IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

credattrs_email
joeuser@bigco.com
credattrs_businesscategory
finance
Note
that
the
service,
source,
and
attributes
can
be
multi-valued.
If
you
specify
the
same
attribute
name
as
a
stanza
entry
keyword,
then
the
attributes
retrieved
will
be
added
as
a
multi-valued
attribute
even
when
they
come
from
different
sources.
For
example,
more
than
one
entitlement
service
can
be
chained
together.
This
enables
values
retrieved
from
one
service.
to
be
used
as
input
values
for
another
service.
Likewise,
attributes
can
be
retrieved
from
more
than
one
DN
in
the
user
registry.
Thus,
using
the
example
above,
you
could
add
values
from
multiple
users
(DNs)
to
one
credattrs_businesscategory
attribute,
if
you
wanted
a
list
of
all
the
businesscategory
entries
for
a
group
of
users.
For
example,
if
you
want
to
build
an
attribute
called
myemployeeinfo
to
add
to
the
credential,
and
you
want
this
attribute
to
contain
the
last
name
and
employee
type
of
everyone
that
authenticates,
you
could
then
define
the
following:
[myID]
source
=
azn_cred_authzn_id
[myID:source]
myemployeeinfo
=
lastname
myemployeeinfo
=
employeetype
Junction
handling
of
extended
credential
attributes
The
user-defined
credential
information
created
in
the
previous
section
can
be
placed
in
an
HTTP
header
of
the
request
that
is
sent
across
a
junction
to
a
back-end
server.
You
must
configure
the
junction
to
extract
extended
attribute
data
from
the
credential
and
insert
the
data
into
the
HTTP
header
of
the
request.
This
functionality
is
achieved
by
setting
a
junction
extended
attribute,
called
HTTP-Tag-Value,
on
the
junction
object
in
the
WebSEAL
protected
object
space.
You
use
the
pdadmin
object
modify
set
attribute
command
to
set
extended
attributes
on
a
junction
object
in
the
WebSEAL
protected
object
space.
pdadmin>
object
modify
object_name
set
attribute
attr_name
attr_value
The
above
command
must
be
entered
as
one
continuous
command
line.
An
extended
attribute
(attr_name)
enables
the
junction
to
perform
a
specific
type
of
functionality.
The
HTTP-Tag-Value
extended
attribute
instructs
the
junction
to
extract
a
particular
value
from
a
user’s
credential
and
send
the
value
to
the
back-end
server
in
an
HTTP
header.
The
value
of
the
HTTP-Tag-Value
extended
attribute
uses
the
following
format:
credential_extended_attribute_name
=
http_header_name
The
credential_extended_attribute_name
entry
is
the
same
as
the
attributed
specified
in
the
WebSEAL
configuration
file
but
without
the
″tagvalue_″
prefix.
The
entry
is
not
case-sensitive.
The
http_header_name
entry
specifies
the
name
of
the
HTTP
header
used
to
deliver
the
data
across
the
junction.
For
example:
218
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide