IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Credential
refresh
configuration
To
configure
credential
refresh,
complete
the
following
steps:
v
“Step
1:
Specify
attributes
to
preserve
or
refresh”
v
“Step
2:
Enable
user
session
IDs”
v
“Step
3:
Enable
placement
of
server
name
into
junction
header”
Step
1:
Specify
attributes
to
preserve
or
refresh
1.
Stop
the
WebSEAL
server.
2.
Edit
the
WebSEAL
configuration
file.
v
Add
entries
for
attributes
to
preserve.
For
example:
[credential-refresh-attributes]
my_cred_attribute1
=
preserve
my_cred_attribute2
=
preserve
v
Add
entries
to
refresh:
[credential-refresh-attributes]
my_cred_attribute3
=
refresh
my_cred_attribute4
=
refresh
v
When
appropriate
use
the
order
of
the
entries
to
handle
both
specific
entries
and
groups
of
entries.
For
example,
to
preserve
the
attribute
special_cred_attr1,
but
refresh
all
other
attributes
with
the
naming
construct
of
special_cred_attr*,
add
the
following
entries:
[credential-refresh-attributes]
special_cred_attr1
=
preserve
special_cred_attr*
=
refresh
Step
2:
Enable
user
session
IDs
Ensure
that
user
session
IDs
are
enabled
for
the
WebSEAL
server
instance.
The
credential
refresh
administration
command
does
not
work
when
user
session
IDs
are
not
enabled.
[session]
user-session-ids
=
yes
Step
3:
Enable
placement
of
server
name
into
junction
header
A
header
with
the
URI-encoded
authorization
API
administration
server
name
is
passed
to
all
junction
servers.
When
no
header
name
is
specified,
the
header
will
not
be
sent
to
the
junction.
The
value
is
set
in
the
default
WebSEAL
configuration
file.
[header-names]
server-name
=
iv_server_name
This
setting
controls
the
name
of
the
header
used
to
pass
the
name
of
the
server
to
junctioned
applications.
For
example,
when
server-name
=
iv_server_name,
and
the
WebSEAL
server
instance
is
default-webseald-diamond.subnet1.ibm.com,
WebSEAL
passes
the
following
header
to
the
junction:
iv-server-name:default-webseald-diamond.subnet1.ibm.com
Typically,
the
default
value
iv_server_name
is
used.
However,
you
can
replace
it
with
any
valid
string.
Valid
strings
are
limited
to
the
following
characters:
[A-Z],
[a-z],
[0–9],
hyphen
(
-
),
or
underscore
(
_
).
WebSEAL
accepts
a
blank
value
for
server-name.
This
is
not
usually
useful,
but
could
be
applicable
if
the
junctioned
application
chooses
to
have
the
server
name
hardcoded
instead
of
obtaining
it
from
the
header.
224
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide