IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Token
authentication
Tivoli
Access
Manager
supports
authentication
using
a
token
passcode
supplied
by
the
client.
This
section
contains
the
following
topics:
v
“Token
authentication
concepts”
v
“Token
authentication
configuration”
on
page
162
Token
authentication
concepts
This
section
contains
the
following
topics:
v
“Token
authentication
library”
v
“SecurID
Token
authentication”
v
“Authentication
workflow
for
tokens
in
new
PIN
mode”
on
page
161
v
“Using
token
authentication
with
a
password
strength
server”
on
page
162
v
“RSA
SecurID
client
does
not
support
Linux
for
zSeries”
on
page
162
Token
authentication
library
Two-factor
authentication
requires
users
to
provide
two
forms
of
identification.
For
example,
a
single
factor
of
identification,
such
as
a
password,
plus
a
second
factor
in
the
form
of
an
authentication
token.
A
simple
two-factor
method
---
based
on
something
the
user
knows
plus
something
the
user
possesses
--
provides
a
more
reliable
level
of
user
authentication
than
reusable
passwords.
Tivoli
Access
Manager
provides
a
built-in
two-factor
authentication
library,
xtokenauth,
that
is
a
client
of
the
RSA
SecurID
token
authentication
server
(ACE/Server)
and
is
written
against
the
RSA
Authorization
API.
WebSEAL
provides
RSA
token
authentication
client
(ACE/Agent)
functions,
and
is
certified
as
SecurID
Ready.
By
default,
this
built-in
shared
library
for
token
authentication
is
hard-coded
to
map
SecurID
(RSA)
token
passcode
data.
This
default
token
authentication
mechanism
expects
the
user
name
used
by
the
client
to
map
to
an
existing
user
account
in
the
Tivoli
Access
Manager
LDAP
registry.
Note:
You
can
also
customize
this
library
file
to
authenticate
other
types
of
special
token
data
and,
optionally,
map
this
data
to
a
Tivoli
Access
Manager
identity.
Refer
to
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Referencefor
more
information.
SecurID
Token
authentication
The
WebSEAL
token
authentication
process
requires
the
RSA
SecurID
client,
installed
and
configured
on
the
WebSEAL
server
machine,
to
communicate
with
a
remote
RSA
server.
The
supported
SecurID
client
version
is
5.1.
RSA’s
ACE/Servers
authenticate
several
different
tokens,
including
software
tokens
and
hand-held
microprocessor-controlled
devices.
SecurID
Software
Tokens
are
binary
programs
running
on
a
workstation,
installed
on
a
smart-card,
or
running
as
a
plug-in
to
a
Web
browser.
SecurID
Software
Tokens
can
run
as
an
application.
The
application
displays
a
window
into
which
a
user
enters
a
Personal
Identification
Number
(PIN),
and
the
Software
Token
computes
the
passcode.
The
user
can
then
authenticate
to
WebSEAL
by
entering
the
passcode
into
a
login
form.
160
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide