IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

4.
Configuring
the
token
time
stamp
The
token
contains
a
configurable
time
stamp
that
defines
the
lifetime
of
the
identity
token.
After
the
time
stamp
has
expired,
the
token
is
considered
invalid
and
is
not
used.
The
time
stamp
is
used
to
help
prevent
replay
attacks
by
setting
a
value
short
enough
to
prevent
the
token
from
being
stolen
and
replayed
within
its
lifetime.
The
authtoken-lifetime
parameter,
located
in
the
[cdsso]
stanza
of
the
WebSEAL
configuration
file,
sets
the
token
lifetime
value.
The
value
is
expressed
in
seconds.
The
default
value
is
180:
[cdsso]
authtoken-lifetime
=
180
You
must
take
into
account
any
clock
skew
among
the
participating
domains.
Clock
skew
means
that
the
system
times
differ
on
the
relevant
servers
in
each
domain.
When
this
difference
approaches
the
value
of
authtoken-lifetime,
the
effective
lifetime
of
the
token
is
greatly
reduced.
When
this
difference
exceeds
the
value
of
authtoken-lifetime,
tokens
from
one
domain
cannot
be
valid
for
the
other
domain.
Administrators
should
adjust
authtoken-lifetime
accordingly.
However,
when
clock
skew
requires
that
authtoken-lifetime
be
set
to
a
large
value,
the
risk
of
replay
attacks
increases.
In
this
case,
administrators
should
consider
synchronizing
the
system
time
on
the
relevant
servers
in
each
domain.
See
“Cross-domain
single
sign-on”
on
page
428.
5.
Configuring
the
token
label
name
The
authentication
information
used
for
a
single
sign-on
transaction
is
placed
in
the
redirected
request
as
an
encrypted
token
query
string
argument
to
the
request.
This
token
string
requires
a
name,
or
label,
to
identify
it.
The
label
name
uniquely
identifies
the
request
to
the
receiving
WebSEAL
server
as
a
single
sign-on
request
to
be
handled
by
the
CDSSO
token
consume
mechanism
(library).
You
must
configure
this
token
label
identically
on
both
WebSEAL
servers
participating
in
the
single
sign-on
functionality.
To
configure
the
token
label,
use
the
cdsso-argument
parameter
located
in
the
[cdsso]
stanza
of
the
WebSEAL
configuration
file.
For
example
(default):
[cdsso]
cdsso-argument
=
PD-ID
See
“Cross-domain
single
sign-on”
on
page
428.
Creating
the
CDSSO
HTML
link
The
HTML
link
(located
on
the
original
server)
that
connects
the
user
to
a
resource
on
the
destination
server
must
use
a
special
CDSSO
expression
that
directs
the
request
to
a
CDSSO
management
page
pkmscdsso:
/pkmscdsso?
For
example:
http://websealA/pkmscdsso?https://websealB/resource.html
The
token
create
library
creates
and
encodes
an
authentication
token
(containing
the
user’s
identity
information)
and
includes
this
token
in
a
redirected
request
to
the
resource
using
the
destination
URL
information
from
the
CDSSO
link.
For
example:
Chapter
9.
Client
single
sign-on
solutions
251