IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[authentication-mechanisms]
sso-create
=
/opt/pdwebrte/lib/libssocreate.so
sso-consume
=
/opt/pdwebrte/lib/libssoconsume.so
Windows:
[authentication-mechanisms]
sso-create
=
C:\Program
Files\Tivoli\PDWebRTE\bin\ssocreate.dll
sso-consume
=
C:\Program
Files\Tivoli\PDWebRTE\bin\ssoconsume.dll
3.
Encrypting
the
authentication
token
data
WebSEAL
must
encrypt
the
authentication
data
placed
in
the
token
using
a
key
generated
by
the
cdsso_key_gen
utility.
You
must
″synchronize″
this
key
by
sharing
the
key
file
with
each
participating
WebSEAL
server
in
each
participating
domain.
Each
participating
WebSEAL
server
in
each
domain
needs
to
use
the
same
key.
The
generated
key
is
a
triple
DES
192
bit
key.
You
cannot
specify
a
life
span
time
on
this
key.
Note:
The
distribution
of
key
files
is
not
a
part
of
the
Tivoli
Access
Manager
CDSSO
process.
The
cdsso_key_gen
utility
requires
that
you
specify
the
location
(absolute
path
name)
of
the
key
file
when
you
run
the
utility.
You
must
also
use
a
full
path
name
to
run
this
utility:
UNIX:
#
/opt/pdwebrte/bin/cdsso_key_gen
Windows:
MSDOS>
C:\Program
Files\Tivoli\PDWebRTE\bin\cdsso_key_gen
Enter
this
key
file
location
in
the
[cdsso-peers]
stanza
of
the
WebSEAL
configuration
file
of
the
participating
WebSEAL
server
in
each
domain.
The
format
must
include
the
fully
qualified
host
name
of
the
WebSEAL
server
and
the
absolute
path
name
to
the
key
file
location:
[cdsso-peers]
=
Configuration
example
for
server
websealA
in
domain
A:
[cdsso-peers]
websealB.domainB.com
=
/A-B.key
This
setting
specifies
what
key
websealA
uses
to
encrypt
a
token
destined
for
websealB
in
domain
B.
Configuration
example
for
server
websealB
in
domain
B:
[cdsso-peers]
websealA.domainA.com
=
/A-B.key
This
setting
specifies
what
key
websealB
(in
domain
B)
uses
to
decrypt
a
token
received
from
websealA
in
domain
A.
In
the
above
example,
the
A-B.key
file
is
generated
on
one
machine
(websealA,
for
example)
and
manually
(and
securely)
copied
to
the
other
machine
(websealB,
for
example).
250
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide