IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Administrators
can
configure
WebSEAL
to
insert
a
customized
set
of
attributes
into
a
failover
cookie.
Attributes
can
be
specified
individually
or
in
a
group.
To
specify
a
group
of
attributes,
use
wildcard
pattern
matching
in
configuration
file
entries.
This
feature
is
useful
in
deployments
that
also
use
customized
authentication
libraries,
such
as
cross-domain
authentication
servers,
to
insert
special
attributes
into
a
user
credential.
By
specifying
those
attributes
in
the
WebSEAL
configuration
file,
the
administrator
can
ensure
that
the
attributes
are
available
to
add
to
the
re-created
user
credential
during
failover
authentication.
Note:
The
maximum
size
of
a
failover
authentication
cookie
is
4
kilobytes
(4096
bytes)
Configuration
instructions:
v
“Add
the
authentication
level”
on
page
176
v
“Add
the
session
lifetime
timestamp”
on
page
176
v
“Add
the
session
activity
timestamp”
on
page
176
v
“Add
an
interval
for
updating
the
activity
timestamp”
on
page
177
v
“Add
extended
attributes”
on
page
177
Extraction
of
data
from
a
failover
cookie
When
a
failover
authentication
event
occurs,
WebSEAL
receives
a
failover
authentication
cookie
and
by
default
extracts
the
following
data
from
each
cookie:
v
User
name
v
Authentication
method
v
Cookie
creation
time
WebSEAL
first
determines
if
the
cookie
is
valid
by
subtracting
the
cookie
creation
time
from
the
system
time,
and
comparing
this
value
against
the
WebSEAL
configuration
file
entry
for
failover
cookie
lifetime.
If
the
cookie
lifetime
has
been
exceeded,
the
cookie
is
not
valid,
and
failover
authentication
is
not
attempted.
If
the
cookie
lifetime
has
not
been
exceeded,
WebSEAL
uses
the
user
name
and
authentication
method
to
authenticate
the
user
and
build
a
user
credential.
WebSEAL
next
checks
configuration
settings
to
determine
if
additional
cookie
data
should
be
extracted
and
evaluated.
Note
that
the
WebSEAL
server
does
not
by
default
extract
any
other
attributes
from
the
failover
authentication
cookie.
Each
additional
attribute
to
be
extracted
must
be
specified
in
the
WebSEAL
configuration
file.
Wildcard
pattern
matching
can
be
used
to
obtain
groups
of
attributes.
WebSEAL
can
be
configured
to
extract
the
following
defined
attributes:
v
Authentication
level
When
this
value
is
extracted,
WebSEAL
uses
it
to
ensure
that
the
user
is
authenticated
with
the
authentication
method
necessary
to
maintain
the
specified
authentication
level.
Note
that
WebSEAL
can
obtain
authentication
levels
from
several
different
places:
–
Failover
cookie
–
Failover
authentication
library
–
Cross-domain
authentication
service
170
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide