IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[failover-add-attributes]
attribute_pattern
=
add
The
attribute_pattern
can
be
either
a
specific
attribute
name,
or
a
case-insensitive
wildcard
expression
that
matches
more
than
one
attribute
name.
For
example,
to
specify
all
attributes
with
the
prefix
tagvalue_,
add
the
following
entry:
[failover-add-attributes]
tagvalue_*
=
add
The
order
of
the
stanza
entries
is
important.
Rules
that
appear
earlier
in
[failover-add-attributes]
take
priority
over
those
placed
later
in
the
stanza.
Attributes
that
do
not
match
any
of
the
wildcard
patterns,
or
are
not
explicitly
specified,
are
not
added
to
the
failover
cookie.
Specify
the
authentication
level
attribute
after
failover
authentication
When
a
failover
cookie
is
used
to
authenticate,
an
authentication
level
can
be
associated
with
the
generated
credential.
This
can
be
done
in
the
following
ways:
v
Using
a
flag
to
the
failover-*
authentication
mechanism.
You
can
set
the
authentication
level
based
on
the
last
authentication
method
used.
This
is
done
by
passing
a
flag
to
the
authentication
method.
The
syntax
is:
[authentication-mechanisms]
failover-method_name
=
WebSEAL_failover_lib
-i
authentication_level
For
example:
failover-password
=
/opt/pdweb/liblibfailoverauth.so&
-i
1
failover-token
=
/opt/pdweb/liblibfailoverauth.so&
-i
2
failover-certificate
=
/opt/pdweb/liblibfailoverauth.so&
-i
3
Note:
This
method
can
be
used
only
with
the
built-in
WebSEAL
failover
authentication
library.
This
method
is
not
available
to
custom
authentication
modules.
v
Setting
it
in
the
[failover-restore-attributes]
configuration
file
stanza
entry.
This
attribute
can
specify
whether
to
use
the
authentication
level
from
the
failover
cookie,
if
it
exists:
[failover-restore-attributes]
AUTHENTICATION_LEVEL
=preserve
Specify
attributes
for
extraction
WebSEAL
can
optionally
be
configured
to
extract
attributes
from
a
failover
authentication
cookie
and
place
them
into
a
user
credential.
No
attributes
are
configured
for
extraction
by
default.
Attributes
to
be
extracted
are
declared
in
the
[failover-restore-attributes]
stanza
in
the
WebSEAL
configuration
file.
The
syntax
is:
[failover-restore-attributes]
attribute_pattern
=
{preserve|refresh}
The
value
preserve
tells
WebSEAL
to
extract
the
attribute
and
add
it
to
the
credential.
The
value
refresh
tells
WebSEAL
to
ignore
the
attribute,
and
not
extract
it
from
the
cookie.
178
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide