IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
configuration
file
entries
are:
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
&
-cfgfile
[/opt/pdweb/etc/webseald-instance_name.conf]
cert-ssl
=
/opt/PolicyDirector/lib/libsslauthn.so
To
enable
switch
user
authentication
mechanisms
for
both
of
these
authentication
methods,
complete
the
following
steps:
1.
Make
a
copy
of
the
switch
user
shared
library
for
each
authentication
mechanism.
The
administrator
can
choose
any
name
for
each
copy,
as
long
as
each
copy
is
uniquely
named.
For
example,
to
support
switch
user
for
both
forms
authentication
and
certificate
authentication:
#
cp
libsuauthn.so
libsuformauthn.so
#
cp
libsuauthn.so
libsucert.so
2.
Edit
the
appropriate
entries
in
the
WebSEAL
configuration
file.
Remove
the
comment
character
(#)
at
the
start
of
the
entry
for
each
supported
switch
user
authentication
mechanism.
3.
For
each
uncommented
entry,
enter
the
name
of
the
uniquely-named
copy
of
the
switch
user
authentication
library.
The
updated
configuration
file
entries
for
the
example
above
are:
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
&
-cfgfile
[/opt/pdweb/etc/webseald-instance_name.conf]
cert-ssl
=
/opt/pdwebrte/lib/libsslauthn.so
&
-cfgfile
[/opt/pdweb/etc/webseald-instance_name.conf]
su-password
=
/opt/pdwebrte/lib/libsuformauthn.so
su-certificate
=
/opt/pdwebrte/lib/libsucert.so
The
environment
is
now
expanded
to
support
switch
user
functionality
for
both
authentication
methods.
Note:
If
your
environment
includes
a
custom
CDAS
authentication
mechanism,
you
must
provide
the
same
functionality.
See
“Developing
a
custom
authentication
module
for
switch
user”
on
page
197.
Part
3:
Configuring
the
switch
user
HTML
form
This
part
is
optional.
WebSEAL
provides
a
default
HTML
form
that
the
administrator
accesses
in
order
to
use
the
switch
user
function.
The
default
form
can
be
used
without
modification.
Optionally,
the
form
can
be
edited
for
customized
appearance
and
functionality.
The
default
form
is
named
switchuser.html.
The
name
of
this
file
can
be
modified.
Form
contents
and
location
The
form
contains
requests
for:
v
User
name
The
name
of
the
user
whose
credentials
the
administrator
wants
to
access.
v
Destination
URL
This
page
appears
after
a
successful
switch
user
operation.
v
Authentication
method
Chapter
7.
Advanced
WebSEAL
authentication
193