IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
At<br />
installation,<br />
<strong>WebSEAL</strong><br />
uses<br />
the<br />
stash<br />
file<br />
to<br />
obtain<br />
the<br />
key<br />
file<br />
password.<br />
The<br />
webseal-cert-keyfile-pwd<br />
is<br />
commented<br />
out.<br />
By<br />
using<br />
the<br />
stash<br />
file<br />
you<br />
can<br />
avoid<br />
displaying<br />
the<br />
password<br />
as<br />
text<br />
in<br />
the<br />
webseald.conf<br />
configuration<br />
file.<br />
Note:<br />
Uncomment<br />
the<br />
specific<br />
password<br />
parameter<br />
you<br />
want<br />
to<br />
use.<br />
If<br />
both<br />
password<br />
and<br />
stash<br />
file<br />
are<br />
specified,<br />
the<br />
password<br />
value<br />
is<br />
used.<br />
<strong>WebSEAL</strong><br />
Test<br />
Certificate:<br />
At<br />
installation,<br />
<strong>WebSEAL</strong><br />
provides<br />
a<br />
non-secure<br />
self-signed<br />
test<br />
certificate.<br />
The<br />
test<br />
certificate,<br />
acting<br />
as<br />
a<br />
server-side<br />
certificate,<br />
allows<br />
<strong>WebSEAL</strong><br />
to<br />
identify<br />
itself<br />
to<br />
SSL<br />
clients.<br />
To<br />
better<br />
control<br />
how<br />
this<br />
test<br />
certificate<br />
is<br />
used,<br />
the<br />
certificate<br />
is<br />
not<br />
installed<br />
as<br />
a<br />
default<br />
certificate.<br />
Instead,<br />
the<br />
webseal-cert-keyfile-label<br />
parameter<br />
designates<br />
the<br />
certificate<br />
as<br />
the<br />
active<br />
server-side<br />
certificate<br />
and<br />
overrides<br />
any<br />
other<br />
certificate<br />
designated<br />
as<br />
″default″<br />
in<br />
the<br />
keyfile<br />
database.<br />
webseal-cert-keyfile-label<br />
=<br />
<strong>WebSEAL</strong>-Test-Only<br />
Note:<br />
<strong>WebSEAL</strong><br />
uses<br />
GSKit<br />
certificate<br />
handling<br />
functionality.<br />
GSKit<br />
allows<br />
but<br />
does<br />
not<br />
require<br />
that<br />
a<br />
certificate<br />
in<br />
keyfile<br />
databases<br />
be<br />
designated<br />
the<br />
default<br />
certificate.<br />
For<br />
more<br />
in<strong>for</strong>mation<br />
on<br />
certificate<br />
handling,<br />
see<br />
the<br />
GSKit<br />
document:<br />
Secure<br />
Socket<br />
Layer<br />
and<br />
iKeyman<br />
User’s<br />
Guide.<br />
Although<br />
this<br />
test<br />
certificate<br />
allows<br />
<strong>WebSEAL</strong><br />
to<br />
respond<br />
to<br />
an<br />
SSL-enabled<br />
browser<br />
request,<br />
it<br />
cannot<br />
be<br />
verified<br />
by<br />
the<br />
browser<br />
(which<br />
does<br />
not<br />
contain<br />
an<br />
appropriate<br />
root<br />
CA<br />
certificate).<br />
Because<br />
the<br />
private<br />
key<br />
<strong>for</strong><br />
this<br />
default<br />
certificate<br />
is<br />
contained<br />
in<br />
every<br />
<strong>WebSEAL</strong><br />
distribution,<br />
this<br />
certificate<br />
offers<br />
no<br />
true<br />
secure<br />
communication.<br />
You<br />
must<br />
use<br />
the<br />
iKeyman<br />
utility<br />
to<br />
generate<br />
a<br />
certificate<br />
request<br />
that<br />
can<br />
be<br />
sent<br />
to<br />
a<br />
Certificate<br />
Authority<br />
(CA).<br />
Use<br />
iKeyman<br />
to<br />
install<br />
and<br />
label<br />
the<br />
returned<br />
server<br />
certificate.<br />
If<br />
you<br />
use<br />
different<br />
certificates<br />
<strong>for</strong><br />
other<br />
scenarios<br />
(such<br />
as<br />
–K<br />
junctions),<br />
you<br />
can<br />
use<br />
the<br />
iKeyman<br />
utility<br />
to<br />
create,<br />
install,<br />
and<br />
label<br />
these<br />
certificates.<br />
The<br />
keyfile<br />
label<br />
must<br />
not<br />
contain<br />
spaces.<br />
<strong>WebSEAL</strong><br />
(which<br />
by<br />
default<br />
runs<br />
as<br />
user<br />
ivmgr)<br />
must<br />
have<br />
read<br />
(r)<br />
permission<br />
on<br />
these<br />
key<br />
database<br />
files.<br />
Inter-server<br />
SSL<br />
Communication<br />
<strong>for</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong>:<br />
The<br />
[ssl]<br />
stanza<br />
of<br />
the<br />
webseald.conf<br />
configuration<br />
file<br />
contains<br />
four<br />
additional<br />
parameters<br />
used<br />
to<br />
configure<br />
the<br />
keyfile<br />
used<br />
by<br />
<strong>WebSEAL</strong><br />
<strong>for</strong><br />
internal<br />
SSL<br />
communication<br />
with<br />
other<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
servers.<br />
You<br />
should<br />
only<br />
modify<br />
these<br />
parameters<br />
through<br />
the<br />
pdconfig<br />
configuration<br />
script.<br />
[ssl]<br />
ssl-keyfile<br />
=<br />
ssl-keyfile-pwd<br />
=<br />
ssl-keyfile-stash<br />
=<br />
ssl-keyfile-label<br />
=<br />
Using<br />
the<br />
iKeyman<br />
certificate<br />
management<br />
utility<br />
The<br />
iKeyman<br />
utility<br />
is<br />
a<br />
tool<br />
provided<br />
with<br />
GSKit<br />
that<br />
you<br />
can<br />
use<br />
to<br />
manage<br />
digital<br />
certificates<br />
used<br />
by<br />
<strong>WebSEAL</strong>.<br />
Use<br />
iKeyman<br />
to:<br />
230<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language