IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
reauthentication
based
on
session
inactivity
policy
Tivoli
Access
Manager
WebSEAL
can
force
a
user
to
perform
an
additional
login
(reauthentication)
to
ensure
that
a
user
accessing
a
protected
resource
is
the
same
person
who
initially
authenticated
at
the
start
of
the
session.
Reauthentication
can
be
activated
by
a
Protected
Object
Policy
(POP)
on
the
protected
object
or
by
expiration
of
the
inactivity
timeout
value
for
a
WebSEAL
session
cache
entry.
This
section
discusses
reauthentication
based
on
the
expiration
of
the
inactivity
timeout
value
for
a
WebSEAL
session
cache
entry.
Background
material
on
the
WebSEAL
session
cache
is
provided
in
“The
WebSEAL
session/credentials
cache
structure”
on
page
10.
Conditions
affecting
inactivity
reauthentication
Forced
reauthentication
provides
additional
protection
for
sensitive
resources
in
the
secure
domain.
Reauthentication
based
on
session
inactivity
policy
is
enabled
by
a
configuration
parameter
and
is
activated
by
the
expiration
of
the
inactivity
timeout
value
of
the
session
cache
entry.
Reauthentication
is
supported
by
the
following
supported
WebSEAL
authentication
methods:
v
Forms
(user
name
and
password)
authentication
v
Token
authentication
In
addition,
a
custom
user
name/password
CDAS
can
be
written
to
support
reauthentication.
Reauthentication
assumes
the
user
has
initially
logged
in
to
the
secure
domain
and
that
a
valid
credential
exists
for
the
user.
During
reauthentication,
the
user
must
log
in
using
the
same
identity
that
generated
the
existing
credential.
WebSEAL
preserves
the
user’s
original
session
information,
including
the
credential,
during
reauthentication.
The
credential
is
not
replaced
during
reauthentication.
During
reauthentication,
WebSEAL
also
caches
the
request
that
prompted
the
reauthentication.
After
successful
reauthentication,
the
cached
data
is
used
to
rebuild
the
request.
See
“Server-side
request
caching”
on
page
200.
A
user’s
session
is
normally
regulated
by
a
session
inactivity
value
and
a
session
lifetime
value.
When
WebSEAL
is
configured
for
reauthentication
based
on
session
inactivity,
the
user’s
session
cache
entry
is
″flagged″
whenever
the
session
inactivity
timeout
value
expires.
The
session
cache
entry
(containing
the
user
credential)
is
not
removed.
The
user
can
proceed
to
access
unprotected
resources.
However,
if
the
user
requests
a
protected
resource,
WebSEAL
sends
a
login
prompt.
After
successful
reauthentication,
the
inactive
session
″flag″
is
removed
and
the
inactivity
timer
is
reset.
If
reauthentication
fails,
WebSEAL
returns
the
login
prompt
again.
The
session
cache
entry
remains
″flagged″
and
the
user
can
proceed
as
unauthenticated
until
the
session
cache
entry
lifetime
value
expires.
If
reauthentication
succeeds,
but
the
ACL
check
fails
for
that
resource,
a
403
″Forbidden″
is
returned
and
the
user
is
denied
access
to
the
requested
resource.
208
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide