IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

xauthn_username
xauthn_qop
xauthn_ipaddr
xauthn_browser_info
The
xauthn_browser_info,
xauthn_qop,
and
xauthn_ipaddr
identity
components
represent
those
of
the
administrator,
not
the
″switched
to″
user.
This
data
is
supplied
for
any
authentication
module
that
must
perform
additional
validations
of
the
administrator’s
account.
Note:
Refer
to
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference
for
more
information
on
writing
a
custom
authentication
module.
Configuring
a
custom
authentication
module
for
switch
user
The
following
example
expands
on
the
example
presented
in
“Part
2:
Configuring
switch
user
authentication
mechanisms”
on
page
191.
The
example
adds
a
custom
authentication
module
to
list
of
enabled
authentication
mechanisms.
The
example,
for
a
Solaris
platform,
shows
an
existing
environment
that
has
three
authentication
methods
enabled:
v
Forms
authentication
using
the
built-in
libldapauthn
library
v
Certificates
authentication
using
the
built-in
libsslauthn
library
v
Token
authentication
using
a
custom
authentication
module
In
this
example,
the
administrator
wants
to
be
able
to
use
switch
user
authentication
for
all
three
authentication
methods.
Thus,
three
additional
authentication
parameters
for
switch
user
must
be
enabled
in
the
WebSEAL
configuration
file.
The
third
parameter
represents
the
new
custom
authentication
module
library
that
was
written
to
emulate
the
existing
token
authentication
and
support
the
requirements
of
switch
user
authentication:
The
configuration
file
entries
before
enabling
switch
user
for
the
three
authentication
mechanism
are:
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
cert-ssl
=
/opt/PolicyDirector/lib/libsslauthn.so
token-cdas
=
/opt/PolicyDirector/lib/libcustom.so
Note
that
the
example
token
custom
authentication
library
is
called
libcustom.so.
The
new
switch
user
version
of
this
token
custom
authentication
library
will
be
called
libsucustom.so
After
adding
the
switch
user
authentication
mechanism,
the
configuration
file
entries
are:
[authentication-mechanisms]
passwd-ldap
=
/opt/PolicyDirector/lib/libldapauthn.so
cert-ssl
=
/opt/PolicyDirector/lib/libsslauthn.so
token-cdas
=
/opt/PolicyDirector/lib/libcustom.so
su-password
=
/opt/PolicyDirector/lib/libsuformauthn.so
su-certificate
=
/opt/PolicyDirector/lib/libsucert.so
su-token-card
=
/opt/PolicyDirector/lib/libsucustom.so
Notice
the
following
changes:
v
The
new
entry
for
the
authentication
module
has
the
name
su-token-card.
The
value
for
this
entry
is
the
full
path
name
to
the
shared
library
that
has
been
extended
to
support
switch
user.
v
For
the
non-custom
authentication
methods
in
this
example,
remember
that:
198
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide