IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[session]
timeout
inactive-timeout
[ssl]
ssl-v2-timeout
ssl-v3-timeout
When
you
use
cookies
to
maintain
session
state,
the
cookie
is
sent
to
the
browser
only
once,
following
a
successful
login.
However,
some
browsers
enforce
a
limit
on
the
number
of
in-memory
cookies
they
can
store
concurrently.
In
some
environments,
applications
can
place
a
large
number
of
in-memory
cookies
per
domain
on
client
systems.
In
this
case,
any
configured
WebSEAL
session
cookie
or
failover
cookie
can
be
easily
replaced
by
another
cookie.
When
you
configure
WebSEAL
to
use
session
cookies
(and
perhaps
failover
cookies),
you
can
set
the
resend-webseal-cookies
parameter,
located
in
the
[session]
stanza
of
the
WebSEAL
configuration
file,
to
have
WebSEAL
send
the
session
cookie
and
the
failover
cookie
to
the
browser
with
every
response.
This
action
helps
to
ensure
that
the
session
cookie
and
the
failover
cookie
remain
in
the
browser
memory.
The
resend-webseal-cookies
parameter
has
a
default
setting
of
″no″:
[session]
resend-webseal-cookies
=
no
Change
the
default
setting
to
″yes″
to
send
WebSEAL
session
cookies
and
failover
cookies
with
every
response.
Enabling
and
disabling
same
sessions
You
can
configure
WebSEAL
to
use
the
same
session
ID
data
when
a
client
logs
in
over
one
type
of
transport
(HTTP,
for
example),
disconnects,
and
re-logs
in
over
another
type
of
transport
(HTTPS,
for
example).
The
use-same-session
parameter,
located
in
the
[session]
stanza
of
the
WebSEAL
configuration
file,
enables
and
disables
the
recognition
of
the
same
session
ID
data.
By
default,
this
parameter
is
set
to
″no″:
[session]
use-same-session
=
no
A
″yes″
configuration
setting
for
this
parameter
results
in
the
following
conditions:
v
Session
cookies
are
used
to
identify
the
following
client
types
for
subsequent
logins
over
another
transport:
–
Failover
cookies
–
Client-side
certificates
–
CDSSO
ID
token
–
Token
passcode
–
Forms
username
and
password
–
basic
authentication
v
The
HTTP
header
is
used
for
clients
accessing
with
HTTP
headers.
v
The
IP
address
is
used
for
clients
accessing
with
IP
addresses.
v
The
ssl-id-sessions
configuration
is
ignored;
the
resulting
behavior
is
the
same
as
if
ssl-id-sessions
were
set
to
“no”.
This
logic
is
important
because
HTTP
clients
do
not
have
an
SSL
session
ID
available
as
session
data.
Chapter
6.
Authentication
137