IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
cookie.<br />
By<br />
using<br />
the<br />
cookie,<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
does<br />
not<br />
need<br />
to<br />
prompt<br />
the<br />
client<br />
<strong>for</strong><br />
login<br />
in<strong>for</strong>mation,<br />
but<br />
instead<br />
can<br />
establish<br />
a<br />
session<br />
with<br />
the<br />
client<br />
and<br />
construct<br />
a<br />
valid<br />
set<br />
of<br />
user<br />
credentials.<br />
Configuration<br />
instructions:<br />
v<br />
“Enable<br />
domain-wide<br />
failover<br />
cookies”<br />
on<br />
page<br />
179<br />
Backwards<br />
compatibility<br />
Failover<br />
cookies<br />
generated<br />
by<br />
Version<br />
5.1<br />
<strong>WebSEAL</strong><br />
servers<br />
can<br />
be<br />
understood<br />
and<br />
read<br />
(consumed)<br />
by<br />
<strong>WebSEAL</strong><br />
servers<br />
from<br />
versions<br />
prior<br />
to<br />
Version<br />
5.1<br />
.<br />
Likewise,<br />
failover<br />
cookies<br />
generated<br />
by<br />
older<br />
(pre-Version<br />
5.1)<br />
<strong>WebSEAL</strong><br />
servers<br />
can<br />
be<br />
understood<br />
and<br />
read<br />
(consumed)<br />
by<br />
Version<br />
5.1<br />
<strong>WebSEAL</strong><br />
servers.<br />
CDAS<br />
modules<br />
written<br />
to<br />
customize<br />
failover<br />
cookies<br />
<strong>for</strong><br />
older<br />
(pre-Version<br />
5.1)<br />
<strong>WebSEAL</strong><br />
servers<br />
will<br />
work<br />
with<br />
Version<br />
5.1<br />
<strong>WebSEAL</strong><br />
servers.<br />
To<br />
ensure<br />
complete<br />
backwards<br />
compatibility,<br />
the<br />
following<br />
features<br />
are<br />
provided:<br />
v<br />
<strong>WebSEAL</strong><br />
can<br />
be<br />
configured<br />
to<br />
authenticate<br />
a<br />
user<br />
based<br />
on<br />
failover<br />
cookie<br />
contents<br />
when<br />
the<br />
session<br />
lifetime<br />
timestamp<br />
is<br />
not<br />
present.<br />
The<br />
session<br />
lifetime<br />
timestamp<br />
is<br />
not<br />
present<br />
in<br />
failover<br />
authentication<br />
cookies<br />
prior<br />
to<br />
Version<br />
5.1.<br />
v<br />
<strong>WebSEAL</strong><br />
can<br />
be<br />
configured<br />
to<br />
authenticate<br />
a<br />
user<br />
based<br />
on<br />
failover<br />
cookie<br />
contents<br />
when<br />
the<br />
session<br />
inactivity<br />
timestamp<br />
is<br />
not<br />
present.<br />
The<br />
session<br />
inactivity<br />
timestamp<br />
is<br />
not<br />
present<br />
in<br />
failover<br />
authentication<br />
cookies<br />
prior<br />
to<br />
Version<br />
5.1.<br />
v<br />
The<br />
algorithm<br />
used<br />
to<br />
encrypt<br />
client<br />
data<br />
in<br />
failover<br />
authentication<br />
cookies<br />
was<br />
updated<br />
<strong>for</strong><br />
Version<br />
4.1<br />
of<br />
<strong>WebSEAL</strong>.<br />
When<br />
using<br />
<strong>WebSEAL</strong><br />
servers<br />
with<br />
versions<br />
of<br />
<strong>WebSEAL</strong><br />
prior<br />
to<br />
Version<br />
4.1,<br />
a<br />
configuration<br />
file<br />
setting<br />
can<br />
be<br />
set<br />
to<br />
enable<br />
access<br />
to<br />
the<br />
older-style<br />
cookies.<br />
v<br />
<strong>WebSEAL</strong><br />
can<br />
be<br />
configured<br />
to<br />
not<br />
use<br />
UTF-8<br />
encoding<br />
on<br />
strings<br />
in<br />
the<br />
failover<br />
cookie.<br />
By<br />
not<br />
using<br />
UTF-8<br />
encoding<br />
<strong>for</strong><br />
cookies<br />
created<br />
on<br />
Version<br />
5.1<br />
<strong>WebSEAL</strong><br />
servers,<br />
the<br />
cookies<br />
can<br />
be<br />
understood<br />
and<br />
read<br />
(consumed)<br />
by<br />
older<br />
(pre-Version<br />
5.1)<br />
<strong>WebSEAL</strong><br />
servers.<br />
Configuration<br />
instructions:<br />
v<br />
“Require<br />
validation<br />
of<br />
a<br />
lifetime<br />
timestamp”<br />
on<br />
page<br />
179<br />
v<br />
“Require<br />
validation<br />
of<br />
an<br />
activity<br />
timestamp”<br />
on<br />
page<br />
180<br />
v<br />
“Enable<br />
backwards<br />
compatibility<br />
<strong>for</strong><br />
encryption<br />
prior<br />
to<br />
Version<br />
4.1”<br />
on<br />
page<br />
180<br />
v<br />
“Specify<br />
UTF-8<br />
encoding<br />
on<br />
cookie<br />
strings”<br />
on<br />
page<br />
175<br />
Upgrading<br />
failover<br />
authentication<br />
In<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file,<br />
the<br />
[failover-add-attributes]<br />
and<br />
[failover-restore-attributes]<br />
stanzas<br />
replace<br />
the<br />
pre-Version<br />
5.1<br />
stanza<br />
[failover-attributes].<br />
During<br />
an<br />
upgrade<br />
from<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
Version<br />
4.1<br />
to<br />
the<br />
current<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
version,<br />
the<br />
stanza<br />
[failover-attributes]<br />
and<br />
its<br />
contents<br />
are<br />
migrated<br />
to<br />
the<br />
[failover-add-attributes]<br />
stanza.<br />
The<br />
upgrade<br />
is<br />
automated,<br />
and<br />
takes<br />
place<br />
when<br />
<strong>WebSEAL</strong><br />
is<br />
installed.<br />
There<br />
is<br />
no<br />
need<br />
<strong>for</strong><br />
manual<br />
updating<br />
of<br />
these<br />
entries.<br />
172<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language