IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
default
WebSEAL
configuration
file
entry
is:
[acnt-mgt]
certificate-login
=
certlogin.html
Specify
the
certificate
login
error
page
WebSEAL
provides
a
default
HTML
page
containing
an
error
message
that
is
displayed
when
a
user
fails
to
successfully
authenticate
using
client-side
certificate
authentication.
Administrators
can
choose
to
either
use
the
default
error
page,
customize
the
error
message,
or
specify
an
entirely
different
customized
error
page.
Typically,
administrators
use
the
default
page
but
might
customize
the
contents
of
the
error
message.
Administrators
who
choose
to
create
a
new
HTML
error
page
must
edit
the
WebSEAL
configuration
file
to
indicate
the
location
of
the
new
page.
The
default
WebSEAL
configuration
file
entry
is:
[acnt-mgt]
cert-failure
=
certfailure.html
Disable
SSL
session
IDs
for
session
tracking
This
configuration
step
applies
only
when
delayed
certificate
authentication
has
been
enabled.
Disable
the
use
of
SSL
session
IDs
to
track
session
state.
Set
the
following
stanza
entry
in
the
WebSEAL
configuration
file:
[ssl]
ssl-id-sessions
=
no
Note:
In
this
case,
SSL
IDs
cannot
be
used
to
maintain
user
sessions
because
when
the
user
is
prompted
for
a
certificate,
the
user’s
SSL
ID
will
change.
If
ssl-id-sessions
is
set
to
yes,
WebSEAL
generates
an
error
message
upon
startup
and
shuts
down.
Enable
and
configure
the
Certificate
SSL
ID
cache
This
configuration
step
applies
only
when
delayed
certificate
authentication
has
been
enabled.
To
configure
the
cache,
complete
the
following
steps:
1.
Verify
that
certificate
authentication
is
enabled.
See
“Enable
certificate
authentication”
on
page
151
2.
Specify
the
maximum
number
of
entries
allowed
in
the
cache.
Edit
the
WebSEAL
configuration
file.
In
the
[certificate]
stanza,
assign
a
value
to
cert-cache-max-entries:
[certificate]
cert-cache-max-entries
=
1024
The
value
corresponds
to
the
maximum
number
of
concurrent
certificate
authentications.
The
default
value
is
one
quarter
of
the
default
number
of
entries
in
the
SSL
ID
cache.
(Most
SSL
sessions
do
not
require
certificate
logins
or
will
only
require
certificate
authentication
once
for
the
session).
The
number
of
entries
in
the
SSL
ID
cache
is
set
in
the
[ssl]
stanza:
[ssl]
ssl-max-entries
=
4096
Chapter
6.
Authentication
153