IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

eauthenticating
the
user.
WebSEAL
uses
BA
header
information
to
reauthenticate
the
user.
This
reauthentication
eliminates
possible
security
vulnerabilities
that
can
occur
when
BA
headers
are
used
without
cookies.
However,
the
overhead
of
reauthenticaion
and
session
creation
lessens
server
performance.
WebSEAL
can
be
configured
to
accept
BA
requests
over
HTTP
or
HTTPS
(or
both).
When
WebSEAL
accepts
BA
requests
over
HTTP,
WebSEAL
always
sends
a
cookie
to
the
client.
When
WebSEAL
is
configured
to
accept
BA
requests
over
HTTPS,
administrators
can
optionally
use
SSL
ids
to
manage
sessions.
When
administrators
choose
to
not
use
SSL
ids,
WebSEAL
always
sends
a
cookie
to
the
client.
To
use
SSL
IDs,
edit
the
WebSEAL
configuration
file
as
follows:
ssl-id-sessions
=
yes
To
not
use
SSL
IDs,
set:
ssl-id-sessions
=
no
Enabling
and
disabling
session
ID
cookies
The
ssl-id-sessions
parameter,
located
in
the
[session]
stanza
of
the
WebSEAL
configuration
file,
enables
and
disables
session
cookies.
This
parameter
controls
whether
the
SSL
session
ID
is
used
to
maintain
the
login
session
for
clients
accessing
over
HTTPS.
If
the
parameter
is
set
to
″no″,
session
cookies
are
used
for
most
authentication
methods.
[session]
ssl-id-sessions
=
{yes|no}
Note:
The
Opera
browser,
in
its
default
configuration,
does
not
maintain
SSL
IDs
across
SSL
connections.
When
using
the
Opera
browser,
ssl-id-sessions
must
be
set
to
no.
A
configuration
setting
of
no
for
this
parameter
results
in
the
following
conditions
for
clients
accessing
over
HTTPS:
v
The
SSL
session
ID
is
never
used
as
session
ID
data.
v
Cookies
will
be
used
to
maintain
sessions
with
clients
authenticating
with
failover
cookies,
CDSSO
ID
tokens,
forms
username
and
password,
token
passcode,
and
client-side
certificates.
v
For
BA
clients,
a
cookie
is
used
to
maintain
sessions
in
every
configuration
except
one:
If
a
client
connects
via
HTTPS
and
ssl-id-sessions
=
yes
and
use-same-session
=
no,
then
the
SSL
ID
is
used
to
maintain
the
session.
v
The
HTTP
header
is
used
as
session
ID
data
for
clients
authenticating
with
HTTP
headers
v
The
IP
address
is
used
as
session
ID
data
for
clients
authenticating
with
IP
addresses.
When
ssl-id-sessions
is
set
to
yes,
several
different
values
determine
the
timeout
for
the
session.
The
session
cache
entry
lifetime
timeout
is
set
in
the
timeout
entry
in
the
[session]
stanza,
and
the
session
inactivity
timeout
is
set
by
inactive-timeout
in
the
same
stanza.
SSL
timeouts
are
set
in
the
[ssl]
stanza,
where
both
ssl-v2–timeout
and
ssl-v3–timeout
are
declared.
Thus,
when
ssl-id-sessions
=
yes,
the
timeout
is
set
to
the
lowest
of
the
values
set
for
each
of
the
following
timeouts:
136
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide