IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
link
contains
a
special
CDSSO
management
page
expression:
/pkmscdsso?
For
example:
http://websealA/pkmscdsso?https://websealB/resource.html
3.
The
request
is
first
processed
by
the
WebSEAL
server
in
domain
A.
The
websealA
server
builds
an
authentication
token
that
contains
the
user’s
credentials,
including
the
Tivoli
Access
Manager
identity
(short
name),
the
current
domain
(″A″),
additional
user
information,
and
a
time
stamp.
This
process
is
performed
by
the
″token
create″
function
of
the
built-in
single
sign-on
authentication
mechanism
(library).
The
additional
user
information
(extended
attributes)
can
be
obtained
by
a
call
out
to
the
customized
CDMF
shared
library
(cdmf_get_usr_attributes).
This
library
has
the
ability
to
supply
user
attributes
that
can
be
used
by
domain
B
during
the
user
mapping
process.
WebSEAL
triple-DES
encrypts
this
token
data
with
the
symmetric
key
generated
by
the
cdsso_key_gen
utility.
This
key
file
is
shared
and
specified
in
the
[cdsso-peers]
stanza
of
the
WebSEAL
configuration
file
on
both
domain
A
and
domain
B
WebSEAL
servers.
The
token
contains
a
configurable
time
stamp
(authtoken-lifetime)
that
defines
the
lifetime
of
the
token.
The
time
stamp,
when
properly
configured,
can
prevent
replay
attacks.
The
token
is
contained
in
a
redirected
request
to
the
destination
server,
using
the
URL
contained
in
the
pkmscdsso
link.
For
example:
http://websealB/resource.html?PD-ID=
4.
The
websealA
server
redirects
the
request
containing
the
encrypted
token
back
to
the
browser
and
then
to
the
websealB
server
(HTTP
redirection).
5.
The
websealB
server
decodes
and
validates
the
token
as
coming
from
the
referring
domain.
This
process
is
performed
by
the
″token
consume″
function
of
the
built-in
single
sign-on
authentication
mechanism
(library).
6.
The
token
consume
functionality
can
further
call
out
to
a
customized
CDMF
library
which
performs
the
actual
user
mapping
(cdmf_map_usr).
The
CDMF
library
passes
the
user’s
identity,
and
any
extended
attribute
information,
back
to
the
token
consume
library.
The
token
consume
library
uses
this
information
to
build
a
credential.
7.
The
websealB
authorization
service
permits
or
denies
access
to
protected
objects
based
on
the
user’s
credential
and
the
specific
ACL
permissions
associated
with
the
requested
objects.
246
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide