IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[e-community-domain-keys]
dA.com
=
/abc/xyz/key.fileA-A
dB.com
=/abc/xyz/key.fileA-B
dC.com
=/abc/xyz/key.fileA-C
In
this
example,
key.fileA-A
identifies
the
key
file
used
between
all
of
the
servers
in
domainA.
key.fileA-B
identifies
the
key
file
used
between
domain
A
and
domain
B.
key.fileA-C
identifies
the
key
file
used
between
domain
A
and
domain
C.
Each
remote
server
needs
to
have
a
copy
of
the
appropriate
key
file
used
by
the
MAS.
To
exchange
tokens
with
the
MAS
(domain
A),
all
servers
in
domain
B
require
copies
of
key.fileA-B:
[e-community-domain-keys]
dA.com
=/efg/hij/key.fileA-B
To
exchange
tokens
with
the
MAS
(domain
A),
all
servers
in
domain
C
require
copies
of
key.fileA-C:
[e-community-domain-keys]
dA.com
=/efg/hij/key.fileA-C
Any
servers
in
domain
A
which
use
authentication
services
provided
by
the
MAS
must
have
a
copy
of
key.fileA-A:
[e-community-domain-keys]
dA.com
=/efg/hij/key.fileA-A
In
this
example,
key.fileB-B
identifies
the
key
file
used
between
all
of
the
servers
in
domainB.
Also,
key.fileC-C
identifies
the
key
file
used
between
all
of
the
servers
in
domainC
[e-community-domain-keys]
dB.com
=/efg/hij/key.fileB-B
dC.com
=/efg/hij/key.fileC-C
5.
Configuring
the
″vouch
for″
token
label
name
The
authentication
information
used
for
a
single
sign-on
transaction
is
placed
in
the
redirected
request
as
an
encrypted
token
query
string
argument
to
the
request.
This
token
string
requires
a
name,
or
label,
to
identify
it.
The
label
name
uniquely
identifies
the
request
to
the
receiving
WebSEAL
server
as
a
single
sign-on
request
to
be
handled
by
the
single
sign-on
token
consume
mechanism
(library).
You
must
configure
this
token
label
on
both
WebSEAL
servers
participating
in
the
single
sign-on
functionality.
To
configure
the
token
label,
use
the
vf-argument
parameter
located
in
the
[e-community-sso]
stanza
of
the
WebSEAL
configuration
file.
For
example
(default):
[e-community-sso]
vf-argument
=
PD-VF
See
“e-community
single
sign-on”
on
page
431.
6.
Specifying
the
master
authentication
server
(MAS)
You
must
specify
which
server
machine
in
the
e-community
is
to
function
as
the
master
authentication
server
(MAS).
You
must
also
specify
if
a
server
machine
is
not
the
MAS.
268
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide