IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

1.
Enabling
and
disabling
e-community
authentication
The
e-community-sso-auth
parameter,
located
in
the
[e-community-sso]
stanza
of
the
WebSEAL
configuration
file,
enables
and
disables
the
e-community
authentication
method,
and
processes
single
sign-on
requests
by
communication
type.
v
To
enable
the
e-community
authentication
method,
enter
″http″,
″https″,
or
″both″.
The
values
″http″,
″https″,
and
″both″
specify
the
type
of
communication
used
by
e-community
participants.
v
To
disable
the
e-community
authentication
method,
enter
″none″.
The
value
″none″
disables
e-community
for
that
server.
The
default
setting
is
″none″.
For
example:
[e-community-sso]
e-community-sso-auth
=
https
Note:
You
must
stop
and
restart
the
WebSEAL
server
in
order
to
activate
changes
to
the
WebSEAL
configuration
file.
Complete
all
of
the
applicable
configuration
steps
in
this
section
and
then
restart
WebSEAL.
2.
Specifying
an
e-community
name
The
e-community-name
parameter
identifies
the
unifying
name
of
the
e-community
for
all
participating
servers
in
all
participating
domains.
For
example:
[e-community-sso]
e-community-name
=
companyABC
The
e-community-name
value
must
be
the
same
for
all
WebSEAL
servers
in
all
domains
that
are
participating
in
the
e-community.
3.
Configuring
the
single
sign-on
authentication
mechanism
The
default
e-community
configuration
requires
that
you
enable
the
sso-create
and
sso-consume
single
sign-on
authentication
mechanisms.
The
sso-create
mechanism
is
required
by
the
initial
WebSEAL
server
for
creating
the
″vouch
for″
token
and
building
the
redirected
request.
The
sso-consume
mechanism
is
required
by
the
receiving
WebSEAL
server
to
decode
the
″vouch
for″
token
and
build
the
user
credentials
from
the
identity
information
contained
in
the
token.
For
the
default
e-community
configuration,
each
parameter
specifies
a
built-in
″vouch
for″
token
library
file.
One
library
contains
the
code
for
the
token
create
functionality
and
the
other
library
contains
the
code
for
the
token
consume
functionality.
v
On
UNIX,
the
library
files
are
called
libssocreate.
{so
|
a
|
sl}
and
libssoconsume.
{so
|
a
|
sl}.
v
On
Windows,
the
library
files
are
DLL
files
called
ssocreate.dll
and
ssoconsume.dll.
Authentication
Mechanism
Single
Sign-on
Token
Library
Solaris
AIX
Windows
HP-UX
sso-create
libssocreate.so
libssocreate.a
ssocreate.dll
libssocreate.sl
sso-consume
libssoconsume.so
libssoconsume.a
ssoconsume.dll
libssoconsume.sl
266
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide