IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
entry
is
optional.
When
WebSEAL
does
not
find
an
entry
that
matches
the
domain
name,
WebSEAL
looks
for
a
entry.
If
the
configuration
file
contains
a
entry,
WebSEAL
uses
the
assigned
attribute
patterns
for
the
current
domain.
The
string
is
a
keyword,
and
must
be
specified
exactly
as
shown
above,
including
the
<
and
>
characters.
Example:
You
are
creating
an
e-community
single
sign-on
solution
between
two
domains:
example1.com
and
example2.com.
Users
log
in
to
example1.com
but
can
get
redirected
to
example2.com
during
the
user
session.
Your
deployment
includes
a
customized
CDAS
that
inserts
information
into
each
user
credential.
The
information
includes
a
fixed
name
attribute
″job_category″
and
a
variable
number
of
attributes,
each
prefixed
with
the
characters
"my_cdas_attr_″.
This
information
needs
to
be
added
to
the
cross-domain
token.
The
configuration
file
entries
would
be:
example2.com
=
job_category,
my_cdas_attr_*
Specify
extended
attributes
to
extract
from
token
In
the
WebSEAL
configuration
file,
you
can
specify
how
the
token
consume
library
handles
extended
attributes
that
have
been
added
to
an
e-community
single
sign-on
token.
The
attributes
can
either
be
extracted
or
ignored.
In
some
cases,
you
must
extract
the
attributes
because
there
is
no
way
for
a
server
in
the
destination
domain
to
generate
them.
In
other
cases,
you
do
not
want
to
extract
the
tokens,
because
the
server
in
the
destination
domain
can
use
an
independent
process
to
gather
the
same
extended
attributes.
For
example,
the
attribute
could
reflect
a
timestamp
that
needs
to
reflect
the
system
time
on
the
destination
server.
In
the
token
consume
library,
attributes
that
are
extracted
from
the
token
are
passed
through
to
the
cross-domain
mapping
framework
library.
The
default
cross-domain
mapping
framework
library
passes
attributes
directly
through
to
the
user
credential.
Customized
cross-domain
mapping
framework
libraries
can
manipulate
attributes
as
needed
before
passing
them
to
the
user
credential.
The
syntax
for
the
entries
is
as
follows:
[ecsso-incoming-attributes]
attribute_pattern
=
{preserve|refresh}
Typically,
the
names
of
the
extended
attributes
(attribute_pattern)
match
the
names
of
the
attributes
specified
in
the
[ecsso-token-attributes]
stanza
of
the
configuration
file
for
a
WebSEAL
server
that
generates
the
tokens.
The
value
must
be
one
of
the
following
keywords:
v
preserve
Extract
all
attributes
that
match
attribute_pattern.
v
refresh
Do
not
extract
attributes
that
match
attribute_pattern.
Extended
attributes
in
the
token
that
do
not
match
an
entry
in
[ecsso-incoming-attributes]
are
preserved
(extracted).
The
order
of
the
entries
in
the
stanza
is
important.
The
first
entry
that
matches
an
attribute
name
is
used.
Other
entries
are
ignored.
For
example,
if
you
want
to
extract
the
attribute
named
my_special_attr1
but
want
to
ignore
all
other
entries
with
the
prefix
my_special_attr_,
the
stanza
entries
should
be:
Chapter
9.
Client
single
sign-on
solutions
273