IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Reauthentication
WebSEAL
reauthentication
functionality
is
recognized
by
the
switch
user
operation.
If
reauthentication
is
required
during
a
switch
user
operation,
the
administrator
must
authenticate
as
the
″switched-to″
user.
Note:
The
administrator
must
know
the
″switched-to″
user’s
password
to
successfully
reauthenticate.
User
session
management
The
switch
user
operation
supports
user
session
management.
The
administrator
has
a
unique
User
Session
ID.
Additionally,
during
a
switch
user
operation,
a
unique
User
Session
ID
exists
for
the
″switched-to″
user.
The
terminate
single
user
sessions
task
and
terminate
all
user
sessions
task
perform
as
expected.
Tag-value
The
tag-value
capability
often
used
by
a
CDAS
is
recognized
and
supported
by
the
switch
user
functionality.
Auditing
It
is
possible
to
audit
the
administrator
during
a
switch
user
operation.
The
switch
user
functionality
adds
an
extended
attribute
to
the
″switch-to″
user
credential
that
identifies
the
administrator.
The
extended
attribute,
as
stored
in
the
credential,
is
called
tagvalue_su-admin:
tagvalue_su-admin
=
This
extended
attribute
is
available
to
any
auditing
mechanism.
Developing
a
custom
authentication
module
for
switch
user
The
switch
user
functionality
also
supports
custom
authentication
module.
This
support
is
important
because
an
existing
custom
authentication
module
often
returns
additional
information
about
the
user
that
is
incorporated
into
the
user’s
credential.
A
custom
authentication
module
can
be
used
to
perform
further
checks
regarding
switch
user
capability,
such
as
determining
which
users
can
switch
user
to
other
users’
identities,
or
specifying
time
periods
when
switch
user
capability
is
not
allowed.
If
you
are
using
the
switch
user
feature
in
such
an
environment,
you
must
write
a
special
switch
user
authentication
module
that
emulates
the
behavior
of
your
existing
authentication
module
while
supporting
the
requirement
of
returning
a
credential
without
requiring
the
user
password
for
input.
The
Tivoli
Access
Manager
external
authentication
API
provides
a
set
of
identity
components
that
can
be
used
to
pass
client
authentication
information
to
the
switch
user
shared
library.
This
information
is
passed
using
a
name/value
list
format,
where
the
name
is
an
identifier
that
specifies
the
value
type.
The
information
is
stored
in
the
xnlist_t
data
type.
Values
can
be
accessed
by
using
the
utility
function
xnvlist_get().
Identity
components
appropriate
for
a
switch
user
authentication
module
include:
xauthn_su_method
xauthn_admin_name
xauthn_admin_cred
xauthn_existing_cred
Chapter
7.
Advanced
WebSEAL
authentication
197