IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[server]
pre-510-compatible-tokens
=
no
To
enable
backwards
compatibility,
set
pre-510-compatible-tokens
to
yes:
[server]
pre-510-compatible-tokens
=
yes
Note:
To
enable
backwards
compatibility
with
WebSEAL
servers
prior
to
Version
4.1,
you
must
set
an
additional
parameter.
See
“Enabling
compatibility
with
tokens
prior
to
Version
4.1”
on
page
271.
Specify
extended
attributes
to
add
to
token
In
the
WebSEAL
configuration
file,
you
can
specify
extended
attributes
from
a
user
credential
to
add
to
the
cross-domain
single
sign-on
token.
Extended
attributes
consist
of
information
about
a
user
identity
that
is
added
to
an
extended
attribute
list
when
a
user
credential
is
created.
Extended
attributes
can
be
added
by
a
number
of
authentication
mechanisms,
including
external
authentication
services
(CDASs).
The
CDASs
can
be
used,
for
example,
to
obtain
user
information
from
a
registry
that
is
external
to
Tivoli
Access
Manager.
You
can
use
this
setting
to
customize
the
contents
of
the
e-community
single
sign-on
token.
This
feature
enables
you
to
tailor
the
token
contents
to
match
the
needs
of
the
destination
domain.
When
you
use
this
feature
to
add
an
attribute
to
a
token,
you
must
also
configure
the
WebSEAL
configuration
file
for
the
server
in
the
destination
domain.
For
the
destination
server,
the
stanza
[ecsso-incoming-
attributes]
is
used
to
specify
the
handling
(extract
or
ignore)
of
each
attribute.
You
can
specify
extended
attributes
by
name,
or
you
can
declare
a
pattern
that
matches
multiple
attribute
names.
You
can
use
standard
Tivoli
Access
Manager
wildcard-matching
characters.
Table
34.
Supported
wildcard
matching
characters
Character
Description
\
The
character
that
follows
the
backslash
is
part
of
a
special
sequence.
Can
be
used
to
escape
the
other
pattern
matching
characters:
(
?
*
[
]
^
).
To
match
the
backslash
character,
use
″\\″..
?
Wildcard
that
matches
a
single
character.
For
example,
the
string
“abcde”
is
matched
by
the
expression
“ab?de”
*
Wildcard
that
matches
zero
or
more
characters.
[]
Defines
a
set
of
characters,
from
which
any
can
match.
For
example,
the
string
“abcde”
is
matched
with
the
regular
expression
“ab[cty]de”.
^
Indicates
a
negation.
For
example,
the
expression
[^ab]
matches
anything
but
the
‘a’
or
‘b’
characters.
Each
entry
in
the
WebSEAL
is
assigned
the
name
of
the
domain
for
which
the
token
is
intended.
This
name
takes
one
or
more
arguments
that
specify
names
or
patterns.
The
syntax
is:
[ecsso-token-attributes]
domain_name
=
pattern1
[pattern2],
...
[patternN]
=
pattern1
[pattern2],
...
[patternN]
272
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide