IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Cross-domain
single
sign-on
The
Tivoli
Access
Manager
Cross-Domain
Single
Sign-on
(CDSSO)
provides
a
default
mechanism
for
transferring
user
credentials
between
unique
servers
and
domains.
CDSSO
allows
Web
users
to
perform
a
single
sign-on
and
move
seamlessly
between
two
separate
secure
domains
when
requesting
a
resource.
The
CDSSO
authentication
mechanism
does
not
rely
on
a
Master
Authentication
Server
or
MAS
(see
“e-community
single
sign-on”
on
page
256).
CDSSO
supports
the
goals
of
scalable
network
architecture
by
allowing
the
integration
of
multiple
secure
domains.
For
example,
a
large
corporate
extranet
can
be
set
up
with
two
or
more
unique
domains—each
with
its
own
users
and
object
space.
CDSSO
allows
movement
of
users
between
the
domains
with
a
single
sign-on.
When
a
user
makes
a
request
to
a
resource
located
in
another
domain,
the
CDSSO
mechanism
transfers
an
encrypted
user
identity
token
from
the
first
domain
to
the
second
domain.
The
identity
information
in
this
token
indicates
to
the
receiving
domain
that
the
user
is
successfully
authenticated
in
the
first
domain.
The
identity
does
not
contain
password
information.
The
receiving
server
uses
this
token
to
build
credentials
in
its
own
cache
for
that
user.
The
user
is
not
forced
to
perform
an
additional
login.
Customizing
single
sign-on
authentication
Cross-domain
single
sign-on
solutions
employ
authentication
tokens
that
convey
an
encoded
version
of
the
user
identity
to
the
destination
server.
The
construction
of
these
tokens
by
the
initial
server
is
called
″token
creation.″
The
decoding
and
use
of
the
token
by
the
destination
server
is
called
″token
consumption.″
You
can
create
custom
token
create
and
consume
libraries
to
meet
the
specific
requirements
of
your
network
and
Tivoli
Access
Manager
implementation.
Complete
information
and
API
reference
material
for
cross-domain
external
authentication
can
be
found
in
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference.
In
many
CDSSO
scenarios,
the
default
one-to-one
mapping
between
users
in
different
domains
might
not
suit
all
deployment
requirements.
The
cross-domain
mapping
frameWork
(CDMF)
is
a
programming
interface
that
allows
you
to
build
a
custom
shared
library
that
can
handle
extended
user
attributes
and
provide
mapping
services
for
the
user
identity.
The
CDMF
programming
interface
allows
flexibility
in
customizing
the
mapping
of
user
identities
and
the
handling
of
user
attributes.
Complete
information
and
API
reference
material
for
CDMF
can
be
found
in
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference.
Authentication
process
flow
for
CDSSO
with
CDMF
The
following
process
flow
description
is
illustrated
in
Figure
8.
1.
Any
user
who
wants
to
participate
in
multiple
domains
must
have
a
valid
user
account
in
the
initial
domain
and
an
identity
that
can
be
mapped
into
a
valid
account
in
each
of
the
participating
remote
domains.
A
user
cannot
invoke
the
CDSSO
functionality
without
initially
authenticating
to
an
initial
secure
domain
(A)
that
contains
the
user’s
account.
2.
The
user
makes
a
request
to
access
a
resource
in
domain
B
via
a
custom
link
on
a
Web
page.
Chapter
9.
Client
single
sign-on
solutions
245