IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

–
Entitlements
service
The
authentication
level
extracted
from
the
failover
cookie
takes
precedence
over
levels
obtained
from
the
other
places.
v
Session
lifetime
timestamp
WebSEAL
can
use
this
timestamp
to
determine
if
the
user’s
entry
in
the
original
server’s
session
cache
would
have
expired.
If
it
would
have,
WebSEAL
discards
the
cookie
and
all
its
potential
credential
attributes.
The
session
lifetime
is
not
preserved,
and
the
user
is
prompted
to
log
in.
v
Session
inactivity
timestamp
WebSEAL
can
use
this
timestamp
to
determine
if
the
user’s
entry
in
the
original
server’s
session
cache
would
have
been
inactive
for
too
long.
If
it
would
have,
WebSEAL
discards
the
cookie
and
all
its
potential
credential
attributes.
The
session
lifetime
is
not
preserved,
and
the
user
is
prompted
to
log
in.
Note:
Successful
use
of
these
timestamps
requires
synchronization
of
clocks
between
replicated
WebSEAL
servers.
If
clock
skew
becomes
great,
sessions
will
expire
or
become
inactive
at
unintended
times.
v
Additional
extended
attributes
These
include
user-defined
customized
attributes,
such
as
those
generated
by
cross-domain
authentication
services.
WebSEAL
adds
the
attributes
to
the
user
credential.
Attributes
that
are
not
specified
in
the
WebSEAL
configuration
file
will
be
ignored
and
not
extracted.
In
addition,
administrators
can
specify
that
certain
attributes
must
be
ignored
during
failover
cookie
extraction.
Although
ignore
is
the
default
behavior,
this
specification
can
be
useful,
for
example,
to
ensure
that
user
attributes
are
obtained
from
the
user
registry
instead
of
from
the
failover
cookie.
Configuration
instructions:
v
“Extraction
of
data
from
a
failover
cookie”
on
page
170
Domain-wide
failover
authentication
WebSEAL
supports
an
optional
configuration
that
enables
failover
authentication
cookies
to
be
marked
as
available
for
use
during
failover
authentication
to
any
and
all
other
WebSEAL
servers
in
the
Tivoli
Access
Manager
domain.
This
configuration
option
enables
failover
authentication
cookies
to
be
used
in
deployments
that
do
not
necessarily
have
a
load
balancer
and
replicated
WebSEAL
servers.
When
a
client
session
goes
through
a
failover
authentication
event
to
a
replicated
WebSEAL
server,
the
client
continues
to
access
the
same
set
of
protected
resources.
When
a
client
session
goes
through
a
failover
authentication
event
to
a
WebSEAL
server
that
is
not
replicated,
it
is
possible
that
a
different
set
of
resources
will
be
available
to
the
client.
In
large
deployments,
this
partitioning
of
resources
within
the
Tivoli
Access
Manager
domain
is
common.
This
partitioning
can
be
done
for
performance
reasons
and
for
administrative
purposes.
Domain-wide
failover
authentication
can
be
used
to
redirect
a
client
to
another
WebSEAL
server
at
a
time
when
the
client’s
requests
have
led
it
to
request
a
resource
that
is
not
available
through
the
local
WebSEAL
server.
In
this
case,
the
client
(browser)
is
redirected
to
another
WebSEAL
server.
The
receiving
WebSEAL
server
can
be
configured
to
look
for
failover
authentication
cookies.
The
WebSEAL
server
attempts
to
authenticate
the
client
and
recognizes
the
failover
authentication
Chapter
6.
Authentication
171