IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
default
file
name
is
switchuser.html.
For
information
on
the
full
path
name,
see
“Part
3:
Configuring
the
switch
user
HTML
form”
on
page
193.
3.
On
the
form,
specify:
v
The
name
of
the
user
identity
that
you
want
to
assume.
v
A
destination
URL
v
An
authentication
method
This
action
results
in
a
POST
request
being
sent
to
/pkmssu.form.
WebSEAL
sends
a
redirect
to
the
browser
for
the
destination
URL
supplied
in
the
switch
user
form.
The
request
is
processed
using
the
user’s
credential,
and
the
URL
is
accessed.
4.
Make
other
requests
as
necessary.
All
authorization
decisions
for
these
requests
are
based
on
the
credential
of
the
user.
5.
When
finished,
end
the
switch
user
session
by
using
the
standard
Tivoli
Access
Manager
/pkmslogout
utility.
For
more
information
on
how
the
switch
user
function
works,
see
“Overview
of
the
switch
user
function”
on
page
188.
Additional
switch
user
features
This
section
describes
switch
user
support
for
additional
features
such
as
reauthentication,
step-up
authentication,
user
session
management,
and
auditing.
Session
cache
timeout
The
functionality
of
the
configured
WebSEAL
session
cache
inactivity
and
lifetime
timeout
values
is
not
affected
by
the
switch
user
operation.
The
inactivity
and
lifetime
timers
are
associated
with
the
administrator’s
session
cache
entry
and
not
the
cache
data
that
changes
during
a
switch
user
operation.
The
inactivity
timer
continues
to
be
reset
while
the
administrator
performs
requests
as
the
″switched-to″
user.
When
the
administrator
ends
the
switch
user
session,
the
inactivity
is
still
valid
for
the
re-established
administrator
session.
The
lifetime
value
is
not
extended
because
of
a
switch
user
operation.
It
is
possible
for
the
lifetime
timeout
of
the
session
cache
entry
to
expire
during
a
switch
user
operation.
If
this
timeout
occurs,
the
session
cache
is
deleted
and
the
administrator
is
logged
off.
The
administrator
must
reauthenticate
and
begin
the
switch
user
operation
again.
Step-up
authentication
The
shared
library
specification
can
take
additional
arguments
in
the
form:
&
....
You
can
designate
step-up
authentication
levels
using
the
–l
option
followed
by
the
level
number.
For
example:
su-password
=
/opt/PolicyDirector/lib/libsuformauthn.so&
-l
1
su-certificate
=
/opt/PolicyDirector/lib/libsucert.so&
-l
0
su-token-card
=
/opt/PolicyDirector/lib/libsucustom.so&
-l
2
Note:
The
administrator
must
know
the
user’s
password
to
successfully
perform
step-up
authentication.
196
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide