IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

http://websealB/resource.html?PD-ID=
Protecting
the
authentication
token
While
the
authentication
token
does
not
contain
authentication
information
(such
as
user
name
and
password),
it
does
contain
a
user
identity
that
is
trusted
within
the
receiving
domain.
The
token
itself
must
therefore
be
protected
against
theft
and
replay.
The
token
is
protected
against
theft
off
the
wire
through
the
use
of
SSL
to
secure
communications
between
the
WebSEAL
servers
and
the
users.
The
token
could
conceivably
be
stolen
from
the
user’s
browser
history.
The
time
stamp
on
the
token
should
be
short
enough
to
make
it
unlikely
that
the
token
could
be
stolen
and
replayed
during
the
lifetime
of
the
token.
However,
a
token
that
has
expired
with
respect
to
its
time
stamp
is
still
vulnerable
to
cryptographic
attacks.
If
the
key
used
to
encrypt
the
token
is
discovered
or
otherwise
compromised,
malicious
users
could
build
their
own
tokens.
These
tokens
could
then
be
inserted
into
a
″pseudo-CDSSO
flow.″
They
would
be
indistinguishable
from
real
authentication
tokens
to
the
WebSEAL
servers
participating
in
the
CDSSO
domain.
For
this
reason,
the
keys
used
to
protect
the
tokens
must
also
be
carefully
managed
and
changed
on
a
regular
basis.
UTF-8
encoding
of
tokens
for
cross
domain
single
sign-on
The
use
of
UTF-8
encoding
for
strings
within
tokens
used
for
cross
domain
single
sign-on
is
specified
in
the
WebSEAL
configuration
file.
[cdsso]
use-utf8
=
{true|false}
The
default
value
is
true.
When
use-utf8
is
set
to
false,
strings
are
encoded
using
the
local
code
page.
Use
this
value
when
implementing
cross
domain
single
sign-on
with
older
(pre-Version
5.1)
WebSEAL
servers.
WebSEAL
servers
from
versions
prior
to
5.1
do
not
use
UTF-8
encoding
for
tokens.
When
deploying
an
environment
that
includes
these
older
servers,
configure
the
Version
5.1
WebSEAL
server
to
not
use
UTF-8
encoding.
This
setting
is
necessary
for
backwards
compatibility.
For
more
information
on
WebSEAL
support
for
UTF-8
encoding,
see
“Multi-locale
support
with
UTF-8”
on
page
44.
Enabling
compatibility
with
tokens
prior
to
Version
4.1
In
the
Version
4.1
release
of
Tivoli
Access
Manager,
the
level
of
security
for
the
encryption
of
the
authentication
token
was
increased.
The
Version
4.1
encryption
algorithm
is
not
backward
compatible.
If
you
are
integrating
CDSSO
with
servers
using
versions
of
Tivoli
Access
Manager
prior
to
Version
4.1,
you
must
enable
the
pre-410-compatible-tokens
parameter
in
the
[server]
stanza
of
the
WebSEAL
configuration
file.
For
example:
pre-410-compatible-tokens
=
yes
The
default
setting
for
this
parameter
is
″no″.
252
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide