IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Each
WebSEAL
instance
must
have
a
separate
Kerberos
identity
v
On
Windows,
create
a
separate
Windows
administrative
user
for
each
instance,
and
modify
the
services
configuration
so
that
the
instance
is
started
under
that
user
account.
v
On
UNIX,
create
a
separate
Active
Directory
user
for
each
instance.
Note:
Multiple
WebSEAL
instances
are
supported
with
SPNEGO
when
each
WebSEAL
server
has
a
unique
IP
address
and
host
name.
Multiple
instances
are
not
supported
when
the
instances
listen
on
different
ports
but
share
the
same
IP
address.
Step
2:
Map
Kerberos
principal
to
Active
Directory
user
The
IE
client
request
to
the
Active
Directory
domain
controller
requests
access
to
a
Kerberos
principal
of
name:
HTTP/DNS_name_of_WebSEAL_server@Active_Directory_domain_name
This
name
must
be
mapped
to
the
Active
Directory
user
that
represents
the
WebSEAL
server
instance,
as
created
in
Step
1
above.
This
mapping
requires
the
Windows
ktpass
utility.
The
ktpass
utility
might
not
be
loaded
on
the
Windows
system
by
default.
It
can
be
obtained
from
the
Windows
Support
Tools
package
on
the
Windows
CDs.
Windows
The
configuration
steps
differ
between
configuring
the
first
(default)
WebSEAL
server
and
configuring
multiple
server
instances.
Use
the
appropriate
instructions
that
follow.
Default
(first)
WebSEAL
server:
1.
Register
the
service
principal
name
for
the
WebSEAL
server.
On
the
Active
Directory
domain
controller,
run
the
ktpass.
command.
For
example,
when
the
WebSEAL
host
is
diamond.subnet2.ibm.com,
and
the
Active
Directory
domain
is
IBM.COM.
the
command
is:
ktpass
-princ
HTTP/diamond.subnet2.ibm.com@IBM.COM
-mapuser
diamond$
Note
that
the
value
to
the
-mapuser
option
has
a
dollar
sign
(
$
)
character
at
the
end.
The
user
with
the
dollar
sign
(
$
)
represents
the
local
service
account.
Multiple
WebSEAL
server
instances:
1.
Register
the
service
principal
name
for
the
WebSEAL
server.
On
the
Active
Directory
domain
controller,
run
the
ktpass.
command.
For
example,
when
the
WebSEAL
instance
name
is
web1,
host
name
is
web1.subnet2.ibm.com,
and
the
Active
Directory
domain
is
IBM.COM.
the
command
is:
ktpass
-princ
HTTP/web1.subnet2.ibm.com@IBM.COM
-mapuser
web1
Note:
The
user
specified
by
-mapuser
must
match
the
user
created
in
Step
1
above.
The
-mapuser
option
does
not
create
a
user
account.
2.
Modify
the
service
for
the
instance
so
that
it
starts
using
the
new
user
you
just
created.
Open
the
Services
control
panel
right
click
on
the
service
for
a
new
WebSEAL
server,
and
select
Properties.
Select
the
Log
On
tab,
and
select
the
This
account
radio
button.
For
the
account
name,
enter
the
name
of
the
account
you
just
created.
For
example,
web1@subnet1.ibm.com.
Enter
the
password
for
the
account.
238
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide