IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

9.
The
administrator
ends
the
switch
user
session
using
the
standard
Tivoli
Access
Manager
/pkmslogout
utility.
Upon
successful
log
out:
a.
The
user’s
cache
data
is
deleted.
b.
The
administrator’s
original
cache
data
(and
credential)
is
restored.
c.
The
administrator
is
returned
to
the
original
page
from
which
the
switch
user
form
was
requested.
The
authorization
service
uses
the
original
credential
of
the
administrator
for
all
subsequent
requests.
Configuration
procedure
The
WebSEAL
administrator
must
complete
several
configuration
steps
before
administrators
can
use
the
switch
user
functionality.
To
configure
switch
user,
complete
the
instructions
in
each
of
the
following
sections:
1.
“Part
1:
Configuring
user
access”
2.
“Part
2:
Configuring
switch
user
authentication
mechanisms”
on
page
191
3.
“Part
3:
Configuring
the
switch
user
HTML
form”
on
page
193
This
part
is
optional.
4.
“Part
4:
Designing
additional
input
forms”
on
page
195
This
part
is
optional.
5.
“Part
5:
Stopping
and
restarting
WebSEAL”
on
page
195
Part
1:
Configuring
user
access
During
WebSEAL
installation,
the
WebSEAL
configuration
process
automatically
creates
several
groups
for
use
by
the
switch
user
functionality.
The
WebSEAL
administrator
controls
switch
user
capability
by
adding
users
to
the
groups.
To
configure
user
access,
complete
the
following
steps:
1.
Add
users
to
the
su-admins
group.
To
use
switch
user
function,
a
user
must
be
a
member
of
a
special
administrative
group
called
su-admins.
This
group
is
automatically
created
by
default
during
installation
of
a
WebSEAL
server.
There
are
no
users
in
this
group
by
default.
The
WebSEAL
administrator
must
manually
add
users
to
this
group.
Typically,
only
administrative
users
are
added
to
this
group.
Users
who
have
been
granted
membership
in
su-admins
can
switch
user
to
most
other
user
identities,
but
cannot
switch
to
the
identity
of
any
other
user
that
is
also
a
member
of
the
su-admins
group
.
Thus,
once
an
administrator
is
granted
switch
user
privileges
by
being
added
to
su-admins,
the
administrator’s
account
is
protected
from
access
by
any
other
user
that
gains
switch
user
privileges.
2.
Add
users
to
the
su-excluded
group
This
group
contains
the
names
of
users
whose
identities
should
not
be
accessed
through
the
switch
user
capability.
During
WebSEAL
installation,
the
WebSEAL
configuration
process
automatically
creates
this
group.
There
are
no
users
in
this
group
by
default.
WebSEAL
administrator
typically
add
to
this
group
the
names
of
users
who
are
not
members
of
the
administrative
group
su-admins,
but
for
whom
switch
user
access
should
still
be
blocked
When
switch
user
is
used,
WebSEAL
also
checks
the
memberships
of
the
Tivoli
Access
Manager
group
called
securitygroup.
This
group
contains
the
name
of
the
Tivoli
Access
Manager
administrative
user
sec_master,
plus
a
number
of
WebSEAL
processes
that
must
be
excluded
from
access
through
switch
user
capability.
190
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide