IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
The
junction
point
name
should
be
unique
and
not
match
any
directory
in
the
Web
space
of
the
local
WebSEAL
server.
For
example,
if
WebSEAL
has
resources
of
the
form
/path/...,
do
not
create
a
junction
point
with
the
name
/path.
v
The
junction
point
should
not
match
any
directory
in
the
Web
space
of
the
back-end
server
if
HTML
pages
from
that
server
contain
programs
(such
as
Javascript
or
applets)
with
server-relative
URLs
to
that
directory.
For
example,
if
pages
from
the
back-end
server
contain
programs
with
a
URL
of
form
/path/...,
do
not
create
a
junction
point
of
name
/path.
v
Do
not
create
multiple
WebSEAL
junctions
that
point
to
the
same
back-end
application
server/port.
This
type
of
configuration
can
cause
unpredictable
control
of
access
to
resources
and
therefore
is
not
a
recommended
or
supported
Tivoli
Access
Manager
configuration
strategy.
Each
WebSEAL
junction
can
be
secured
by
a
unique
set
of
access
controls
(ACLs).
However,
the
ACL
policy
of
each
newly
created
junction
overlays
the
policies
of
previously
created
junctions
attached
to
the
same
back-end
server/port.
Subsequent
junctions
secured
with
more
permissive
ACLs
can
compromise
previous
junctions
secured
with
less
permissive
ACLs.
WebSEAL
and
the
Tivoli
Access
Manager
authorization
model
cannot
guarantee
secure
access
control
with
this
type
of
junction
implementation.
v
WebSEAL
supports
HTTP
1.1
across
junctions.
Note:
You
can
also
use
the
Tivoli
Access
Manager
Web
Portal
Manager
graphical
user
interface
to
create
junctions.
For
more
information,
see
the
Web
Portal
Manager
online
help
screens.
Additional
references
for
WebSEAL
junctions
See
“Understanding
WebSEAL
junctions”
on
page
11
for
a
conceptual
overview
of
WebSEAL
junctions.
See
Appendix
B,
“WebSEAL
junction
reference,”
on
page
491
for
complete
information
on
junction
command
options.
Chapter
10.
WebSEAL
junctions
277