets
the
timeout
value
for
user
session
inactivity.
The
default
login
session
inactivity
timeout
(in
seconds)
is
600:
[session]
inactive-timeout
=
600
To
disable
this
timeout
feature,
set
the
parameter
value
to
″0″.
Note:
This
parameter
is
not
appropriate
for
basic
authentication
(BA).
BA
supplies
authentication
data
with
each
request,
thereby
repeatedly
resetting
the
inactive
timeout
value.
Credentials
cache
limitation
Limitation:
When
you
delete
a
user
from
the
registry,
the
credentials
of
that
user
in
the
WebSEAL
credentials
cache
are
not
removed.
If
the
user
has
a
browser
session
active
at
the
time
the
account
is
deleted,
the
user
can
continue
to
browse,
based
on
the
existing
credentials
in
the
cache.
The
credentials
of
the
user
are
not
reevaluated,
based
on
the
current
information
in
the
user
registry,
until
either
a
new
login
occurs
or
the
current
credentials
expire.
The
contents
of
the
WebSEAL
credentials
cache
are
cleared
when
the
user
logs
out
of
the
browser
session.
134
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide