IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

1.
The
client
(browser)
attempts
to
access
a
protected
resource.
The
client
request
goes
to
a
load
balancer
that
controls
access
to
the
replicated
WebSEAL
servers.
2.
The
load
balancer
selects
a
target
WebSEAL
server
and
forwards
the
user
request.
3.
The
client
successfully
authenticates
to
WebSEAL
using
one
of
the
supported
authentication
methods.
4.
WebSEAL
creates
a
failover
authentication
cookie
that
contains
client
authentication
information,
and
sends
the
cookie
to
the
client.
5.
The
client
sends
the
cookie
through
the
load
balancer
to
WebSEAL
with
each
subsequent
request.
The
WebSEAL
server
processes
each
request.
6.
If
the
load
balancer
finds
that
the
WebSEAL
server
is
not
accessible,
the
client
request
is
directed
to
another
replicated
WebSEAL
server.
7.
The
replicated
WebSEAL
server
is
configured
to
check
for
the
existence
of
a
failover
authentication
cookie
every
time
it
attempts
to
authenticate
a
user.
8.
WebSEAL
uses
the
information
in
the
cookie
to
establish
a
session
with
the
client,
without
requiring
the
client
to
manually
log
in
again.
The
client’s
session
data
and
user
credential
are
built,
and
the
request
for
the
protected
resource
is
processed.
9.
The
change
of
session
from
one
WebSEAL
server
to
another
WebSEAL
server
is
transparent
to
the
client.
Because
the
WebSEAL
servers
contain
identical
resources,
the
client
session
continues
uninterrupted.
Note:
For
more
information
on
replication
of
WebSEAL
servers,
see
“Replicated
front-end
WebSEAL
servers”
on
page
58.
Failover
authentication
library
WebSEAL
provides
a
built-in
failover
authentication
shared
library
for
each
of
the
supported
authentication
methods.
Each
failover
shared
library
mimics
the
shared
library
for
the
corresponding
authentication
method
and,
additionally,
recovers
any
extended
attributes
that
were
originally
placed
in
the
user’s
credential.
When
a
failover
authentication
event
occurs,
WebSEAL
calls
the
failover
authentication
library
that
matches
the
last
authentication
method
used
by
the
user
before
the
original
WebSEAL
server
failed.
WebSEAL
supplies
failover
authentication
function
for
the
following
authentication
methods:
v
Basic
or
forms
authentication
(also
known
as
password
authentication)
v
Token
card
authentication
v
Certificate
authentication
v
HTTP
request
authentication
v
Cross-domain
single
signon
(CDSSO)
v
Kerberos
authentication
(SPNEGO)
WebSEAL
supplies
one
standard
failover
shared
library
that
functions
for
all
the
above
authentication
methods.
This
library
is
called
libfailoverauthn
on
UNIX
systems,
and
failoverauthn
on
Windows.
Note:
Alternatively,
you
can
supply
a
custom
CDAS
library
that
provides
specific
authentication
capabilities
required
by
your
environment.
For
example,
a
WebSEAL
server
can
be
configured
to
support
forms
authentication
and
failover
authentication.
When
WebSEAL
starts,
both
the
forms
authentication
shared
library
and
the
″failover-forms″
authentication
library
are
loaded.
The
user
Chapter
6.
Authentication
167