IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Credential
refresh
This
section
contains
the
following
topics:
v
“Credential
refresh
concepts”
v
“Credential
refresh
configuration”
on
page
224
v
“Credential
refresh
usage”
on
page
225
Credential
refresh
concepts
This
section
contains
the
following
topics:
v
“Credential
refresh
overview”
v
“Credential
refresh
rules”
on
page
221
v
“Refresh
of
cached
credential
information”
on
page
221
v
“Configuration
file
syntax
and
usage”
on
page
222
v
“Default
settings
for
preserve
and
refresh”
on
page
223
v
“Limitations”
on
page
223
Credential
refresh
overview
When
a
user
authenticates
to
WebSEAL,
the
authentication
process
accesses
the
Tivoli
Access
Manager
user
registry
and
builds
a
credential
for
the
user.
The
credential
contains
information
about
the
user
that
is
needed
by
Tivoli
Access
Manager
to
decide
whether
to
grant
the
user
access
to
the
requested
resource.
An
example
of
credential
information
is
a
list
of
groups
to
which
the
user
belongs.
During
a
user
session,
changes
in
user
information
can
take
place.
For
example,
the
user
may
be
added
to
a
new
group.
When
this
occurs,
there
might
be
a
need
to
update
or
refresh
the
contents
of
the
user
credential,
to
reflect
the
new
user
information.
WebSEAL
provides
a
mechanism
to
enable
a
credential
refresh
without
requiring
the
user
to
log
out
and
then
reauthenticate.
You
can
control
how
the
credential
refresh
feature
occurs.
WebSEAL
provides
configuration
settings
that
enable
you
to
specify
credential
attributes
to
refresh
(update)
and
credential
attributes
to
preserve
(retain).
This
enables
you
to
have
precise
control
over
how
user
credentials
are
manipulated
during
a
user
session.
Use
of
the
credential
refresh
configuration
settings
can
be
important
when
the
authentication
process
on
your
WebSEAL
server
includes
call
outs
to
mechanisms
that
provide
additional
or
extended
information
about
a
user.
These
mechanisms
include:
v
Credential
attribute
entitlement
service.
This
service
is
built
into
Tivoli
Access
Manager
by
default.
v
Customized
credential
attribute
entitlement
service
This
service
must
be
written
by
the
application
developer.
v
Credential
extended
attributes
external
authentication
module
This
authentication
module
must
be
written
by
the
application
developer.
For
more
information
on
the
credential
attribute
services
listed
above,
see
“Mechanisms
for
adding
registry
attributes
to
a
credential”
on
page
215.
When
credential
refresh
occurs,
the
above
services
are
handled
as
follows:
v
The
default
credential
attribute
entitlement
services
is
run.
v
The
customized
credential
attribute
entitlement
services
is
run.
220
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide