IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
v<br />
Credential<br />
extended<br />
attributes<br />
external<br />
authentication<br />
modules<br />
are<br />
not<br />
run.<br />
The<br />
credential<br />
refresh<br />
configuration<br />
settings<br />
enables<br />
you<br />
to<br />
preserve<br />
attributes<br />
obtained<br />
during<br />
the<br />
initial<br />
use<br />
of<br />
an<br />
entitlement<br />
service.<br />
For<br />
example,<br />
if<br />
an<br />
attribute<br />
contained<br />
a<br />
timestamp<br />
<strong>for</strong><br />
the<br />
start<br />
of<br />
the<br />
user<br />
session,<br />
you<br />
might<br />
want<br />
to<br />
preserve<br />
the<br />
timestamp<br />
even<br />
though<br />
the<br />
credential<br />
was<br />
refreshed.<br />
The<br />
credential<br />
refresh<br />
configuration<br />
settings<br />
also<br />
enables<br />
you<br />
to<br />
preserve<br />
attributes<br />
obtained<br />
from<br />
a<br />
credential<br />
extended<br />
attribute<br />
authentication<br />
module.<br />
Since<br />
custom<br />
authentication<br />
modules<br />
are<br />
not<br />
run<br />
again<br />
during<br />
the<br />
rebuilding<br />
of<br />
the<br />
credential,<br />
you<br />
use<br />
the<br />
configuration<br />
file<br />
settings<br />
to<br />
specify<br />
attributes<br />
to<br />
be<br />
added<br />
to<br />
the<br />
new<br />
credential.<br />
Credential<br />
refresh<br />
rules<br />
Credential<br />
refresh<br />
involves<br />
the<br />
generation<br />
of<br />
a<br />
new<br />
credential<br />
<strong>for</strong><br />
user<br />
identity,<br />
followed<br />
by<br />
an<br />
evaluation<br />
of<br />
the<br />
contents<br />
of<br />
the<br />
new<br />
credential<br />
against<br />
the<br />
contents<br />
of<br />
the<br />
old<br />
credential<br />
that<br />
was<br />
obtained<br />
during<br />
initial<br />
user<br />
authentication.<br />
The<br />
contents<br />
of<br />
the<br />
two<br />
credentials<br />
are<br />
combined<br />
into<br />
a<br />
merged<br />
credential<br />
according<br />
to<br />
the<br />
following<br />
rules:<br />
1.<br />
When<br />
an<br />
attribute<br />
occurs<br />
in<br />
the<br />
new<br />
credential<br />
but<br />
not<br />
the<br />
old<br />
credential,<br />
it<br />
is<br />
added<br />
to<br />
the<br />
merged<br />
credential.<br />
2.<br />
The<br />
following<br />
attributes<br />
are<br />
added<br />
to<br />
the<br />
merged<br />
credential<br />
based<br />
only<br />
on<br />
their<br />
value<br />
in<br />
the<br />
old<br />
credential.<br />
These<br />
attributes<br />
are<br />
used<br />
by<br />
the<br />
authorization<br />
API.<br />
They<br />
are<br />
not<br />
changed<br />
by<br />
values<br />
in<br />
the<br />
new<br />
credential.<br />
AZN_CRED_AUTHNMECH_INFO<br />
AZN_CRED_BROWSER_INFO<br />
AZN_CRED_IP_ADDRESS<br />
AZN_CRED_PRINCIPAL_NAME<br />
AZN_CRED_AUTH_METHOD<br />
AZN_CRED_USER_INFO<br />
AZN_CRED_QOP_INFO<br />
3.<br />
For<br />
each<br />
attribute<br />
in<br />
the<br />
old<br />
credential<br />
<strong>for</strong><br />
which<br />
there<br />
is<br />
a<br />
corresponding<br />
attribute<br />
in<br />
the<br />
new<br />
credential,<br />
the<br />
following<br />
rules<br />
apply:<br />
v<br />
When<br />
there<br />
is<br />
an<br />
entry<br />
in<br />
the<br />
configuration<br />
file<br />
that<br />
matches<br />
it,<br />
the<br />
attribute<br />
in<br />
the<br />
merged<br />
credential<br />
is<br />
preserved<br />
or<br />
refreshed<br />
according<br />
to<br />
the<br />
value<br />
of<br />
the<br />
entry<br />
in<br />
the<br />
configuration<br />
file<br />
v<br />
When<br />
there<br />
is<br />
not<br />
an<br />
entry<br />
in<br />
the<br />
configuration<br />
file<br />
that<br />
matches<br />
it,<br />
the<br />
attribute<br />
in<br />
the<br />
merged<br />
credential<br />
is<br />
assigned<br />
the<br />
value<br />
from<br />
the<br />
new<br />
credential.<br />
4.<br />
For<br />
each<br />
attribute<br />
in<br />
the<br />
old<br />
credential<br />
<strong>for</strong><br />
which<br />
there<br />
is<br />
not<br />
a<br />
corresponding<br />
attribute<br />
in<br />
the<br />
new<br />
credential,<br />
the<br />
following<br />
rules<br />
applies:<br />
v<br />
When<br />
there<br />
is<br />
a<br />
configuration<br />
file<br />
entry<br />
<strong>for</strong><br />
the<br />
attribute<br />
specifying<br />
refresh,<br />
the<br />
attribute<br />
is<br />
not<br />
added<br />
to<br />
the<br />
merged<br />
credential<br />
v<br />
When<br />
there<br />
is<br />
a<br />
configuration<br />
file<br />
entry<br />
<strong>for</strong><br />
the<br />
attribute<br />
specifying<br />
preserve,<br />
the<br />
attribute<br />
is<br />
added<br />
to<br />
the<br />
merged<br />
credential<br />
v<br />
When<br />
the<br />
configuration<br />
file<br />
does<br />
not<br />
contain<br />
an<br />
entry<br />
<strong>for</strong><br />
the<br />
attribute,<br />
the<br />
attribute<br />
is<br />
not<br />
added<br />
to<br />
the<br />
merged<br />
credential.<br />
Refresh<br />
of<br />
cached<br />
credential<br />
in<strong>for</strong>mation<br />
Some<br />
user<br />
registries<br />
maintain<br />
cached<br />
in<strong>for</strong>mation.<br />
Cached<br />
data<br />
is<br />
kept<br />
<strong>for</strong><br />
a<br />
specific<br />
amount<br />
of<br />
time,<br />
and<br />
is<br />
then<br />
discarded.<br />
Once<br />
the<br />
cached<br />
data<br />
has<br />
expired,<br />
it<br />
is<br />
not<br />
reloaded<br />
into<br />
the<br />
cache<br />
until<br />
the<br />
next<br />
time<br />
the<br />
user<br />
registry<br />
is<br />
accessed.<br />
Thus,<br />
when<br />
changes<br />
are<br />
made<br />
to<br />
user<br />
registry<br />
data,<br />
the<br />
data<br />
is<br />
not<br />
immediately<br />
cached<br />
in<br />
memory.<br />
Likewise,<br />
when<br />
using<br />
a<br />
replicated<br />
LDAP<br />
user<br />
registry,<br />
the<br />
updates<br />
to<br />
the<br />
replicated<br />
registries<br />
do<br />
not<br />
occur<br />
immediately.<br />
Chapter<br />
7.<br />
Advanced<br />
<strong>WebSEAL</strong><br />
authentication<br />
221