IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

authenticates
using
forms
authentication.
The
WebSEAL
server
sends
a
failover
authentication
cookie
to
each
client
(browser).
The
cookie
data
specifies
that
the
cookie
was
created
in
a
forms
authentication
environment.
When
the
WebSEAL
server
becomes
unavailable,
the
failover
cookie
is
sent
to
a
second
WebSEAL
server.
The
second
WebSEAL
server,
which
is
typically
a
replicated
WebSEAL
server,
also
has
both
the
forms
authentication
shared
library
and
the
forms-failover
library
loaded.
The
second
WebSEAL
server
receives
the
failover
cookie,
and
examines
it
to
determine
the
user’s
previous
authentication
method.
The
second
WebSEAL
server
calls
out
to
the
failover–forms
authentication
shared
library
to
extract
the
necessary
data
from
the
cookie,
and
then
uses
that
data
to
authenticate
the
user
and
get
a
user
credential.
For
example,
when
both
forms
authentication
and
failover
authentication
are
enabled
in
a
replicated
WebSEAL
environment,
two
separate
libraries
must
be
configured
in
the
WebSEAL
configuration
file.
One
library
specifies
the
forms
authentication
method
library.
The
other
library
specifies
the
failover
authentication
method
library.
Example
configuration
file
entries
would
be:
[authentication-mechanisms]
passwd-ldap
=
/opt/pdweb/lib/libldapauthn.so
failover-password
=
/opt/pdweb/lib/libfailoverauthn.so
In
this
example,
the
passwd-ldap
stanza
entry
specifies
WebSEAL’s
built-in
forms
authentication
library.
The
failover-password
stanza
entry
specifies
WebSEAL’s
built-in
failover
authentication
library.
Configuration
instructions:
v
“Specify
the
failover
authentication
library”
on
page
174
v
“Add
the
authentication
level”
on
page
176
Addition
of
data
to
a
failover
cookie
WebSEAL
automatically
adds
specific
data
from
the
user
session
to
each
failover
authentication
cookie.
WebSEAL
can
be
configured
to
add
additional
information
from
the
client
data
maintained
in
the
credential
cache.
Also,
WebSEAL
can
be
configured
to
add
user-defined
data
specific
to
their
deployment.
For
example,
user
attributes
obtained
by
a
custom
cross-domain
authentication
service
can
be
added
to
the
cookie.
By
default
WebSEAL
adds
the
following
data
to
each
cookie:
v
User
name
This
name
corresponds
to
the
name
used
to
identify
the
user
in
the
user
registry
Note:
When
an
authenticated
user
has
used
the
WebSEAL
switch
user
function
to
obtain
the
effective
identity
of
another
user,
the
identity
of
the
other
user
is
not
added
to
the
cookie.
Only
the
original
authenticated
user
identity
is
added
to
the
cookie.
v
Authentication
method
The
authentication
method
used
to
authenticate
the
user
to
WebSEAL
v
Cookie
creation
time
The
system
time
when
the
cookie
was
created.
WebSEAL
also
creates
an
attribute
list
containing
additional
data.
By
default,
the
attribute
list
contains
one
value:
168
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide