IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
3.<br />
<strong>WebSEAL</strong><br />
2<br />
redirects<br />
the<br />
browser<br />
to<br />
a<br />
special<br />
″vouch<br />
<strong>for</strong>″<br />
URL<br />
on<br />
the<br />
domain<br />
A<br />
″vouch<br />
<strong>for</strong>″<br />
server<br />
identified<br />
in<br />
the<br />
cookie<br />
(in<br />
this<br />
case<br />
the<br />
MAS,<br />
because<br />
<strong>WebSEAL</strong><br />
2<br />
is<br />
in<br />
domain<br />
A).<br />
4.<br />
The<br />
MAS<br />
receives<br />
the<br />
″vouch<br />
<strong>for</strong>″<br />
request<br />
and<br />
finds<br />
credentials<br />
<strong>for</strong><br />
that<br />
user<br />
in<br />
the<br />
cache<br />
(this<br />
occurred<br />
in<br />
scenario<br />
1<br />
and<br />
2).<br />
5.<br />
The<br />
MAS<br />
redirects<br />
the<br />
browser<br />
back<br />
to<br />
the<br />
originally<br />
requested<br />
URL<br />
on<br />
<strong>WebSEAL</strong><br />
2<br />
with<br />
an<br />
encrypted<br />
″vouch<br />
<strong>for</strong>″<br />
token.<br />
6.<br />
<strong>WebSEAL</strong><br />
2<br />
decrypts<br />
the<br />
token<br />
and<br />
builds<br />
its<br />
own<br />
credential<br />
<strong>for</strong><br />
the<br />
user.<br />
7.<br />
The<br />
authorization<br />
service<br />
permits<br />
or<br />
denies<br />
the<br />
request.<br />
(4)<br />
NEXT<br />
e-Community<br />
Remote<br />
(Domain<br />
B)<br />
<strong>Access</strong>:<br />
<strong>WebSEAL</strong><br />
4<br />
1.<br />
User<br />
requests<br />
a<br />
resource<br />
protected<br />
by<br />
<strong>WebSEAL</strong><br />
4<br />
(remote<br />
domain<br />
B).<br />
If<br />
scenario<br />
2<br />
occurred<br />
first,<br />
the<br />
browser<br />
contains<br />
a<br />
domain<br />
B<br />
e-community<br />
cookie<br />
identifying<br />
<strong>WebSEAL</strong><br />
3<br />
as<br />
the<br />
″vouch<br />
<strong>for</strong>″<br />
server.<br />
<strong>WebSEAL</strong><br />
4<br />
has<br />
no<br />
cached<br />
credentials<br />
<strong>for</strong><br />
the<br />
user.<br />
2.<br />
<strong>WebSEAL</strong><br />
4<br />
configuration<br />
has<br />
e-community<br />
authentication<br />
enabled<br />
and<br />
specifies<br />
the<br />
location<br />
of<br />
the<br />
MAS.<br />
The<br />
presence<br />
of<br />
a<br />
domain<br />
B<br />
e-community<br />
cookie<br />
overrides<br />
the<br />
<strong>WebSEAL</strong><br />
4<br />
configuration<br />
<strong>for</strong><br />
the<br />
MAS<br />
location.<br />
The<br />
cookie<br />
provides<br />
<strong>WebSEAL</strong><br />
4<br />
with<br />
the<br />
identity<br />
of<br />
the<br />
″vouch<br />
<strong>for</strong>″<br />
server.<br />
(If<br />
scenario<br />
1<br />
occurred<br />
first,<br />
there<br />
would<br />
only<br />
be<br />
a<br />
domain<br />
A<br />
cookie<br />
maintained<br />
on<br />
the<br />
browser<br />
that<br />
would<br />
not<br />
be<br />
sent<br />
to<br />
a<br />
domain<br />
B<br />
server.<br />
The<br />
configured<br />
MAS<br />
location<br />
would<br />
be<br />
used<br />
instead.<br />
<strong>WebSEAL</strong><br />
4<br />
