IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

1.
Ensure
that
the
server-name
key
is
set
in
the
configuration
file
for
the
WebSEAL
server
instance.
2.
Restart
the
WebSEAL
server.
Credential
refresh
usage
Topic
index:
v
“Refresh
credentials
for
a
specified
user”
v
“Troubleshooting”
Refresh
credentials
for
a
specified
user
Send
a
command
to
the
WebSEAL
server,
instructing
it
to
perform
a
credential
refresh
operation
for
all
of
the
sessions
of
the
specified
user
on
the
WebSEAL
server.
The
syntax
is:
pdadmin>
server
task
instance_name-webseald-host_name
\
refresh
all_sessions
user_name
Enter
the
above
command
as
one
continuous
command
line.
To
obtain
the
server
name
in
the
correct
format,
use
the
pdadmin
server
list
command.
Then
enter
the
pdadmin
command
to
refresh
all
sessions.
For
example,
when
logged
in
to
pdadmin
as
the
administrative
user
sec_master:
pdadmin
sec_master>
server
list
default-webseald-diamond.subnet1.ibm.com
default-webseald-cmd
pdadmin
sec_master>
server
task
default-webseald-diamond.subnet1.ibm.com
\
refresh
all_sessions
brian
DPWWA2043I
The
user’s
credential
was
updated.
Note
that
the
pdadmin
server
task
command
must
each
be
entered
as
one
continuous
command
line
A
warning
message
is
returned
if
the
user
is
not
logged
in
to
the
WebSEAL
server.
Usage
notes:
v
Configure
credential
refresh
for
WebSEAL
before
using
this
pdadmin
command.
See
“Credential
refresh
configuration”
on
page
224.
v
You
must
issue
a
separate
pdadmin
command
for
each
user
whose
credentials
are
to
be
refreshed.
You
cannot
refresh
credentials
for
more
than
one
user
at
a
time.
v
The
user
invoking
this
command
must
have
server
admin
(The
s
ACL
bit)
permission
on
the
/WebSEAL/hostname_instance_name
server
object.
This
prevents
unauthorized
users
from
performing
credential
refresh
operations.
Note
that
the
name
of
the
hostname_instance_name
server
object
is
different
than
the
server
name.
To
determine
the
exact
name
of
the
server
object,
use
pdadmin
object
list.
For
example,
when
logged
in
to
pdadmin
as
the
administrative
user
sec_master:
pdadmin
sec_master>
object
list
/WebSEAL
/WebSEAL/cmd-default
/WebSEAL/diamond.subnet1.ibm.com-default
Troubleshooting
v
Problem:
When
a
new
group
entry
is
added
to
a
user’s
information
in
a
user
registry,
a
credential
refresh
command
does
not
obtain
the
new
entry.
Solution:
Some
user
registries
maintain
cached
information.
The
cache
is
updated
periodically.
The
cache
update
must
take
place
before
the
credential
Chapter
7.
Advanced
WebSEAL
authentication
225