IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

methods,
insert
the
name
of
the
custom
CDAS
as
the
value
for
the
configuration
file
keyword.
For
example,
if
you
developed
a
custom
CDAS
for
forms
authentication,
enter
the
absolute
path
name:
[authentication-mechanisms]
failover-password
=
/dir_name/custom_cdas_failover_library.so
Create
an
encryption
key
for
cookie
data
Use
the
cdsso_key_gen
utility
to
secure
the
cookie
data.
WebSEAL
provides
this
utility.
This
utility
generates
a
symmetric
key
that
encrypts
and
decrypts
the
data
in
the
cookie.
Attention:
If
you
do
not
configure
WebSEAL
to
encrypt
failover
authentication
cookies,
and
you
have
enabled
failover
authentication,
WebSEAL
will
generate
an
error
and
refuse
to
start.
Failover
authentication
cookies
must
be
encrypted.
1.
Run
the
utility
on
one
of
the
replicated
servers.
From
a
command
line,
specify
the
location
of
the
key
file
you
want
to
create.
You
must
specify
an
absolute
path
name.
For
example:
UNIX:
/opt/pdweb/bin/cdsso_key_gen
absolute_pathname_for_keyfile
Windows:
C:\Program
Files\Tivoli\PDWeb\bin\cdsso_key_gen
absolute_pathname_for_keyfile
You
can
give
the
key
file
any
appropriate
name,
such
as
/opt/pdweb/lib/ws.key.
2.
Edit
the
WebSEAL
configuration
file.
In
the
[failover]
stanza,
specify
the
keyfile
location.
[failover]
failover-cookies-keyfile
=
absolute_pathname_for_keyfile
3.
Manually
copy
the
key
file
to
each
of
the
remaining
replicated
servers.
4.
On
each
replicated
server,
edit
the
WebSEAL
configuration
file
to
supply
the
correct
path
name
to
failover-cookies-keyfile
in
the
[failover]
stanza.
Specify
the
cookie
lifetime
Edit
the
WebSEAL
configuration
file.
Specify
the
valid
lifetime
for
the
failover
cookie.
[failover]
failover-cookie-lifetime
=
60
The
default
lifetime
is
60
minutes.
Specify
UTF-8
encoding
on
cookie
strings
Edit
the
WebSEAL
configuration
file.
Specify
whether
or
not
WebSEAL
should
use
UTF-8
encoding
on
strings
within
the
failover
cookies.
[failover]
use-utf8
=
yes
The
default
value
is
yes.
UTF-8
should
be
used
when
user
names
or
credential
attributes
in
the
cookie
are
not
encoded
in
the
same
code
page
as
the
one
that
the
WebSEAL
server
is
using.
By
default,
WebSEAL
servers
use
UTF-8
encoding.
When
all
WebSEAL
servers
in
the
WebSEAL
deployment
use
UTF-8
encoding,
leave
this
value
at
the
default
setting
of
yes.
Chapter
6.
Authentication
175