IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

However,
the
Tivoli
Access
Manager
Web
Plug-in
for
IIS
supports
NTLM.
WebSEAL
can
be
deployed
in
an
e-community
single
signon
solution
that
uses
the
Web
Plug-in
for
IIS
to
accomplish
SPNEGO
authentication
using
NTLM.
v
Using
SPNEGO
simultaneously
with
other
authentication
methods
does
not
work
with
Netscape
4.7
Windows
desktop
single
sign-on
configuration
This
section
contains
the
configuration
steps
that
must
be
completed
to
implement
Windows
desktop
single
signon
using
SPNEGO
authentication
with
WebSEAL.
Not
all
steps
are
required
on
each
platform.
To
configure
SPNEGO
authentication,
complete
each
of
the
following
steps:
v
“Step
1:
Configure
WebSEAL
server
into
Active
Directory
domain”
v
“Step
2:
Map
Kerberos
principal
to
Active
Directory
user”
on
page
238
v
“Step
3:
Install
Kerberos
runtime
client
(UNIX
only)”
on
page
240
v
“Step
4:
Configure
Kerberos
client
(UNIX
only)”
on
page
240
v
“Step
5:
Verify
authentication
of
Web
server
principal
(UNIX
only)”
on
page
241
v
“Step
6:
Verify
WebSEAL
authentication
using
the
keytab
file
(UNIX
only)”
on
page
242
v
“Step
7:
Enable
SPNEGO
for
WebSEAL”
on
page
242
v
“Step
8:
Add
service
name
and
keytab
file
entries
(UNIX
only)”
on
page
242
v
“Step
9:
Restart
WebSEAL”
on
page
243
v
“Step
10:
Configure
the
Internet
Explorer
client”
on
page
243
Troubleshooting
information:
v
“Troubleshooting
tips”
on
page
243
Step
1:
Configure
WebSEAL
server
into
Active
Directory
domain
To
participate
in
a
Kerberos
exchange
with
IE,
a
WebSEAL
server
must
have
an
identity
in
the
Active
Directory
Kerberos
domain.
This
requires
that
WebSEAL
be
registered
with
the
Active
Directory
domain
controller.
This
enables
the
IE
browser
to
obtain
a
Kerberos
ticket
from
the
Active
Directory
domain
controller
in
order
to
access
the
WebSEAL
server.
See
the
Microsoft
documentation
for
instructions
on
how
to
add
an
identity
for
the
WebSEAL
server
host
into
an
Active
Directory
domain.
Notes:
v
On
Windows,
the
default
WebSEAL
server
(first
server
instance)
uses
the
Local
Service
Account
identity
when
contacting
the
Active
Directory
domain
controller.
Additional
WebSEAL
server
instances
must
be
configured
to
use
a
different
user
account.
The
user
account
must
match
a
unique
Active
Directory
user
for
the
WebSEAL
server
identity.
v
On
UNIX,
ensure
that
the
user
name
matches
the
host
name
of
the
WebSEAL
server
host.
Do
not
use
the
full
domain
name.
For
example,
for
the
system
diamond.subnet2.ibm.com,
create
a
user
diamond.
Do
not
require
the
user
to
change
password
at
next
log
in.
Do
not
set
the
password
to
expire.
v
Ensure
that
DNS
is
configured
properly
for
each
of
the
participating
machine.
One
way
to
confirm
this
is
to
run
forward
and
reverse
nslookup
on
each
machine.
Multiple
WebSEAL
instances
Chapter
9.
Client
single
sign-on
solutions
237