IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
The
domain-specific
cookie
contains
the
name
of
the
″vouch
for″
server,
the
e-community
identity,
a
location
(URL)
of
the
″vouch
for″
server
and
functionality,
and
a
lifetime
value.
The
cookie
contains
no
user
or
security
information.
v
The
e-community
cookie
allows
servers
in
participating
domains
to
request
″vouch
for″
information
locally.
The
e-community
cookie
for
the
domain
where
the
MAS
resides
plays
a
less
significant
role.
v
The
cookie
has
a
lifetime
(timeout)
value
that
is
set
in
the
WebSEAL
configuration
file.
This
lifetime
value
specifies
how
long
a
remote
server
is
able
to
provide
″vouch
for″
information
for
the
user.
When
the
cookie
lifetime
has
expired,
the
user
must
be
redirected
to
the
MAS
for
authentication.
v
The
cookie
is
cleared
from
memory
when
the
browser
is
closed.
If
the
user
logs
out
of
a
specific
domain,
the
e-community
cookie
is
overwritten
as
empty.
This
action
effectively
removes
it
from
the
browser.
Understanding
the
″vouch
for″
request
and
reply
The
e-community
″vouch
for″
operation
requires
dedicated
functionality
accessed
through
two
specially
constructed
URLs:
the
″vouch
for″
request
and
the
″vouch
for″
reply.
The
″vouch
for″
Request
The
″vouch
for″
request
is
triggered
when
a
user
requests
a
resource
from
a
target
server
(configured
for
e-community)
that
contains
no
credential
information
for
that
user.
The
server
sends
a
redirect
to
the
″vouch
for″
server
(either
the
MAS
or
a
delegated
″vouch
for″
server
identified
in
an
e-community
cookie).
The
″vouch
for″
request
contains
the
following
information:
https:///pkmsvouchfor?&
The
receiving
server
checks
the
ecommunity-name
to
validate
the
e-community
identity.
The
receiving
server
uses
the
target-URL
in
the
″vouch
for″
reply
to
redirect
the
browser
back
to
the
originally
requested
page.
The
pkmsvouchfor
″vouch
for″
URL
is
configurable.
For
example:
https://mas.dA.com/pkmsvouchfor?companyABC&https://ws5.dB.com/index.html
The
″vouch
for″
Reply
The
″vouch
for″
reply
is
the
response
from
the
″vouch
for″
server
to
the
target
server.
The
″vouch
for″
server
is
either
the
MAS
or
a
delegated
″vouch
for″
server
in
a
domain
remote
from
the
MAS
domain.
The
″vouch
for″
reply
contains
the
following
information:
https://?PD-VFHOST=&PD-VF=
The
PD-VFHOST
label
identifies
the
server
that
performed
the
″vouch
for″
operation.
The
receiving
(target)
server
uses
this
information
to
select
the
correct
key
required
to
decrypt
the
″vouch
for″
token.
The
PD-VF
label
identifies
the
encrypted
token
in
the
″vouch
for″
reply
URL.
For
example:
https://w5.dB.com/index.html?PD-VFHOST=mas.dA.com&PD-VF=3qhe9fjkp...ge56wgb
262
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide