IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Creating
and
applying
the
reauthentication
POP
Forced
reauthentication
based
on
security
policy
is
configured
by
creating
a
protected
object
policy
(POP)
with
a
special
extended
attribute
named
″reauth″.
You
can
attach
this
POP
to
any
object
that
requires
the
extra
protection
provided
by
forced
reauthentication.
Remember
that
all
children
of
the
object
with
the
POP
also
inherit
the
POP
conditions.
Each
requested
child
object
requires
a
separate
reauthentication.
Use
the
pdadmin
pop
create,
pdadmin
pop
modify,
and
pdadmin
pop
attach
commands.
The
following
example
illustrates
creating
a
POP
called
″secure″
with
the
reauth
extended
attribute
and
attaching
it
to
an
object
(budget.html):
pdadmin>
pop
create
secure
pdadmin>
pop
modify
secure
set
attribute
reauth
true
pdadmin>
pop
attach
/WebSEAL/hostA/junction/budget.html
secure
Anyone
attempting
to
access
budget.html
is
forced
to
reauthenticate
using
the
same
identity
and
authentication
method
that
generated
the
existing
credential.
If
the
user
requesting
the
resource
is
unauthenticated,
the
POP
forces
the
user
to
authenticate.
No
reauthentication
is
necessary
for
this
resource
after
successful
initial
login.
Details
about
the
pdadmin
command
line
utility
can
be
found
in
the
IBM
Tivoli
Access
Manager
Base
Administrator’s
Guide.
Configuring
session
cache
entry
lifetime
reset
and
extension
Resetting
the
session
cache
entry
lifetime
value
The
user’s
session
cache
entry
has
a
limited
lifetime,
as
specified
by
the
timeout
parameter
in
the
[session]
stanza
of
the
webseald.conf
configuration
file.
The
default
value,
in
seconds,
is
3600
(1
hour):
[session]
timeout
=
3600
Regardless
of
session
activity
or
inactivity,
the
session
cache
entry
is
removed
when
the
lifetime
value
is
reached,
at
which
point
the
user
is
logged
off.
However,
you
can
configure
the
lifetime
of
the
session
cache
entry
to
be
reset
whenever
reauthentication
occurs.
With
this
configuration,
the
user
session
no
longer
has
a
single
maximum
lifetime
value.
Each
time
reauthentication
occurs,
the
lifetime
value
of
the
session
cache
entry
is
reset.
You
can
configure
session
cache
entry
lifetime
reset
with
the
reauth-reset-lifetime
parameter
in
the
[reauthentication]
stanza
of
the
webseald.conf
configuration
file:
[reauthentication]
reauth-reset-lifetime
=
yes
The
default
value
is
″no″.
This
parameter
is
also
appropriate
for
reauthentication
due
to
the
expiration
of
the
inactivity
timeout
value
for
a
session
cache
entry.
See
“Configuring
reauthentication
based
on
session
inactivity
policy”
on
page
208.
Chapter
7.
Advanced
WebSEAL
authentication
205