IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
multiple
authentication
methods
You
modify
the
[authentication-mechanism]
stanza
of
the
WebSEAL
configuration
file
to
specify
the
shared
library
to
be
used
for
any
supported
authentication
method.
The
following
conditions
apply
when
you
configure
multiple
authentication
methods:
v
All
authentication
methods
can
function
independently
from
each
other.
It
is
possible
to
configure
a
shared
library
for
each
supported
method.
v
The
cert-cdas
method
overrides
the
cert-ssl
method
when
both
are
configured.
You
must
enable
one
of
these
to
support
client-side
certificates.
v
Only
one
password
type
authenticator
is
actually
used
when
more
than
one
is
configured.
WebSEAL
uses
the
following
order
of
priority
to
resolve
multiple
configured
password
authenticators:
1.
passwd-cdas
2.
passwd-ldap
v
It
is
possible
to
configure
the
same
custom
library
for
two
different
authentication
methods.
For
example,
you
could
write
a
custom
shared
library
to
process
both
username/password
and
HTTP
header
authentication.
For
this
example,
you
would
configure
both
the
passwd-cdas
and
http-request
parameters
with
the
same
shared
library.
It
is
the
responsibility
of
the
developer
to
maintain
session
state
and
avoid
conflicts
between
the
two
methods.
Prompting
for
login
WebSEAL
prompts
a
client
for
a
login
under
the
following
conditions:
v
An
unauthenticated
client
that
fails
an
authorization
check
v
A
forms
or
basic
authentication
client
that
fails
an
authorization
check
v
When
an
authentication
strength
(step-up
authentication)
policy
is
enforced
on
the
requested
resource,
and
the
client
has
not
already
authenticated
using
the
required
authentication
level.
The
following
client
types
are
presented
a
″403
failure″
error:
v
When
an
authorization
check
fails:
–
Client-side
certificate
–
Failover
cookie
–
CDSSO
–
IP
address
–
HTTP
header
v
When
a
client
authenticates
with
a
method
that
is
disabled
by
WebSEAL
Configuring
account
expiry
notification
WebSEAL
returns
an
error
message
to
a
user
when
a
login
attempt
fails.
The
error
message
applies
to
a
variety
of
situations
where
the
user
has
supplied
invalid
authentication
information,
such
as
an
invalid
user
name
or
password.
You
can
choose
to
have
this
same
error
message
returned
to
a
user
when
the
user
login
fails
due
to
an
invalid
or
expired
user
account.
Alternatively,
you
can
specify
that
a
different
error
message
is
sent
to
the
user
in
this
situation.
The
different
error
message
specifies
the
exact
reason
for
the
failure
due
to
account
expiry.
142
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide