IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
Credential
extended
attributes
external
authentication
modules
are
not
run.
The
credential
refresh
configuration
settings
enables
you
to
preserve
attributes
obtained
during
the
initial
use
of
an
entitlement
service.
For
example,
if
an
attribute
contained
a
timestamp
for
the
start
of
the
user
session,
you
might
want
to
preserve
the
timestamp
even
though
the
credential
was
refreshed.
The
credential
refresh
configuration
settings
also
enables
you
to
preserve
attributes
obtained
from
a
credential
extended
attribute
authentication
module.
Since
custom
authentication
modules
are
not
run
again
during
the
rebuilding
of
the
credential,
you
use
the
configuration
file
settings
to
specify
attributes
to
be
added
to
the
new
credential.
Credential
refresh
rules
Credential
refresh
involves
the
generation
of
a
new
credential
for
user
identity,
followed
by
an
evaluation
of
the
contents
of
the
new
credential
against
the
contents
of
the
old
credential
that
was
obtained
during
initial
user
authentication.
The
contents
of
the
two
credentials
are
combined
into
a
merged
credential
according
to
the
following
rules:
1.
When
an
attribute
occurs
in
the
new
credential
but
not
the
old
credential,
it
is
added
to
the
merged
credential.
2.
The
following
attributes
are
added
to
the
merged
credential
based
only
on
their
value
in
the
old
credential.
These
attributes
are
used
by
the
authorization
API.
They
are
not
changed
by
values
in
the
new
credential.
AZN_CRED_AUTHNMECH_INFO
AZN_CRED_BROWSER_INFO
AZN_CRED_IP_ADDRESS
AZN_CRED_PRINCIPAL_NAME
AZN_CRED_AUTH_METHOD
AZN_CRED_USER_INFO
AZN_CRED_QOP_INFO
3.
For
each
attribute
in
the
old
credential
for
which
there
is
a
corresponding
attribute
in
the
new
credential,
the
following
rules
apply:
v
When
there
is
an
entry
in
the
configuration
file
that
matches
it,
the
attribute
in
the
merged
credential
is
preserved
or
refreshed
according
to
the
value
of
the
entry
in
the
configuration
file
v
When
there
is
not
an
entry
in
the
configuration
file
that
matches
it,
the
attribute
in
the
merged
credential
is
assigned
the
value
from
the
new
credential.
4.
For
each
attribute
in
the
old
credential
for
which
there
is
not
a
corresponding
attribute
in
the
new
credential,
the
following
rules
applies:
v
When
there
is
a
configuration
file
entry
for
the
attribute
specifying
refresh,
the
attribute
is
not
added
to
the
merged
credential
v
When
there
is
a
configuration
file
entry
for
the
attribute
specifying
preserve,
the
attribute
is
added
to
the
merged
credential
v
When
the
configuration
file
does
not
contain
an
entry
for
the
attribute,
the
attribute
is
not
added
to
the
merged
credential.
Refresh
of
cached
credential
information
Some
user
registries
maintain
cached
information.
Cached
data
is
kept
for
a
specific
amount
of
time,
and
is
then
discarded.
Once
the
cached
data
has
expired,
it
is
not
reloaded
into
the
cache
until
the
next
time
the
user
registry
is
accessed.
Thus,
when
changes
are
made
to
user
registry
data,
the
data
is
not
immediately
cached
in
memory.
Likewise,
when
using
a
replicated
LDAP
user
registry,
the
updates
to
the
replicated
registries
do
not
occur
immediately.
Chapter
7.
Advanced
WebSEAL
authentication
221