IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

For
example:
[e-community-sso]
vf-url
=
/pkmsvouchfor
You
can
also
express
an
extended
URL:
vf-url
=
/ecommA/pkmsvouchfor
The
extended
URL
is
used
when
the
client
is
communicating
with
a
MAS
that
is
not
a
WebSEAL
server.
This
use
of
vf-url
enables
the
client
to
specify
access
to
a
MAS
with
specialized
authentication
library,
such
as
a
customized
token
consumption
library.
8.
Configure
token
and
ec-cookie
lifetime
values
vf-token-lifetime
The
vf-token-lifetime
parameter
sets
the
lifetime
timeout
value
(in
seconds)
of
the
″vouch
for″
token.
This
value
is
checked
against
the
creation
time
stamped
on
the
cookie.
The
default
value
is
180
seconds.
You
must
take
into
account
clock
skew
among
participating
servers.
For
example:
[e-community-sso]
vf-token-lifetime
=
180
ec-cookie-lifetime
The
ec-cookie-lifetime
parameter
specifies
the
maximum
lifetime
(in
minutes)
of
the
e-community
domain
cookie.
The
default
value
is
300
minutes.
For
example:
[e-community-sso]
ec-cookie-lifetime
=
300
You
must
take
into
account
any
clock
skew
among
the
participating
domains.
Clock
skew
means
that
the
system
times
differ
on
the
relevant
servers
in
each
domain.
When
this
difference
approaches
the
value
of
vf-token-lifetime,
the
effective
lifetime
of
the
token
is
greatly
reduced.
When
this
difference
exceeds
the
value
of
vf-htoken-lifetime,
tokens
from
one
domain
cannot
be
valid
for
the
other
domain.
Administrators
should
adjust
vf-token-lifetime
accordingly.
However,
when
clock
skew
requires
that
vf-token-lifetime
be
set
to
a
large
value,
the
risk
of
replay
attacks
increases.
In
this
case,
administrators
should
consider
synchronizing
the
system
time
on
the
relevant
servers
in
each
domain.
See
“e-community
single
sign-on”
on
page
431.
Enabling
unauthenticated
access
You
can
control
whether
unauthenticated
users
are
allowed
access
to
unprotected
resources
on
e-community
SSO
slave
servers.
When
authenticated
users
are
allowed
this
access,
the
slave
server
can
serve
the
resource
without
requiring
that
the
user
authenticate
through
the
master
authentication
server.
When
this
policy
is
configured,
the
slave
server
will
redirect
to
the
master
authentication
server
only
when
the
client
requests
access
to
a
protected
resource.
This
policy
is
set
through
a
setting
in
the
WebSEAL
configuration
file:
270
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide