IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

su-ba
su-forms
su-certificate
su-token-card
su-http-request
su-cdsso
The
methods
in
the
list
above
map
directly
to
authentication
mechanisms
specified
in
the
WebSEAL
configuration
file.
Note,
however,
that
the
su-ba
and
su-forms
methods
both
map
to
the
su-password
authentication
mechanism.
Both
basic
authentication
(ba)
and
forms
authentication
(forms)
use
the
su-password
authentication
library.
Note
that
a
WebSEAL
deployment
can
support
basic
authentication
without
supporting
forms
authentication.
Thus
separate
configuration
values
are
maintained
for
each
authentication
type
(su-ba
and
su-forms).
Part
4:
Designing
additional
input
forms
This
part
is
optional.
You
can
design
additional
forms
to
validate
or
process
data
to
be
submitted
to
/pkmssu.form.
These
forms
can
be
used
to
assist
the
administrator
by
populating
some
of
the
entries
on
the
switch
user
form.
Some
examples
are:
v
An
administrator
might
have
chosen
to
have
different
destination
URLs,
to
be
accessed
based
on
the
user
identity.
Another
form
could
be
written
to
build
and
present
a
list
of
these
URLs,
from
which
the
administrator
could
select
the
appropriate
entry.
v
A
form
could
be
developed
to
call
another
program,
such
as
a
CGI
script,
to
supply
a
list
of
user
identities
for
whom
switch
user
is
allowed.
This
list
could
help
administrators
determine
if
access
to
a
user
identity
through
switch
user
is
allowed.
v
A
form
could
be
developed
to
display
a
list
of
user
identities
for
whom
switch
user
is
not
allowed.
This
list
would
be
based
on
the
memberships
of
the
su-excluded
and
securitygroup
groups.
Part
5:
Stopping
and
restarting
WebSEAL
To
activate
the
new
configuration
changes
you
must
stop
and
restart
WebSEAL.
This
enables
WebSEAL
to
use
the
new
values
that
were
specified
to
the
WebSEAL
configuration
file
in
“Part
1:
Configuring
user
access”
on
page
190
and
“Part
2:
Configuring
switch
user
authentication
mechanisms”
on
page
191.
The
methods
for
stopping
and
restarting
the
WebSEAL
server
are
described
in
“Server
tasks”
on
page
72.
Using
switch
user
When
the
configuration
steps
in
the
previous
section
have
been
completed,
WebSEAL
administrators
can
use
the
switch
user
function.
To
use
the
switch
user
function,
complete
the
following
steps:
1.
Log
in
as
a
user
who
has
permission
to
access
the
switch
user
function.
This
function
is
usually
accessed
by
administrators.
The
user
must
be
a
member
of
the
su-admins
group.
2.
Invoke
the
switch
user
HTML
form.
Chapter
7.
Advanced
WebSEAL
authentication
195