IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
–<br />
Entitlements<br />
service<br />
The<br />
authentication<br />
level<br />
extracted<br />
from<br />
the<br />
failover<br />
cookie<br />
takes<br />
precedence<br />
over<br />
levels<br />
obtained<br />
from<br />
the<br />
other<br />
places.<br />
v<br />
Session<br />
lifetime<br />
timestamp<br />
<strong>WebSEAL</strong><br />
can<br />
use<br />
this<br />
timestamp<br />
to<br />
determine<br />
if<br />
the<br />
user’s<br />
entry<br />
in<br />
the<br />
original<br />
server’s<br />
session<br />
cache<br />
would<br />
have<br />
expired.<br />
If<br />
it<br />
would<br />
have,<br />
<strong>WebSEAL</strong><br />
discards<br />
the<br />
cookie<br />
and<br />
all<br />
its<br />
potential<br />
credential<br />
attributes.<br />
The<br />
session<br />
lifetime<br />
is<br />
not<br />
preserved,<br />
and<br />
the<br />
user<br />
is<br />
prompted<br />
to<br />
log<br />
in.<br />
v<br />
Session<br />
inactivity<br />
timestamp<br />
<strong>WebSEAL</strong><br />
can<br />
use<br />
this<br />
timestamp<br />
to<br />
determine<br />
if<br />
the<br />
user’s<br />
entry<br />
in<br />
the<br />
original<br />
server’s<br />
session<br />
cache<br />
would<br />
have<br />
been<br />
inactive<br />
<strong>for</strong><br />
too<br />
long.<br />
If<br />
it<br />
would<br />
have,<br />
<strong>WebSEAL</strong><br />
discards<br />
the<br />
cookie<br />
and<br />
all<br />
its<br />
potential<br />
credential<br />
attributes.<br />
The<br />
session<br />
lifetime<br />
is<br />
not<br />
preserved,<br />
and<br />
the<br />
user<br />
is<br />
prompted<br />
to<br />
log<br />
in.<br />
Note:<br />
Successful<br />
use<br />
of<br />
these<br />
timestamps<br />
requires<br />
synchronization<br />
of<br />
clocks<br />
between<br />
replicated<br />
<strong>WebSEAL</strong><br />
servers.<br />
If<br />
clock<br />
skew<br />
becomes<br />
great,<br />
sessions<br />
will<br />
expire<br />
or<br />
become<br />
inactive<br />
at<br />
unintended<br />
times.<br />
v<br />
Additional<br />
extended<br />
attributes<br />
These<br />
include<br />
user-defined<br />
customized<br />
attributes,<br />
such<br />
as<br />
those<br />
generated<br />
by<br />
cross-domain<br />
authentication<br />
services.<br />
<strong>WebSEAL</strong><br />
adds<br />
the<br />
attributes<br />
to<br />
the<br />
user<br />
credential.<br />
Attributes<br />
that<br />
are<br />
not<br />
specified<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file<br />
will<br />
be<br />
ignored<br />
and<br />
not<br />
extracted.<br />
In<br />
addition,<br />
administrators<br />
can<br />
specify<br />
that<br />
certain<br />
attributes<br />
must<br />
be<br />
ignored<br />
during<br />
failover<br />
cookie<br />
extraction.<br />
Although<br />
ignore<br />
is<br />
the<br />
default<br />
behavior,<br />
this<br />
specification<br />
can<br />
be<br />
useful,<br />
<strong>for</strong><br />
example,<br />
to<br />
ensure<br />
that<br />
user<br />
attributes<br />
are<br />
obtained<br />
from<br />
the<br />
user<br />
registry<br />
instead<br />
of<br />
from<br />
the<br />
failover<br />
cookie.<br />
Configuration<br />
instructions:<br />
v<br />
“Extraction<br />
of<br />
data<br />
from<br />
a<br />
failover<br />
cookie”<br />
on<br />
page<br />
170<br />
Domain-wide<br />
failover<br />
authentication<br />
<strong>WebSEAL</strong><br />
supports<br />
an<br />
optional<br />
configuration<br />
that<br />
enables<br />
failover<br />
authentication<br />
cookies<br />
to<br />
be<br />
marked<br />
as<br />
available<br />
<strong>for</strong><br />
use<br />
during<br />
failover<br />
authentication<br />
to<br />
any<br />
and<br />
all<br />
other<br />
<strong>WebSEAL</strong><br />
servers<br />
in<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
domain.<br />
This<br />
configuration<br />
option<br />
enables<br />
failover<br />
authentication<br />
cookies<br />
to<br />
be<br />
used<br />
in<br />
deployments<br />
that<br />
do<br />
not<br />
necessarily<br />
have<br />
a<br />
load<br />
balancer<br />
and<br />
replicated<br />
<strong>WebSEAL</strong><br />
servers.<br />
When<br />
a<br />
client<br />
session<br />
goes<br />
through<br />
a<br />
failover<br />
authentication<br />
event<br />
to<br />
a<br />
replicated<br />
<strong>WebSEAL</strong><br />
server,<br />
the<br />
client<br />
continues<br />
to<br />
access<br />
the<br />
same<br />
set<br />
of<br />
protected<br />
resources.<br />
When<br />
a<br />
client<br />
session<br />
goes<br />
through<br />
a<br />
failover<br />
authentication<br />
event<br />
to<br />
a<br />
<strong>WebSEAL</strong><br />
server<br />
that<br />
is<br />
not<br />
replicated,<br />
it<br />
is<br />
possible<br />
that<br />
a<br />
different<br />
set<br />
of<br />
resources<br />
will<br />
be<br />
available<br />
to<br />
the<br />
client.<br />
In<br />
large<br />
deployments,<br />
this<br />
partitioning<br />
of<br />
resources<br />
within<br />
the<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
domain<br />
is<br />
common.<br />
This<br />
partitioning<br />
can<br />
be<br />
done<br />
<strong>for</strong><br />
per<strong>for</strong>mance<br />
reasons<br />
and<br />
<strong>for</strong><br />
administrative<br />
purposes.<br />
Domain-wide<br />
failover<br />
authentication<br />
can<br />
be<br />
used<br />
to<br />
redirect<br />
a<br />
client<br />
to<br />
another<br />
<strong>WebSEAL</strong><br />
server<br />
at<br />
a<br />
time<br />
when<br />
the<br />
client’s<br />
requests<br />
have<br />
led<br />
it<br />
to<br />
request<br />
a<br />
resource<br />
that<br />
is<br />
not<br />
available<br />
through<br />
the<br />
local<br />
<strong>WebSEAL</strong><br />
server.<br />
In<br />
this<br />
case,<br />
the<br />
client<br />
(browser)<br />
is<br />
redirected<br />
to<br />
another<br />
<strong>WebSEAL</strong><br />
server.<br />
The<br />
receiving<br />
<strong>WebSEAL</strong><br />
server<br />
can<br />
be<br />
configured<br />
to<br />
look<br />
<strong>for</strong><br />
failover<br />
authentication<br />
cookies.<br />
The<br />
<strong>WebSEAL</strong><br />
server<br />
attempts<br />
to<br />
authenticate<br />
the<br />
client<br />
and<br />
recognizes<br />
the<br />
failover<br />
authentication<br />
Chapter<br />
6.<br />
Authentication<br />
171