IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Server-side<br />
request<br />
caching<br />
This<br />
section<br />
contains<br />
the<br />
following<br />
topics:<br />
v<br />
“Overview<br />
of<br />
server-side<br />
request<br />
caching”<br />
v<br />
“Configuring<br />
server-side<br />
caching<br />
parameters”<br />
on<br />
page<br />
201<br />
Overview<br />
of<br />
server-side<br />
request<br />
caching<br />
In<br />
past<br />
versions<br />
of<br />
<strong>WebSEAL</strong><br />
using<br />
Forms<br />
authentication,<br />
<strong>WebSEAL</strong><br />
created<br />
a<br />
cache<br />
entry<br />
<strong>for</strong><br />
the<br />
URL<br />
of<br />
a<br />
user<br />
request<br />
whenever<br />
authentication<br />
was<br />
required.<br />
Upon<br />
successful<br />
authentication,<br />
<strong>WebSEAL</strong><br />
sent<br />
an<br />
HTTP<br />
redirect<br />
to<br />
the<br />
browser<br />
that<br />
included<br />
this<br />
URL.<br />
The<br />
browser<br />
then<br />
followed<br />
the<br />
redirect<br />
to<br />
the<br />
original<br />
resource<br />
location.<br />
The<br />
limitation<br />
of<br />
this<br />
implementation<br />
became<br />
apparent<br />
when,<br />
<strong>for</strong><br />
example,<br />
a<br />
POST<br />
request<br />
was<br />
interrupted<br />
by<br />
a<br />
session<br />
timeout<br />
that<br />
prompted<br />
a<br />
re-authentication<br />
process.<br />
Since<br />
<strong>WebSEAL</strong><br />
only<br />
cached<br />
the<br />
URL<br />
of<br />
the<br />
original<br />
request,<br />
the<br />
POST<br />
data<br />
(including<br />
the<br />
METHOD<br />
and<br />
Message<br />
Body)<br />
were<br />
lost<br />
during<br />
the<br />
HTTP<br />
redirect.<br />
The<br />
user<br />
had<br />
to<br />
rebuild<br />
the<br />
POST<br />
request.<br />
<strong>WebSEAL</strong><br />
now<br />
caches<br />
a<br />
more<br />
complete<br />
set<br />
of<br />
request<br />
data<br />
and<br />
uses<br />
this<br />
cached<br />
data<br />
to<br />
rebuild<br />
the<br />
request<br />
during<br />
the<br />
HTTP<br />
redirect,<br />
if<br />
a<br />
re-authentication<br />
requirement<br />
interrupts<br />
the<br />
completion<br />
of<br />
the<br />
request<br />
processing.<br />
This<br />
solution<br />
particularly<br />
benefits<br />
POST<br />
and<br />
PUT<br />
requests,<br />
because<br />
these<br />
requests<br />
types<br />
can<br />
include<br />
a<br />
variety<br />
of<br />
in<strong>for</strong>mation<br />
fields.<br />
When<br />
an<br />
authentication<br />
requirement<br />
interrupts<br />
a<br />
request,<br />
<strong>WebSEAL</strong><br />
caches<br />
all<br />
in<strong>for</strong>mation<br />
necessary<br />
to<br />
rebuild<br />
the<br />
request<br />
during<br />
the<br />
HTTP<br />
redirect<br />
that<br />
follows<br />
after<br />
re-authentication.<br />
Cached<br />
request<br />
data<br />
includes<br />
URL,<br />
METHOD,<br />
Message<br />
Body,<br />
query<br />
strings,<br />
and<br />
all<br />
HTTP<br />
headers<br />
(including<br />
cookies).<br />
This<br />
data<br />
is<br />
temporarily<br />
stored<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
credentials/session<br />
cache.<br />
Upon<br />
successful<br />
authentication<br />
(or<br />
re-authentication),<br />
<strong>WebSEAL</strong><br />
sends<br />
an<br />
HTTP<br />
redirect<br />
to<br />
the<br />
browser.<br />
The<br />
browser<br />
follows<br />
the<br />
redirect<br />
to<br />
the<br />
original<br />
URL<br />
contained<br />
in<br />
the<br />
redirect.<br />
<strong>WebSEAL</strong><br />
intercepts<br />
the<br />
redirect<br />
and<br />
rebuilds<br />
the<br />
request<br />
using<br />
the<br />
cached<br />
data.<br />
The<br />
rebuilt<br />
request<br />
is<br />
delivered<br />
to<br />
the<br />
URL<br />
destination.<br />
The<br />
following<br />
diagram<br />
illustrates<br />
a<br />
typical<br />
server-side<br />
request<br />
caching<br />
process<br />
flow:<br />
1.<br />
User<br />
successfully<br />
logs<br />
in<br />
(Forms<br />
authentication)<br />
and<br />
submits<br />
an<br />
HTTP<br />
request<br />
<strong>for</strong><br />
a<br />
resource<br />
involving<br />
a<br />
CGI-generated<br />
data<br />
<strong>for</strong>m.<br />
<strong>WebSEAL</strong><br />
creates<br />
and<br />
caches<br />
a<br />
session<br />
ID<br />
<strong>for</strong><br />
the<br />
user.<br />
2.<br />
The<br />
back-end<br />
application<br />
server<br />
returns<br />
the<br />
<strong>for</strong>m<br />
to<br />
the<br />
user.<br />
3.<br />
During<br />
the<br />
time<br />
it<br />
takes<br />
the<br />
user<br />
to<br />
fill<br />
in<br />
the<br />
<strong>for</strong>m,<br />
the<br />
configured<br />
session<br />
timeout<br />
<strong>for</strong><br />
the<br />
user<br />
expires.<br />
<strong>WebSEAL</strong><br />
removes<br />
the<br />
user’s<br />
credentials<br />
cache<br />
entry<br />
and<br />
session<br />
ID.<br />
4.<br />
The<br />
user<br />
eventually<br />
submits<br />
the<br />
completed<br />
<strong>for</strong>m<br />
(POST).<br />
<strong>WebSEAL</strong><br />
finds<br />
no<br />
cache<br />
entry<br />
<strong>for</strong><br />
the<br />
user,<br />
creates<br />
a<br />
new<br />
cache<br />
entry,<br />
and<br />
temporarily<br />
caches<br />
the<br />
complete<br />
in<strong>for</strong>mation<br />
contained<br />
in<br />
the<br />
POST<br />
request.<br />
5.<br />
Because<br />
<strong>WebSEAL</strong><br />
finds<br />
no<br />
credentials<br />
<strong>for</strong><br />
this<br />
user,<br />
the<br />
user<br />
must<br />
authenticate.<br />
<strong>WebSEAL</strong><br />
sends<br />
a<br />
login<br />
<strong>for</strong>m<br />
to<br />
the<br />
user.<br />
6.<br />
The<br />
user<br />
returns<br />
the<br />
completed<br />
login<br />
<strong>for</strong>m<br />
to<br />
<strong>WebSEAL</strong><br />
(POST).<br />
Authentication<br />
is<br />
successful.<br />
The<br />
cache<br />
now<br />
contains<br />
the<br />
user’s<br />
credentials,<br />
as<br />
well<br />
as<br />
the<br />
cached<br />
request.<br />
200<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide