IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

1.
Enabling
and
disabling
CDSSO
authentication
To
enable
CDSSO
authentication,
specify
values
for
two
settings
in
the
WebSEAL
configuration
file.
There
is
a
setting
for
the
token
create
(sso-create)
library
and
a
separate
setting
for
the
token
consume
(sso-consume)
library.
To
enable
the
token
create
library,
set
the
following
entry:
[cdsso]
cdsso-create
=
{none|http|https|both}
The
value
both
specifies
both
HTTP
and
HTTPS
protocols.
The
value
none
disables
the
token
create
library.
To
enable
the
token
consume
library,
(this
means
that
the
server
will
accept
CDSSO
tokens
for
authentication)
set
the
following
entry:
[cdsso]
cdsso-auth
=
{none|http|https|both}
The
value
both
specifies
both
HTTP
and
HTTPS
protocols.
The
value
none
disables
the
token
consume
library.
Note:
You
must
stop
and
restart
the
WebSEAL
server
in
order
to
activate
changes
to
the
WebSEAL
configuration
file.
Complete
all
of
the
applicable
configuration
steps
in
this
section
and
then
restart
WebSEAL.
2.
Configuring
the
single
sign-on
authentication
mechanism
The
default
CDSSO
configuration
requires
that
you
enable
the
sso-create
and
sso-consume
single
sign-on
authentication
mechanisms.
The
sso-create
mechanism
is
required
by
the
initial
WebSEAL
server
for
creating
the
CDSSO
token
and
building
the
redirected
request.
The
sso-consume
mechanism
is
required
by
the
receiving
WebSEAL
server
to
decode
the
token
and
build
the
user
credentials
from
the
identity
information
contained
in
the
token.
For
the
default
CDSSO
configuration,
each
parameter
specifies
a
built-in
CDSSO
token
library
file.
One
library
contains
the
code
for
the
token
create
functionality
and
the
other
library
contains
the
code
for
the
token
consume
functionality.
v
On
UNIX,
the
library
files
are
called
libssocreate.
{so
|
a
|
sl}
and
libssoconsume.
{so
|
a
|
sl}.
v
On
Windows,
the
library
files
are
DLL
files
called
ssocreate.dll
and
ssoconsume.dll.
Authentication
Mechanism
Single
Sign-on
Token
Library
Solaris
AIX
Windows
HP-UX
sso-create
libssocreate.so
libssocreate.a
ssocreate.dll
libssocreate.sl
sso-consume
libssoconsume.so
libssoconsume.a
ssoconsume.dll
libssoconsume.sl
You
can
configure
the
CDSSO
authentication
mechanism
by
specifying
the
sso-create
and
sso-consume
parameters
with
the
full
path
name
of
the
appropriate
platform-specific
default
library
file
in
the
[authentication-mechanism]
stanza
of
the
WebSEAL
configuration
file.
For
example:
Solaris:
Chapter
9.
Client
single
sign-on
solutions
249