IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Failover<br />
authentication<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Failover<br />
authentication<br />
concepts”<br />
v<br />
“Failover<br />
authentication<br />
configuration”<br />
on<br />
page<br />
173<br />
Failover<br />
authentication<br />
concepts<br />
<strong>WebSEAL</strong><br />
provides<br />
an<br />
authentication<br />
method<br />
that<br />
enables<br />
an<br />
authenticated<br />
session<br />
between<br />
a<br />
client<br />
and<br />
<strong>WebSEAL</strong><br />
to<br />
be<br />
preserved<br />
when<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
becomes<br />
unavailable.<br />
The<br />
method<br />
is<br />
called<br />
failover<br />
authentication.<br />
Failover<br />
authentication<br />
enables<br />
the<br />
client<br />
to<br />
connect<br />
to<br />
another<br />
<strong>WebSEAL</strong><br />
server,<br />
and<br />
create<br />
an<br />
authentication<br />
session<br />
containing<br />
the<br />
same<br />
user<br />
session<br />
data<br />
and<br />
user<br />
credentials.<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Failover<br />
authentication<br />
scenario”<br />
v<br />
“Failover<br />
authentication<br />
library”<br />
on<br />
page<br />
167<br />
v<br />
“Addition<br />
of<br />
data<br />
to<br />
a<br />
failover<br />
cookie”<br />
on<br />
page<br />
168<br />
v<br />
“Extraction<br />
of<br />
data<br />
from<br />
a<br />
failover<br />
cookie”<br />
on<br />
page<br />
170<br />
v<br />
“Domain-wide<br />
failover<br />
authentication”<br />
on<br />
page<br />
171<br />
v<br />
“Backwards<br />
compatibility”<br />
on<br />
page<br />
172<br />
v<br />
“Upgrading<br />
failover<br />
authentication”<br />
on<br />
page<br />
172<br />
Failover<br />
authentication<br />
scenario<br />
Failover<br />
authentication<br />
is<br />
most<br />
commonly<br />
used<br />
in<br />
a<br />
scenario<br />
where<br />
a<br />
client<br />
(browser)<br />
goes<br />
through<br />
a<br />
load<br />
balancer<br />
to<br />
reach<br />
a<br />
<strong>WebSEAL</strong><br />
environment.<br />
The<br />
<strong>WebSEAL</strong><br />
environment<br />
contains<br />
two<br />
or<br />
more<br />
replicated<br />
<strong>WebSEAL</strong><br />
servers.<br />
The<br />
replicated<br />
servers<br />
are<br />
identical.<br />
They<br />
contain<br />
replica<br />
copies<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
Web<br />
protected<br />
object<br />
space,<br />
junction<br />
database,<br />
and<br />
(optionally)<br />
dynurl<br />
database.<br />
Failover<br />
authentication<br />
is<br />
typically<br />
used<br />
in<br />
a<br />
<strong>WebSEAL</strong><br />
deployment<br />
that<br />
includes<br />
replicated<br />
<strong>WebSEAL</strong><br />
servers.<br />
This<br />
type<br />
of<br />
deployment<br />
provides<br />
two<br />
useful<br />
features:<br />
per<strong>for</strong>mance<br />
improvements<br />
through<br />
load<br />
balancing,<br />
and<br />
failover<br />
of<br />
client<br />
sessions<br />
between<br />
<strong>WebSEAL</strong><br />
servers.<br />
As<br />
part<br />
of<br />
the<br />
failover<br />
capability,<br />
<strong>WebSEAL</strong><br />
supports<br />
authentication<br />
of<br />
a<br />
user<br />
through<br />
a<br />
failover<br />
cookie.<br />
The<br />
failover<br />
cookie<br />
is<br />
a<br />
server-specific<br />
cookie<br />
or<br />
a<br />
domain<br />
cookie.<br />
The<br />
failover<br />
cookie<br />
contains<br />
client-specific<br />
data,<br />
such<br />
as<br />
user<br />
name,<br />
cookie-creation<br />
time<br />
stamp,<br />
original<br />
authentication<br />
method,<br />
and<br />
an<br />
attribute<br />
list.<br />
The<br />
attribute<br />
list<br />
contains<br />
by<br />
default<br />
the<br />
user’s<br />
authentication<br />
level.<br />
<strong>WebSEAL</strong><br />
can<br />
be<br />
configured<br />
to<br />
add<br />
specific<br />
extended<br />
attributes<br />
to<br />
the<br />
attribute<br />
list.<br />
<strong>WebSEAL</strong><br />
encrypts<br />
this<br />
client-specific<br />
data.<br />
The<br />
replicated<br />
<strong>WebSEAL</strong><br />
servers<br />
share<br />
a<br />
common<br />
key<br />
that<br />
decrypts<br />
the<br />
cookie<br />
in<strong>for</strong>mation.<br />
When<br />
the<br />
replicated<br />
<strong>WebSEAL</strong><br />
server<br />
receives<br />
this<br />
cookie,<br />
it<br />
decrypts<br />
the<br />
cookie,<br />
and<br />
uses<br />
the<br />
user<br />
name<br />
and<br />
authentication<br />
method<br />
to<br />
regenerate<br />
the<br />
client’s<br />
credential.<br />
<strong>WebSEAL</strong><br />
can<br />
also<br />
be<br />
configured<br />
to<br />
copy<br />
any<br />
extended<br />
attributes<br />
from<br />
the<br />
cookie<br />
to<br />
the<br />
user<br />
credential.<br />
The<br />
client<br />
can<br />
now<br />
establish<br />
a<br />
new<br />
session<br />
with<br />
a<br />
replica<br />
<strong>WebSEAL</strong><br />
server<br />
without<br />
being<br />
prompted<br />
to<br />
log<br />
in.<br />
Note:<br />
Failover<br />
cookies<br />
can<br />
be<br />
used<br />
over<br />
either<br />
HTTP<br />
or<br />
HTTPS.<br />
The<br />
sequence<br />
of<br />
events<br />
<strong>for</strong><br />
a<br />
failover<br />
authentication<br />
event<br />
is:<br />
166<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language