IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Table
22.
Authentication
library
types
specified
in
the
WebSEAL
configuration
file
(continued)
failover-certificate
Library
that
implements
failover
cookie
authentication
for
certificate
authentication.
failover-http-request
Library
that
implements
failover
cookie
authentication
for
HTTP
header
authentication
or
IP
address
authentication.
failover-cdsso
Library
that
implements
failover
cookie
authentication
for
cross-domain
single
sign-on
authentication.
passwd-strength
Library
that
enforces
custom
password
strength
authentication
policies.
cred-ext-attrs
Custom
authentication
module
used
to
supply
extended
attribute
data
to
user
credential
You
use
the
[authentication-mechanisms]
stanza
to
configure
the
authentication
method
and
the
implementation
in
the
following
format:
authentication_method_entry
=
built-in_shared_library
Authentication
conversion
library
WebSEAL
provides
an
authentication
conversion
library
that
converts
authentication
data
from
UTF-8
format
to
non-UTF-8
format.
For
Version
5.1,
WebSEAL
produces
authentication
data
in
UTF-8
format.
Prior
to
Version
5.1,
WebSEAL
produced
authentication
data
in
the
format
of
the
local
code
page.
Thus,
external
authentication
modules,
such
as
CDASs,
that
were
written
for
versions
of
WebSEAL
prior
to
Version
5.1
might
need
to
use
the
conversion
library.
For
more
information
on
the
conversion
library,
including
configuration
instructions
see
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference.
For
more
information
on
WebSEAL’s
use
of
UTF-8
encoding,
see
“Multi-locale
support
with
UTF-8”
on
page
44.
Default
configuration
for
WebSEAL
authentication
By
default,
WebSEAL
is
set
to
authenticate
clients
over
SSL
using
basic
authentication
(BA)
user
names
and
passwords
(LDAP
registry).
WebSEAL
is
normally
enabled
for
both
TCP
and
SSL
access.
Therefore,
a
typical
configuration
of
the
[authentication-mechanisms]
stanza
includes
support
for
username
and
password
(LDAP
registry)
and
support
for
client-side
certificates
over
SSL.
The
following
example
represents
the
typical
configuration
of
the
[authentication-mechanisms]
stanza
for
Solaris:
[authentication-mechanisms]
passwd-ldap
=
libldapauthn.so
cert-ssl
=
libsslauthn.so
To
configure
other
authentication
methods,
add
the
appropriate
parameter
with
its
shared
library
(or
CDAS
module).
Chapter
6.
Authentication
141