IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
2.<br />
<strong>WebSEAL</strong><br />
returns<br />
an<br />
authentication<br />
page,<br />
requesting<br />
username<br />
and<br />
passcode.<br />
3.<br />
User<br />
fills<br />
in<br />
username<br />
and<br />
tokencode<br />
and<br />
submits<br />
<strong>for</strong>m<br />
to<br />
<strong>WebSEAL</strong>’s<br />
authentication<br />
library.<br />
When<br />
the<br />
user<br />
has<br />
no<br />
PIN,<br />
either<br />
because<br />
the<br />
tokencard<br />
is<br />
new<br />
or<br />
the<br />
administrator<br />
reset<br />
the<br />
PIN,<br />
the<br />
tokencode<br />
is<br />
the<br />
same<br />
as<br />
the<br />
passcode.<br />
When<br />
the<br />
user<br />
has<br />
a<br />
PIN,<br />
but<br />
the<br />
tokencard<br />
is<br />
in<br />
New<br />
PIN<br />
mode,<br />
the<br />
user<br />
enters<br />
the<br />
PIN<br />
plus<br />
the<br />
tokencode.<br />
4.<br />
<strong>WebSEAL</strong>’s<br />
token<br />
authentication<br />
library<br />
sends<br />
the<br />
authentication<br />
request<br />
to<br />
the<br />
ACE/Server.<br />
5.<br />
The<br />
ACE/Server<br />
processes<br />
the<br />
request<br />
as<br />
follows:<br />
a.<br />
If<br />
the<br />
authentication<br />
is<br />
unsuccessful,<br />
the<br />
result<br />
is<br />
returned<br />
to<br />
the<br />
<strong>WebSEAL</strong><br />
token<br />
authentication<br />
library,<br />
which<br />
displays<br />
an<br />
error<br />
page<br />
to<br />
the<br />
client<br />
(return<br />
to<br />
step<br />
2).<br />
b.<br />
If<br />
the<br />
token<br />
was<br />
not<br />
in<br />
new<br />
PIN<br />
mode,<br />
the<br />
user<br />
is<br />
authenticated.<br />
The<br />
<strong>WebSEAL</strong><br />
token<br />
authentication<br />
library<br />
returns<br />
success<br />
to<br />
the<br />
<strong>WebSEAL</strong><br />
server,<br />
which<br />
serves<br />
the<br />
requested<br />
protected<br />
Web<br />
object.<br />
(End<br />
of<br />
authentication<br />
workflow).<br />
c.<br />
If<br />
the<br />
token<br />
is<br />
in<br />
new<br />
PIN<br />
mode,<br />
the<br />
ACE/Server<br />
returns<br />
the<br />
NEW_PIN<br />
error<br />
code<br />
to<br />
the<br />
<strong>WebSEAL</strong><br />
token<br />
authentication<br />
library.<br />
6.<br />
<strong>WebSEAL</strong><br />
presents<br />
to<br />
the<br />
user<br />
the<br />
password<br />
expired<br />
<strong>for</strong>m.<br />
7.<br />
User<br />
enters<br />
tokencode<br />
or<br />
passcode<br />
and<br />
the<br />
new<br />
PIN<br />
and<br />
posts<br />
it<br />
to<br />
<strong>WebSEAL</strong>.<br />
8.<br />
<strong>WebSEAL</strong><br />
checks<br />
to<br />
see<br />
if<br />
a<br />
password<br />
strength<br />
server<br />
is<br />
deployed.<br />
a.<br />
If<br />
a<br />
password<br />
strength<br />
server<br />
is<br />
not<br />
deployed,<br />
<strong>WebSEAL</strong><br />
continues<br />
to<br />
step<br />
9.<br />
b.<br />
If<br />
a<br />
password<br />
strength<br />
server<br />
is<br />
deployed,<br />
<strong>WebSEAL</strong><br />
checks<br />
the<br />
new<br />
PIN.<br />
If<br />
the<br />
PIN<br />
is<br />
valid,<br />
<strong>WebSEAL</strong><br />
continues<br />
to<br />
step<br />
9.<br />
If<br />
the<br />
PIN<br />
is<br />
not<br />
valid,<br />
<strong>WebSEAL</strong><br />
returns<br />
to<br />
step<br />
6.<br />
9.<br />
The<br />
<strong>WebSEAL</strong><br />
authentication<br />
library<br />
sends<br />
the<br />
tokencode<br />
and<br />
new<br />
PIN<br />
to<br />
the<br />
ACE/Server.<br />
10.<br />
The<br />
ACE/Server<br />
returns<br />
a<br />
response<br />
code.<br />
11.<br />
If<br />
the<br />
PIN<br />
set<br />
call<br />
to<br />
the<br />
ACE/Server<br />
is<br />
successful,<br />
<strong>WebSEAL</strong><br />
returns<br />
the<br />
originally<br />
requested<br />
protected<br />
Web<br />
object<br />
to<br />
the<br />
client.<br />
If<br />
the<br />
PIN<br />
set<br />
call<br />
fails,<br />
authentication<br />
workflow<br />
returns<br />
to<br />
step<br />
6.<br />
Using<br />
token<br />
authentication<br />
with<br />
a<br />
password<br />
strength<br />
server<br />
<strong>WebSEAL</strong><br />
also<br />
supports<br />
a<br />
password<br />
strength<br />
server<br />
that<br />
is<br />
specific<br />
to<br />
an<br />
authentication<br />
mechanism.<br />
This<br />
support<br />
enables<br />
security<br />
architects<br />
to<br />
develop<br />
different<br />
password<br />
strength<br />
policies<br />
<strong>for</strong><br />
different<br />
authentication<br />
methods<br />
while<br />
using<br />
only<br />
<strong>WebSEAL</strong><br />
authentication<br />
mechanisms.<br />
A<br />
four-digit,<br />
numeric<br />
PIN,<br />
<strong>for</strong><br />
example,<br />
may<br />
qualify<br />
<strong>for</strong><br />
the<br />
ACE/Server<br />
but<br />
would<br />
fail<br />
against<br />
a<br />
more<br />
stringent<br />
password<br />
strength<br />
server.<br />
RSA<br />
SecurID<br />
client<br />
does<br />
not<br />
support<br />
Linux<br />
<strong>for</strong><br />
zSeries<br />
The<br />
RSA<br />
SecurID<br />
client<br />
is<br />
not<br />
supported<br />
on<br />
the<br />
Linux<br />
<strong>for</strong><br />
zSeries<br />
plat<strong>for</strong>ms.<br />
This<br />
means<br />
that<br />
the<br />
<strong>WebSEAL</strong><br />
token<br />
authentication<br />
module<br />
cannot<br />
support<br />
Linux<br />
<strong>for</strong><br />
zSeries<br />
plat<strong>for</strong>ms.<br />
Token<br />
authentication<br />
configuration<br />
To<br />
configure<br />
token<br />
authentication,<br />
the<br />
instructions<br />
in<br />
the<br />
following<br />
sections<br />
must<br />
be<br />
completed:<br />
v<br />
“Enable<br />
token<br />
authentication”<br />
on<br />
page<br />
163<br />
v<br />
“Specify<br />
the<br />
token<br />
authentication<br />
mechanism”<br />
on<br />
page<br />
163<br />
162<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language