IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Enable
backwards
compatibility
for
Version
4.1
tokens
For
Tivoli
Access
Manager
Version
5.1,
the
format
of
the
encryption
of
the
authentication
token
was
changed.
This
encryption
algorithm
is
not
backward
compatible.
If
you
are
integrating
authentication
tokens
with
Version
4.1
WebSEAL
servers,
you
must
specify
a
configuration
file
setting
in
the
WebSEAL
configuration
file
to
enable
backwards
compatibility.
Backwards
compatibility
with
the
older
encryption
format
is
not
enabled
by
default:
[server]
pre-510-compatible-tokens
=
no
To
enable
backwards
compatibility,
set
pre-510-compatible-tokens
to
yes:
[server]
pre-510-compatible-tokens
=
yes
Note:
To
enable
backwards
compatibility
with
WebSEAL
servers
prior
to
Version
4.1,
you
must
set
an
additional
parameter.
See
“Enabling
compatibility
with
tokens
prior
to
Version
4.1”
on
page
252.
Specify
extended
attributes
to
add
to
token
In
the
WebSEAL
configuration
file,
you
can
specify
extended
attributes
from
a
user
credential
to
add
to
the
cross-domain
single
sign-on
token.
Extended
attributes
consist
of
information
about
a
user
identity
that
is
added
to
an
extended
attribute
list
when
a
user
credential
is
created.
Extended
attributes
can
be
added
by
a
number
of
authentication
mechanisms,
including
custom
authentication
modules.
The
custom
authentication
modules
can
be
used,
for
example,
to
obtain
user
information
from
a
registry
that
is
external
to
Tivoli
Access
Manager.
You
can
use
this
setting
to
customize
the
contents
of
the
cross-domain
single
sign-on
token.
This
feature
enables
you
to
tailor
the
token
contents
to
match
the
needs
of
the
destination
domain.
When
you
use
this
feature
to
add
an
attribute
to
a
token,
you
must
also
configure
the
WebSEAL
configuration
file
for
the
server
in
the
destination
domain.
For
the
destination
server,
the
stanza
[cdsso-incoming-
attributes]
is
used
to
specify
the
handling
(extract
or
ignore)
of
each
attribute.
You
can
specify
extended
attributes
by
name,
or
you
can
declare
a
pattern
that
matches
multiple
attribute
names.
You
can
use
standard
Tivoli
Access
Manager
wildcard-matching
characters.
Table
33.
Supported
wildcard
matching
characters
Character
Description
\
The
character
that
follows
the
backslash
is
part
of
a
special
sequence.
Can
be
used
to
escape
the
other
pattern
matching
characters:
(
?
*
[
]
^
).
To
match
the
backslash
character,
use
″\\″..
?
Wildcard
that
matches
a
single
character.
For
example,
the
string
“abcde”
is
matched
by
the
expression
“ab?de”
*
Wildcard
that
matches
zero
or
more
characters.
[]
Defines
a
set
of
characters,
from
which
any
can
match.
For
example,
the
string
“abcde”
is
matched
with
the
regular
expression
“ab[cty]de”.
^
Indicates
a
negation.
For
example,
the
expression
[^ab]
matches
anything
but
the
‘a’
or
‘b’
characters.
Chapter
9.
Client
single
sign-on
solutions
253