IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

supported
mechanism,
an
additional
step
is
required.
In
this
case,
additional
copies
of
the
default
switch
user
shared
library
must
be
made.
The
following
instructions
are
separated
into
two
parts.
The
first
part
describes
how
to
configure
a
single
switch
user
authentication
mechanism.
The
second
part
describes
how
to
configure
multiple
switch
user
authentication
mechanisms.
Use
the
instructions
that
are
appropriate
for
your
deployment.
Configuring
a
single
switch
user
authentication
mechanism
To
enable
a
single
switch
user
authentication
mechanism,
complete
the
following
steps:
1.
Edit
the
appropriate
entry
in
the
WebSEAL
configuration
file.
Remove
the
comment
character
(#)
at
the
start
of
the
line.
2.
Enter
the
name
of
the
switch
user
authentication
library.
For
example,
on
a
Solaris
system,
prior
to
the
configuration
of
switch
user,
the
configuration
file
for
a
WebSEAL
server
that
was
configured
to
support
only
password
authentication
would
contain
the
following
entries
(each
entry
is
one
continuous
line):
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
&
-cfgfile
[/opt/pdweb/etc/webseald-instance_name.conf]
.....
#su-password
=
#su-token-card
=
#su-certificate
=
#su-http-request
=
#su-cdsso
=
The
switch
user
library
specified
by
the
su-password
entry
corresponds
to
the
authentication
library
specified
by
passwd-ldap.
The
entry
shown
below
in
bold
font
shows
the
modified
entry
(entered
as
one
continuous
command
line):
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
&
-cfgfile
[/opt/pdweb/etc/webseald-instance_name.conf]
.....
su-password
=
/opt/pdwebrte/lib/libsuauthn.so
#su-token-card
=
#su-certificate
=
#su-http-request
=
#su-cdsso
=
Configuring
multiple
switch
user
authentication
mechanisms
The
default
switch
user
shared
library,
libsuauthn
(UNIX)
or
suauthn
(Windows)
supports
multiple
authentication
mechanisms.
In
the
configuration
file,
however,
each
entry
for
a
configured
switch
user
authentication
library
must
be
uniquely
named,
even
though
the
same
shared
library
is
used
for
multiple
authentication
methods.
In
the
following
example,
for
a
Solaris
platform,
an
existing
environment
has
two
authentication
methods
enabled:
v
Forms
authentication
using
the
built-in
libldapauthn
library
v
Certificate
authentication
using
the
built-in
libsslauthn
library
192
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide