IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

More documents

Recommendations

Info

IBM Tivoli Access Manager for e-business WebSEAL Version 5.1 Administration Guide �� SC32-1359-00
Page 1: IBM Tivoli Access Manager for e-bus
Page 5 and 6: Contents Preface . . . . . . . . .
Page 7 and 8: Preventing vulnerability caused by
Page 9 and 10: Setting the cache entry timeout val
Page 11 and 12: Step-up authentication . . . . . .
Page 13 and 14: 1. Enabling and disabling e-communi
Page 15 and 16: Enabling forms single sign-on . . .
Page 17 and 18: Scheme filtering . . . . . . . . .
Page 19 and 20: Preface Welcome to the IBM ® Tivol
Page 21 and 22: This chapter discusses the administ
Page 23 and 24: Provides reference information abou
Page 25 and 26: Additional information on IBM Tivol
Page 27 and 28: Accessing publications online The p
Page 29 and 30: Chapter 1. IBM Tivoli Access Manage
Page 31 and 32: When a user successfully authentica
Page 33 and 34: Explicit and inherited policy Polic
Page 35 and 36: You implement security policy by ap
Page 37 and 38: Credentials can be used by any Tivo
Page 39 and 40: Understanding WebSEAL junctions Tiv
Page 41 and 42: v To extend the site with additiona
Page 43 and 44: Chapter 2. WebSEAL server configura
Page 45 and 46: The instance name also affects how
Page 47 and 48: Note: This step is specific to use
Page 49 and 50: IP address 1.2.3.5 Use SSL to commu
Page 51 and 52: Silent configuration overview You c
Page 53 and 54:
[server] network-interface = 1.2.3.
Page 55 and 56:
. Start the amwebcfg utility. The s
Page 57 and 58:
This test certificate is not suitab
Page 59 and 60:
Parameter Description Default Value
Page 61 and 62:
Rainbow CryptoSwift and nCipher nFo
Page 63 and 64:
allows iKeyman to understand the ha
Page 65 and 66:
[ssl] pkcs11-driver-path = /opt/Era
Page 67 and 68:
SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_
Page 69 and 70:
Managing worker thread allocation v
Page 71 and 72:
This parameter determines the cut-o
Page 73 and 74:
support (utf8-url-support-enabled)
Page 75 and 76:
In previous versions of WebSEAL, fo
Page 77 and 78:
WebSEAL attempts to distinguish bet
Page 79 and 80:
When use-utf8 is set to false, stri
Page 81 and 82:
Multi-locale messages Standard WebS
Page 83 and 84:
Handling invalid character encoding
Page 85 and 86:
WebSEAL, by default, filters string
Page 87 and 88:
Platform for Privacy Preferences (P
Page 89 and 90:
The configuration file entry is: [p
Page 91 and 92:
Table 5. Supported values for the a
Page 93 and 94:
specified, the default value is aut
Page 95 and 96:
The following table lists the suppo
Page 97 and 98:
Suppressing server identity HTTP se
Page 99 and 100:
Chapter 3. WebSEAL server administr
Page 101 and 102:
You must issue a separate net stop
Page 103 and 104:
# pdadmin pdadmin> login Enter User
Page 105 and 106:
The following example illustrates a
Page 107 and 108:
Value Description public The public
Page 109 and 110:
The compression_level is an optiona
Page 111 and 112:
[compress-user-agent] user_agent =
Page 113 and 114:
Filename Title Description HTTP Err
Page 115 and 116:
When client-notify-tod = yes, WebSE
Page 117 and 118:
Custom HTML page descriptions Form
Page 119 and 120:
Modifying pages from prior versions
Page 121 and 122:
Example archive file created by thi
Page 123 and 124:
Chapter 4. Serviceability and loggi
Page 125 and 126:
The FILE syntax for the NOTICE mess
Page 127 and 128:
Maximum size, in bytes, of event bu
Page 129 and 130:
The following log agent configurati
Page 131 and 132:
2001-11-14-16:23:00.294+00:00I-----
Page 133 and 134:
Legacy auditing Legacy auditing is