would<br />
then<br />
become<br />
the<br />
″vouch<br />
<strong>for</strong>″<br />
server<br />
<strong>for</strong><br />
domain<br />
B.)<br />
3.<br />
If<br />
scenario<br />
2<br />
occurred<br />
first,<br />
<strong>WebSEAL</strong><br />
4<br />
redirects<br />
the<br />
browser<br />
to<br />
a<br />
special<br />
″vouch<br />
<strong>for</strong>″<br />
URL<br />
on<br />
the<br />
domain<br />
B<br />
″vouch<br />
<strong>for</strong>″<br />
server<br />
identified<br />
in<br />
the<br />
domain<br />
B<br />
cookie<br />
(in<br />
this<br />
case<br />
<strong>WebSEAL</strong><br />
3).<br />
4.<br />
<strong>WebSEAL</strong><br />
3<br />
receives<br />
the<br />
″vouch<br />
<strong>for</strong>″<br />
request<br />
and<br />
finds<br />
credentials<br />
<strong>for</strong><br />
that<br />
user<br />
in<br />
the<br />
cache<br />
(this<br />
occurred<br />
in<br />
scenario<br />
2).<br />
5.<br />
<strong>WebSEAL</strong><br />
3<br />
redirects<br />
the<br />
browser<br />
back<br />
to<br />
the<br />
originally<br />
requested<br />
URL<br />
on<br />
<strong>WebSEAL</strong><br />
4<br />
with<br />
an<br />
encrypted<br />
″vouch<br />
<strong>for</strong>″<br />
token.<br />
6.<br />
<strong>WebSEAL</strong><br />
4<br />
decrypts<br />
the<br />
token<br />
and<br />
builds<br />
its<br />
own<br />
credential<br />
<strong>for</strong><br />
the<br />
user.<br />
7.<br />
The<br />
authorization<br />
service<br />
permits<br />
or<br />
denies<br />
the<br />
request.<br />
(5)<br />
ANOTHER<br />
e-Community<br />
Local<br />
(Domain<br />
A)<br />
<strong>Access</strong>:<br />
<strong>WebSEAL</strong><br />
2<br />
1.<br />
User<br />
connects<br />
to<br />
<strong>WebSEAL</strong><br />
2<br />
(domain<br />
A)<br />
with<br />
a<br />
request.<br />
If<br />
scenario<br />
3<br />
occurred,<br />
<strong>WebSEAL</strong><br />
2<br />
has<br />
cached<br />
credentials<br />
<strong>for</strong><br />
the<br />
user.<br />
2.<br />
The<br />
authorization<br />
service<br />
permits<br />
or<br />
denies<br />
the<br />
request.<br />
Logout<br />
from<br />
the<br />
e-Community<br />
v<br />
If<br />
the<br />
user<br />
logs<br />
out<br />
by<br />
closing<br />
the<br />
browser,<br />
all<br />
SSL<br />
sessions<br />
and<br />
all<br />
e-community<br />
cookies<br />
are<br />
cleared.<br />
v<br />
If<br />
the<br />
user<br />
logs<br />
out<br />
via<br />
the<br />
/pkmslogout<br />
page,<br />
the<br />
SSL<br />
session<br />
and<br />
e-community<br />
cookie<br />
<strong>for</strong><br />
that<br />
domain<br />
are<br />
cleared.<br />
Understanding<br />
the<br />
e-community<br />
cookie<br />
v<br />
The<br />
e-community<br />
cookie<br />
is<br />
a<br />
domain-specific<br />
cookie<br />
set<br />
by<br />
one<br />
<strong>WebSEAL</strong><br />
server,<br />
stored<br />
in<br />
the<br />
memory<br />
of<br />
the<br />
user’s<br />
browser,<br />
and<br />
transmitted<br />
to<br />
other<br />
<strong>WebSEAL</strong><br />
servers<br />
(in<br />
the<br />
same<br />
domain)<br />
in<br />
subsequent<br />
requests.<br />
Chapter<br />
9.<br />
Client<br />
single<br />
sign-on<br />
solutions<br />
261