IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[e-community-sso]
ecsso-allow-unauth
=
{yes|no}
When
ecsso-allow-unauth
is
set
to
yes,
unauthenticated
access
is
enabled.
The
default
setting
is
yes.
When
ecsso-allow-unauth
is
set
to
no,
unauthenticated
access
is
disabled.
In
this
case,
clients
must
authenticate
through
the
master
authentication
server
when
requesting
access
to
a
resource
(protected
or
not
protected)
on
an
e-community
SSO
slave
server.
Note:
The
default
behavior
changed
for
WebSEAL
Version
5.1.
In
prior
versions,
unauthenticated
access
was
disabled.
To
retain
backwards
compatible
behavior
with
older
versions
of
WebSEAL,
set
ecsso-allow-unauth
=
no.
UTF-8
encoding
of
tokens
for
e-community
single
sign-on
The
use
of
UTF-8
encoding
for
strings
within
tokens
used
for
e-community
single
sign-on
is
specified
in
the
WebSEAL
configuration
file.
[e-community-sso]
use-utf8
=
{yes|no}
The
default
value
is
yes.
When
use-utf8
is
set
to
no,
strings
are
encoded
using
the
local
code
page.
Use
this
value
when
implementing
e-community
single
sign-on
with
older
(pre-Version
5.1)
WebSEAL
servers.
WebSEAL
servers
from
versions
prior
to
5.1
do
not
use
UTF-8
encoding
for
tokens.
When
deploying
an
environment
that
includes
these
older
servers,
configure
the
Version
5.1
WebSEAL
server
to
not
use
UTF-8
encoding.
This
setting
is
necessary
for
backwards
compatibility.
For
more
information
on
WebSEAL
support
for
UTF-8
encoding,
see
“Multi-locale
support
with
UTF-8”
on
page
44.
Enabling
compatibility
with
tokens
prior
to
Version
4.1
In
the
Version
4.1
release
of
Tivoli
Access
Manager,
the
level
of
security
for
the
encryption
of
the
authentication
token
was
increased.
The
Version
4.1
encryption
algorithm
is
not
backward
compatible.
If
you
are
integrating
ECSSO
with
servers
using
versions
of
Tivoli
Access
Manager
prior
to
Version
4.1,
you
must
enable
the
pre-410-compatible-tokens
parameter
in
the
[server]
stanza
of
the
WebSEAL
configuration
file.
For
example:
pre-410-compatible-tokens
=
yes
The
default
setting
for
this
parameter
is
″no″.
Enable
backwards
compatibility
for
Version
4.1
tokens
For
Tivoli
Access
Manager
Version
5.1,
the
format
of
the
encryption
of
the
authentication
token
was
changed.
This
encryption
algorithm
is
not
backward
compatible.
If
you
are
integrating
authentication
tokens
with
Version
4.1
WebSEAL
servers,
you
must
specify
a
configuration
file
setting
in
the
WebSEAL
configuration
file
to
enable
backwards
compatibility.
Backwards
compatibility
with
the
older
encryption
format
is
not
enabled
by
default:
Chapter
9.
Client
single
sign-on
solutions
271