Page 135 and 136:
Specifying the frequency for flushi
Page 137 and 138:
Chapter 5. WebSEAL security policy
Page 139 and 140:
At installation, this default ACL i
Page 141 and 142:
failure to connect to the first ser
Page 143 and 144:
Command Description Manages the pol
Page 145 and 146:
Authentication strength policy This
Page 147 and 148:
Authentication strength configurati
Page 149 and 150:
Create a protected object policy Co
Page 151 and 152:
v Require a specific authentication
Page 153 and 154:
pdadmin> pop create test1 pdadmin>
Page 155 and 156:
Applications of unauthenticated HTT
Page 157 and 158:
Chapter 6. Authentication This chap
Page 159 and 160:
Authentication Method Supported Con
Page 161 and 162:
The GSKit cache also maintains sess
Page 163 and 164:
Workaround: As administrator, you c
Page 165 and 166:
[session] timeout inactive-timeout
Page 167 and 168:
Authentication Method CDSSO Token F
Page 169 and 170:
Table 22. Authentication library ty
Page 171 and 172:
By default, only one error message
Page 173 and 174:
Basic authentication Basic authenti
Page 175 and 176:
Forms authentication Tivoli Access
Page 177 and 178:
Client-side certificate authenticat
Page 179 and 180:
Certificate authentication configur
Page 181 and 182:
The default WebSEAL configuration f
Page 183 and 184:
Disable certificate authentication
Page 185 and 186:
3. Restart the WebSEAL server. Spec
Page 187 and 188:
IP address authentication Tivoli Ac
Page 189 and 190:
The most typical form of SecurID To
Page 191 and 192:
v “Enable access to the SecurID c
Page 193 and 194:
[token] token-auth = both [authenti
Page 195 and 196:
1. The client (browser) attempts to
Page 197 and 198:
v Authentication level An integer v
Page 199 and 200:
- Entitlements service The authenti
Page 201 and 202:
Failover authentication configurati
Page 203 and 204:
methods, insert the name of the cus
Page 205 and 206:
This value is set in the [failover]
Page 207 and 208:
The attribute_pattern can be either
Page 209 and 210:
Enable backwards compatibility for
Page 211 and 212:
Multiplexing proxy agents Tivoli Ac
Page 213 and 214:
6. The MPA authenticates to WebSEAL
Page 215 and 216:
Chapter 7. Advanced WebSEAL authent
Page 217 and 218:
Administrators requesting use of sw
Page 219 and 220:
This group is automatically created
Page 221 and 222:
The configuration file entries are:
Page 223 and 224:
su-ba su-forms su-certificate su-to
Page 225 and 226:
Reauthentication WebSEAL reauthenti
Page 227 and 228:
- - The su-forms authentication met
Page 229 and 230:
7. WebSEAL sends an HTTP redirect b
Page 231 and 232:
When the server-side cache setting
Page 233 and 234:
Creating and applying the reauthent
Page 235 and 236:
to include the %USERNAME% macro: D
Page 237 and 238:
The session cache entry lifetime va
Page 239 and 240:
v Resetting the session cache lifet
Page 241 and 242:
[acnt-mgt] login-redirect-page = /j
Page 243 and 244:
Extended attributes for credentials
Page 245 and 246:
Step 3 — Specify the attributes t
Page 247 and 248:
pdadmin> object modify /WebSEAL/WS1
Page 249 and 250:
v Credential extended attributes ex
Page 251 and 252:
Note that the ordering of attribute
Page 253 and 254:
1. Ensure that the server-name key
Page 255 and 256:
Chapter 8. WebSEAL Key Management T
Page 257 and 258:
File Type Description .rdb The ″r
Page 259 and 260:
v Create one or more key databases
Page 261 and 262:
Chapter 9. Client single sign-on so
Page 263 and 264:
WebSEAL and IIS handle session mana
Page 265 and 266:
However, the Tivoli Access Manager
Page 267 and 268:
3. Grant the new account Administra
Page 269 and 270:
2. Manually edit krb5.conf to remov
