IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
The
client
cannot
use
an
SSL
session
ID
as
the
session
data
type.
v
As
an
example,
if
the
MPA
uses
a
BA
header
for
the
session
data
type,
the
client’s
choices
for
session
data
type
include
only
HTTP
header
and
cookie.
v
If
the
MPA
uses
an
HTTP
header
for
session
data,
the
client
can
use
a
different
HTTP
header
type.
v
The
server-specific
cookie
contains
session
information
only;
it
does
not
contain
identity
information.
v
If
MPA
support
is
enabled,
the
function
of
ssl-id-sessions
changes.
Normally,
if
ssl-id-sessions
=
yes,
only
the
SSL
session
ID
is
used
to
maintain
sessions
for
HTTPS
clients.
To
allow
the
MPA
to
maintain
a
session
with
an
SSL
session
ID
and
have
clients
maintain
sessions
using
another
method,
this
restriction
is
removed.
See
also
“Determining
valid
session
ID
data
types”
on
page
138.
The
authentication
method
used
by
the
MPA
to
WebSEAL
must
be
distinct
(different)
from
the
authentication
method
used
by
the
client
to
WebSEAL.
The
table
below
lists
the
valid
authentication
methods
for
the
MPA
and
the
client:
Valid
Authentication
Types
MPA-to-WebSEAL
Client-to-WebSEAL
Basic
authentication
Basic
authentication
Forms
Forms
Token
Token
HTTP
Header
HTTP
Header
Certificate
IP
Address
v
As
an
example,
if
the
MPA
uses
basic
authentication,
the
client’s
choices
for
authentication
methods
includes
forms,
token,
and
HTTP
header.
v
Certificates
and
IP
address
authentication
methods
are
not
valid
for
use
by
the
client.
v
Normally,
if
either
forms
(or
token)
authentication
is
enabled
for
a
particular
transport,
basic
authentication
is
automatically
disabled
for
that
transport
(see
“Configuring
the
basic
authentication
mechanism”
on
page
145.
If
MPA
support
is
enabled,
this
restriction
is
removed.
This
allows
the
MPA
to
log
in,
for
example,
with
forms
(or
token)
and
clients
to
log
in
with
basic
authentication
over
the
same
transport.
Authentication
process
flow
for
MPA
and
multiple
clients
1.
The
WebSEAL
administrator
performs
the
following
preliminary
configuration:
v
Enable
support
for
Multiplexing
Proxy
Agents
v
Create
a
Tivoli
Access
Manager
account
for
the
specific
MPA
gateway
v
Add
this
MPA
account
to
the
webseal-mpa-servers
group
2.
Clients
connect
to
the
MPA
gateway.
3.
The
gateway
translates
the
request
to
an
HTTP
request.
4.
The
gateway
authenticates
the
client.
5.
The
gateway
establishes
a
connection
with
WebSEAL
with
the
client
request.
184
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide