IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Switch
user
authentication
The
WebSEAL
switch
user
function
allows
administrators
to
assume
the
identity
of
a
user
who
is
a
member
of
the
Tivoli
Access
Manager
secure
domain.
The
ability
to
assume
a
user’s
identity
can
help
an
administrator
in
a
Help
Desk
environment
to
troubleshoot
and
diagnose
problems.
Switch
user
can
also
be
used
to
test
a
user’s
access
to
resources
and
to
perform
application
integration
testing.
Read
this
entire
section
to
ensure
that
you
understand
the
switch
user
function
before
configuring
and
using
it.
This
section
contains
the
following
topics:
v
“Overview
of
the
switch
user
function”
v
“Configuration
procedure”
on
page
190
v
“Using
switch
user”
on
page
195
v
“Developing
a
custom
authentication
module
for
switch
user”
on
page
197
Overview
of
the
switch
user
function
The
switch
user
implementation
is
similar
to
the
su
command
in
UNIX
environments.
In
the
WebSEAL
environment,
the
administrator
acquires
the
user’s
credentials
and
interacts
with
resources
and
back-end
applications
with
the
exact
same
abilities
as
the
actual
user.
The
administrator
uses
a
special
HTML
form
to
supply
switch
user
information.
WebSEAL
processes
the
form
and
activates
a
special
authentication
mechanism
that
returns
the
specified
user’s
credential
without
the
requirement
of
knowing
the
user’s
password.
The
following
sequence
describes
the
switch
user
process
flow:
1.
An
administrator
authenticates
to
WebSEAL.
WebSEAL
establishes
a
session
for
the
administrator,
and
creates
an
entry
for
the
administrator
in
the
WebSEAL
session
cache.
The
session
cache
entry
contains
a
cache
data
structure.
This
data
structure
stores
the
administrator’s
credential.
During
the
switch
user
process
flow,
the
cache
data
will
be
manipulated.
For
more
information
on
WebSEAL
session
caches,
see
“The
WebSEAL
session/credentials
cache
structure”
on
page
10.
2.
The
administrator
connects
to
a
pre-configured
switch
user
HTML
form,
and
completes
the
form.
On
the
form,
the
administrator
specifies:
v
The
name
of
the
user
identity
that
the
administrator
needs
to
assume.
v
A
destination
URL.
v
An
authentication
method.
This
action
results
in
a
POST
request
being
sent
to
/pkmssu.form.
The
WebSEAL
administrator
can
optionally
modify
the
contents
of
the
switch
user
HTML
form
before
making
it
available
for
use
by
other
administrators.
See
“Part
3:
Configuring
the
switch
user
HTML
form”
on
page
193.
The
administrator
can
also
optionally
extend
the
capabilities
of
the
form.
See
“Part
4:
Designing
additional
input
forms”
on
page
195.
3.
WebSEAL
determines
whether
to
grant
the
switch
user
request
by
performing
the
following
checks:
a.
WebSEAL
examines
the
membership
of
the
Tivoli
Access
Manager
su-admins
group
to
determine
if
the
administrator
has
permission
to
invoke
the
switch
user
function.
188
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide