IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Administrators
requesting
use
of
switch
user
authentication
must
be
members
of
the
su-admins
group.
Membership
in
this
group
must
be
configured
before
switch
user
can
be
used.
For
more
information,
see
“Part
1:
Configuring
user
access”
on
page
190.
b.
WebSEAL
examines
the
membership
of
the
Tivoli
Access
Manager
su-admins,
securitygroup
and
su-excluded
groups
to
ensure
the
user
identity
supplied
in
the
switch
user
form
is
not
a
member
of
one
of
these
groups.
User
identities
that
belong
to
any
of
these
groups
cannot
be
accessed
by
the
switch
user
function.
The
WebSEAL
administrator
must
configure
memberships
in
these
groups
before
administrators
use
the
switch
user
function.
For
configuration
instructions
and
more
information
on
these
groups,
see
“Part
1:
Configuring
user
access”
on
page
190
4.
When
access
to
the
switch
user
function
has
been
granted,
WebSEAL
calls
the
appropriate
switch
user
shared
library
to
perform
the
special
switch
user
authentication.
WebSEAL
supports
a
number
of
different
authentication
mechanisms.
Each
authentication
mechanism
has
a
corresponding
switch
user
authentication
mechanism.
WebSEAL
provides
shared
libraries
that
contain
the
special
switch
user
mechanisms.
Before
switch
user
authentication
can
be
used,
the
WebSEAL
administrator
must
configure
WebSEAL
to
use
the
necessary
shared
libraries.
For
more
information,
see
“Part
2:
Configuring
switch
user
authentication
mechanisms”
on
page
191.
Note:
Switch
user
authentication
can
also
be
performed
by
a
custom
switch
user
CDAS
library.
For
more
information,
see
“Developing
a
custom
authentication
module
for
switch
user”
on
page
197.
5.
When
authentication
of
the
designated
user
succeeds,
the
switch
user
authentication
mechanism
returns
a
valid
credential
for
the
user
—
without
requiring
the
user
password
for
input.
6.
WebSEAL
manipulates
the
contents
of
the
appropriate
entry
in
the
WebSEAL
session
cache
by:
a.
Placing
the
user’s
credential
into
a
new
cache
data
structure.
b.
Removing
the
administrator’s
WebSEAL
session
cache
data
and
storing
it
in
a
separate
location.
c.
Inserting
the
user
cache
data,
including
the
user’s
credential,
in
place
of
the
administrator’s
cache
data.
7.
WebSEAL
sends
a
redirect
to
the
browser
for
the
destination
URL
supplied
in
the
switch
user
form.
The
request
is
processed
normally,
using
the
user’s
credential,
and
the
URL
is
accessed.
8.
The
administrator
can
continue
to
make
other
requests.
All
authorization
decisions
for
these
requests
are
based
on
the
credential
of
the
user.
When
using
switch
user
functionality,
administrators
might
need
to
establish
and
manage
sessions
with
additional
applications.
These
sessions
need
to
be
established
using
the
identity
of
the
new
user.
To
enable
this,
the
new
user
credential
also
contains
a
new
User
Session
ID.
This
User
Session
ID
is
used,
for
example,
when
troubleshooting
the
user’s
ability
to
access
and
use
additional
Web
resources.
For
more
information
on
WebSEAL
session
caches,
see
“GSKit
and
WebSEAL
session
cache
overview”
on
page
132
and
“The
WebSEAL
session/credentials
cache
structure”
on
page
10.
Chapter
7.
Advanced
WebSEAL
authentication
189