IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

You
can
configure
the
e-community
authentication
mechanism
by
specifying
the
sso-create
and
sso-consume
parameters
with
the
full
path
name
of
the
appropriate
platform-specific
default
library
file
in
the
[authentication-mechanism]
stanza
of
the
WebSEAL
configuration
file.
For
example:
Solaris:
[authentication-mechanisms]
sso-create
=
/opt/pdwebrte/lib/libssocreate.so
sso-consume
=
/opt/pdwebrte/lib/libssoconsume.so
Windows:
[authentication-mechanisms]
sso-create
=
C:\Program
Files\Tivoli\PDWebRTE\bin\ssocreate.dll
sso-consume
=
C:\Program
Files\Tivoli\PDWebRTE\bin\ssoconsume.dll
4.
Encrypting
the
″vouch
for″
token
WebSEAL
must
encrypt
the
authentication
data
placed
in
the
token
using
a
key
generated
by
the
cdsso_key_gen
utility.
You
must
″synchronize″
this
key
by
sharing
the
key
file
with
each
WebSEAL
server
in
each
participating
domain.
Each
participating
WebSEAL
server
in
each
domain
needs
to
use
the
same
key.
Note:
The
distribution
of
key
files
is
not
a
part
of
the
Tivoli
Access
Manager
e-community
process.
You
must
manually
and
securely
copy
keys
to
each
participating
server.
The
cdsso_key_gen
utility
requires
that
you
specify
the
location
(absolute
pathname)
of
the
key
file
when
you
run
the
utility.
You
must
also
use
a
full
path
name
to
run
this
utility:
UNIX:
#
/opt/pdwebrte/bin/cdsso_key_gen
Windows:
MSDOS>
C:\Program
Files\Tivoli\PDWebRTE\bin\cdsso_key_gen
The
location
of
the
key
files
used
to
secure
tokens
sent
between
servers
participating
in
the
e-community
is
specified
in
the
[e-community-domain-keys]
stanza.
[e-community-domain-keys]
=
=
E-community
Domain
Keys
The
location
of
the
key
files
required
for
encrypting
and
decrypting
the
tokens
exchanged
among
the
servers
participating
in
the
e-community
is
specified
in
the
[e-community-domain-keys]
stanza.
You
must
specify
fully
qualified
domain
names
for
the
servers
and
absolute
path
names
for
the
key
file
locations.
The
following
example
provides
the
MAS
(domain
A)
with
key
files
for
communicating
with
two
remote
domains(dB
and
dC)
and
a
key
for
communicating
with
other
servers
in
domain
A:
Chapter
9.
Client
single
sign-on
solutions
267