Page 271 and 272:
[spnego] # UNIX ONLY spnego-krb-ser
Page 273 and 274:
Cross-domain single sign-on The Tiv
Page 275 and 276:
Configuring CDSSO authentication CD
Page 277 and 278:
1. Enabling and disabling CDSSO aut
Page 279 and 280:
4. Configuring the token time stamp
Page 281 and 282:
Enable backwards compatibility for
Page 283 and 284:
Extended attributes in the token th
Page 285 and 286:
The home domain ″owns″ the user
Page 287 and 288:
Refer to the following diagram as y
Page 289 and 290:
3. WebSEAL 2 redirects the browser
Page 291 and 292:
Understanding the “vouch for” t
Page 293 and 294:
v The ″vouch for″ server (the M
Page 295 and 296:
You can configure the e-community a
Page 297 and 298:
is-master-authn-server Use the is-m
Page 299 and 300:
[e-community-sso] ecsso-allow-unaut
Page 301 and 302:
The entry is optional. When WebSEA
Page 303 and 304:
Chapter 10. WebSEAL junctions A Web
Page 305 and 306:
v The junction point name should be
Page 307 and 308:
Using pdadmin to create junctions B
Page 309 and 310:
protocol specifies that when a requ
Page 311 and 312:
To enable the server DN matching, s
Page 313 and 314:
Creating TCP and SSL proxy junction
Page 315 and 316:
Modifying URLs to back-end resource
Page 317 and 318:
Relative URLs are always handled ap
Page 319 and 320:
adds junction information to the pa
Page 321 and 322:
The following diagram illustrates t
Page 323 and 324:
processed at the root junction firs
Page 325 and 326:
Additional junction options You can
Page 327 and 328:
The -c all option inserts all three
Page 329 and 330:
Although most HTTP servers support
Page 331 and 332:
A ″state″ established between a
Page 333 and 334:
2. \Program Files\Company Inc.\Rele
Page 335 and 336:
Technical notes for using WebSEAL j
Page 337 and 338:
Using query_contents with third-par
Page 339 and 340:
The file currently contains sample
Page 341 and 342:
Troubleshooting v Problem: query_co
Page 343 and 344:
Chapter 11. Single sign-on solution
Page 345 and 346:
A generic password eliminates passw
Page 347 and 348:
v Security is important for both We
Page 349 and 350:
Mapping the authentication informat
Page 351 and 352:
Parameter Description gso-cache-siz
Page 353 and 354:
Configuring the LTPA cache The crea
Page 355 and 356:
1. Client browser requests the page
Page 357 and 358:
[forms-sso-login-pages] login-page-
Page 359 and 360:
[^acd] Matches any character except
Page 361 and 362:
Venezuela Vietnam Yugoslavia Zimbab
Page 363 and 364:
Chapter 12. Application integration
Page 365 and 366:
″_UTF8″ appended to the end. Th
Page 367 and 368:
Junction ″best practices″ for a
Page 369 and 370:
Building a custom personalization s
Page 371 and 372:
Maintaining session state between c
Page 373 and 374:
HTTP_HTTP_header_name For example:
Page 375 and 376:
Providing access control to dynamic
Page 377 and 378:
Updating WebSEAL for dynamic URLs U
Page 379 and 380:
non-validated content is passed thr
Page 381 and 382:
Dynamic URL example: The Travel Kin
Page 383 and 384:
ows/tr/browse unauthenticated Tr an
Page 385 and 386:
Chapter 13. Authorization decision
Page 387 and 388:
Retrieving ADI from the WebSEAL cli
Page 389 and 390:
The use of the AMWS_qs_ prefix in t
Page 391 and 392:
Supplying a failure reason across a
Page 393 and 394:
Deploying the attribute retrieval s
Page 395 and 396:
Chapter 14. Attribute retrieval ser
Page 397 and 398:
File name of the attribute retrieva
Page 399 and 400:
Editing the data tables The attribu
Page 401 and 402:
This ID (required) refers to the un
Page 403 and 404:
Creating custom protocol plug-ins O
Page 405 and 406:
Appendix A. WebSEAL configuration f
