IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
Authentication
level
An
integer
value
that
corresponds
to
the
WebSEAL
authentication
strength
level
(also
an
integer
value)
that
is
assigned
on
the
local
WebSEAL
server
to
the
authentication
method.
Authentication
strength,
also
known
as
step-up
authentication,
enables
a
user
to
authenticate
to
a
different
authenticate
method
without
having
to
logout.
WebSEAL
defines
additional
user
data
that
can
be
added
to
the
cookie
attribute
list:
v
Session
lifetime
timestamp
When
a
user
authenticates,
WebSEAL
tracks
the
age
or
lifetime
of
the
user
entry
in
the
session
cache.
The
session
lifetime
timestamp
consists
of
the
current
time,
advanced
by
the
number
of
seconds
configured
for
the
maximum
time
that
a
user’s
session
data
can
remain
in
the
session
cache.
When
the
current
system
time
exceeds
the
timestamp
value,
WebSEAL
invalidates
the
user’s
entry
in
the
session
cache
(including
the
user
credentials).
WebSEAL
can
be
configured
to
add
the
session
lifetime
timestamp
to
the
cookie.
When
this
timestamp
is
added
to
the
cookie,
the
session
lifetime
timer
can
be
preserved
across
failover
events.
Thus,
WebSEAL
administrators
can
choose
whether
or
not
to
reset
the
client’s
session
timer
when
the
client
session
is
established
on
a
replicated
server.
Note
that
successful
use
of
this
feature
is
dependent
on
synchronization
of
clocks
between
replicated
WebSEAL
servers.
If
clock
skew
becomes
great,
sessions
will
expire
at
unintended
times.
v
Session
inactivity
timestamp
WebSEAL
also
tracks
the
amount
of
time
that
a
user’s
entry
in
WebSEAL’s
session
cache
has
been
inactive.
When
a
user
session
is
inactive
for
a
period
of
time
longer
than
the
value
set
for
session
inactivity,
WebSEAL
invalidates
the
user’s
session.
The
session
inactivity
timestamp
can
also
be
added
to
the
failover
authentication
cookie.
This
timestamp
differs
slightly
from
the
session
inactivity
timestamp
maintained
for
the
WebSEAL
session
cache.
The
system
inactivity
timeout
maintained
for
the
cache
is
calculated
by
combining
two
values:
–
Current
system
time
–
Maximum
number
of
seconds
that
a
user’s
session
can
remain
inactive.
When
this
value
is
added
to
the
failover
authentication
cookie,
it
is
combined
with
one
additional
value:
–
Maximum
number
of
seconds
(interval)
between
updates
to
the
failover
authentication
cookie
The
setting
for
the
interval
between
the
updating
of
failover
cookies
affects
performance.
Administrators
must
choose
a
balance
between
optimal
performance
and
absolute
accuracy
of
the
inactivity
timer
in
the
cookie.
To
keep
the
inactivity
timer
most
accurate,
it
should
be
updated
every
time
the
user
makes
a
request.
However,
frequent
updating
of
cookie
contents
incurs
overhead
and
decreases
performance.
Each
administrator
must
choose
an
interval
that
best
fits
the
WebSEAL
deployment.
In
some
cases,
an
update
of
the
failover
cookie
with
every
user
request
is
appropriate.
In
other
cases,
the
administrator
might
choose
to
never
update
the
inactivity
timer
in
the
failover
cookie.
v
Additional
extended
attributes
Chapter
6.
Authentication
169