IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

6.
The
MPA
authenticates
to
WebSEAL
(using
a
method
distinct
from
the
client)
and
an
identity
is
derived
for
the
MPA
(which
already
has
a
WebSEAL
account).
7.
WebSEAL
verifies
the
MPA’s
membership
in
the
webseal-mpa-servers
group.
8.
A
credential
is
built
for
the
MPA
and
flagged
as
a
special
MPA
type
in
the
cache.
Although
this
MPA
credential
accompanies
each
future
client
request,
it
is
not
used
for
authorization
checks
on
these
requests.
9.
Now
WebSEAL
needs
to
further
identify
the
owner
of
the
request.
The
MPA
is
able
to
distinguish
the
multiple
clients
for
proper
routing
of
login
prompts.
10.
The
client
logs
in
and
authenticates
using
a
method
distinct
from
the
authentication
type
used
for
the
MPA.
11.
WebSEAL
builds
a
credential
from
the
client
authentication
data.
12.
Session
data
type
used
by
each
client
must
be
distinct
from
the
session
data
type
used
by
the
MPA.
13.
The
authorization
service
permits
or
denies
access
to
protected
objects
based
on
the
user
credential
and
the
object’s
ACL
permissions.
Enabling
and
disabling
MPA
authentication
The
mpa
parameter,
located
in
the
[mpa]
stanza
of
the
WebSEAL
configuration
file,
enables
and
disables
MPA
authentication:
v
To
enable
the
MPA
authentication
method,
enter
″yes″.
v
To
disable
the
MPA
authentication
method,
enter
″no″.
For
example:
[mpa]
mpa
=
yes
Create
a
user
account
for
the
MPA
Refer
to
the
IBM
Tivoli
Access
Manager
Base
Administrator’s
Guide
for
information
on
creating
user
accounts.
Add
the
MPA
account
to
the
webseal-mpa-servers
group
Refer
to
the
IBM
Tivoli
Access
Manager
Base
Administrator’s
Guide
for
information
on
managing
groups.
MPA
authentication
limitations
v
This
release
of
Tivoli
Access
Manager
supports
only
one
MPA
per
WebSEAL
server.
v
MPA
authentication
is
not
supported
with
step-up
authentication
configuration.
v
MPA
is
not
supported
with
use-same-session
=
yes
Chapter
6.
Authentication
185