Page 407 and 408:
v Entries in the configuration file
Page 409 and 410:
However, an administrator should no
Page 411 and 412:
“Content management” on page 44
Page 413 and 414:
The WebSEAL server instance name. T
Page 415 and 416:
Port on which WebSEAL listens for H
Page 417 and 418:
Enable or disable support for UTF-8
Page 419 and 420:
pre-510-compatible-tokens = {yes|no
Page 421 and 422:
User registry This section contains
Page 423 and 424:
Enables or disable LDAP client-side
Page 425 and 426:
Allows or disallows the client to q
Page 427 and 428:
Indicates whether default policy ov
Page 429 and 430:
Active Directory domain name system
Page 431 and 432:
IBM Lotus Domino [uraf-domino] stan
Page 433 and 434:
Domino server password that is used
Page 435 and 436:
String specifying the path to the k
Page 437 and 438:
Integer value indicating the maximu
Page 439 and 440:
String containing the password to p
Page 441 and 442:
Authentication This section contain
Page 443 and 444:
Enables authentication using the SP
Page 445 and 446:
Enables authentication using an HTT
Page 447 and 448:
Authentication libraries [authentic
Page 449 and 450:
Fully qualified path for a library
Page 451 and 452:
Reauthentication [reauthentication]
Page 453 and 454:
Enables the failover cookie for the
Page 455 and 456:
List of attributes to put in the ne
Page 457 and 458:
Use UTF-8 encoding for tokens used
Page 459 and 460:
e-community single sign-on v [e-com
Page 461 and 462:
String value containing the name of
Page 463 and 464:
Quality of protection v [ssl-qop] v
Page 465 and 466:
Session [session] stanza max-entrie
Page 467 and 468:
Indicates whether to send the WebSE
Page 469 and 470:
Content management [content] stanza
Page 471 and 472:
Account management [acnt-mgt] stanz
Page 473 and 474:
Form requesting client-side certifi
Page 475 and 476:
Local CGI v [cgi] v [cgi-types] v [
Page 477 and 478:
Icons v [content-index-icons] v [ic
Page 479 and 480:
Content caching [content-cache] sta
Page 481 and 482:
Content MIME types [content-mime-ty
Page 483 and 484:
Junctions This sections contains th
Page 485 and 486:
Integer value indicating the number
Page 487 and 488:
The password for the LDAP user spec
Page 489 and 490:
Event handler filtering [filter-eve
Page 491 and 492:
MIME types and header filtering v [
Page 493 and 494:
List of specific cookie names that
Page 495 and 496:
Global Sign-On cache [gso-cache] st
Page 497 and 498:
Lightweight Third Party Authenticat
Page 499 and 500:
Logging [logging] stanza server-log
Page 501 and 502:
Fully qualified path to the agents
Page 503 and 504:
Location of the audit trail file fo
Page 505 and 506:
Policy database [aznapi-configurati
Page 507 and 508:
Entitlement services [aznapi-entitl
Page 509 and 510:
Platform for Privacy Preferences (P
Page 511 and 512:
categories = {physical|online|uniqu
Page 513 and 514:
emedies = {correct|money|law} Speci
Page 515 and 516:
For all values except current, an a
Page 517 and 518:
Specifies how long the information
Page 519 and 520:
Appendix B. WebSEAL junction refere
Page 521 and 522:
Create a new junction for an initia
Page 523 and 524:
-f Force the replacement of an exis
Page 525 and 526:
Appendix C. Notices This informatio
Page 527 and 528:
modify, and distribute these sample
Page 529 and 530:
Index A absolute URL filtering, bes
Page 531 and 532:
cross-site scripting illegal-url-su
Page 533 and 534:
HTTP_IV_USER 298, 336, 338 HTTP_PD_
Page 535 and 536:
p3p (continued) recipient 66 remedi
Page 537 and 538:
SPNEGO (continued) kinit 242 overvi
Page 540:
�� Printed in USA SC32-13
show all

IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?