IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Extending
the
session
cache
entry
lifetime
value
It
is
possible
for
the
lifetime
value
of
a
session
cache
entry
to
expire
while
the
user
is
performing
a
reauthentication.
This
situation
occurs
under
the
following
conditions:
v
The
user
requests
a
resource
protected
by
a
reauthentication
POP
v
The
user’s
session
cache
entry
lifetime
value
is
very
near
expiration
The
session
cache
entry
lifetime
can
expire
after
the
reauthentication
login
form
is
sent
to
the
user
and
before
the
completed
login
form
is
returned.
When
the
session
cache
entry
lifetime
value
expires,
the
session
cache
entry
is
deleted.
When
the
login
form
is
returned
to
WebSEAL,
there
is
no
longer
a
session
for
that
user.
In
addition,
all
cached
user
request
data
is
lost.
You
can
configure
a
time
extension,
or
″grace
period,″
for
the
session
cache
entry
lifetime
if
the
lifetime
of
the
session
cache
entry
expires
during
reauthentication.
The
reauth-extend-lifetime
parameter
in
the
[reauthentication]
stanza
of
the
webseald.conf
configuration
file
provides
this
time
extension,
in
seconds.
For
example
(5
minutes):
[reauthentication]
reauth-extend-lifetime
=
300
The
default
value,
″0″,
provides
no
extension
to
the
timeout
value
of
the
session
cache
entry.
The
reauth-extend-lifetime
parameter
applies
to
users
with
existing
session
cache
entries
and
who
are
required
to
reauthenticate.
For
example:
v
Users
performing
reauthentication
resulting
from
POP
security
policy
v
Users
performing
reauthentication
resulting
from
session
cache
inactivity
v
Users
performing
step-up
authentication
The
reauth-extend-lifetime
option
is
intended
to
be
used
in
conjunction
with
the
reauth-reset-lifetime=yes
option.
This
parameter
is
also
appropriate
for
reauthentication
due
to
security
(POP)
policy.
See
“Configuring
reauthentication
based
on
security
policy”
on
page
204.
Preventing
session
removal
when
the
session
lifetime
expires
It
is
possible
for
a
user
to
remain
active
for
the
full
duration
of
a
session
lifetime.
When
the
session
lifetime
value
expires,
the
session
cache
entry
is
normally
removed
and
the
user
is
logged
off.
To
prevent
this
sudden
session
termination,
you
can
configure
WebSEAL
to
allow
the
user
to
reauthenticate
after
the
session
timeout
value
has
expired.
WebSEAL
allows
resetting
of
the
session
lifetime
value,
after
it
has
expired,
under
the
following
conditions:
v
Reauthentication
based
on
inactivity
policy
is
enabled
(reauth-for-
inactive=yes)
v
The
session
lifetime
value
(timeout)
has
expired
v
The
time
extension
(″grace
period″)
for
the
session
lifetime
is
enabled
and
set
to
a
reasonable
value
(for
example,
reauth-extend-lifetime=300)
v
The
user
activates
the
reauthentication
prompt
by
requesting
a
protected
resource
before
the
time
extension
(″grace
period″)
expires
(WebSEAL
does
not
allow
repeated
additions
of
the
time
extension
to
an
end
of
session
lifetime
event.)
210
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide