IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
a
basic
WebSEAL
junction
WebSEAL
supports
both
standard
TCP
(HTTP)
and
secure
SSL
(HTTPS)
junctions
between
WebSEAL
and
back-end
Web
application
servers.
The
junction
between
WebSEAL
and
the
back-end
server
is
independent
of
the
type
of
connection
(and
its
level
of
security)
between
the
client
and
the
WebSEAL
server.
The
mandatory
command
options
required
to
create
a
basic
WebSEAL
junction
using
pdadmin
include:
v
Host
name
of
the
back-end
application
server
(
–h
option)
v
Junction
type:
tcp,
ssl,
tcpproxy,
sslproxy,
local
(
–t
option)
v
Junction
point
(mount
point)
pdadmin>
server
task
instance_name-webseald-host-name
\
create
-t
type
-h
host_name
jct_point
For
example:
pdadmin>
server
task
web1-webseald-cruz
create
-t
tcp
-h
doc.tivoli.com
/pubs
Note:
A
″best
practices″
recommendation
is
to
always
use
the
fully
qualified
domain
name
of
the
back-end
server
when
specifying
the
argument
to
the
–h
option.
Creating
TCP
type
junctions
A
WebSEAL
junction
over
a
TCP
connection
provides
the
basic
properties
of
a
junction
but
does
not
provide
secure
communication
across
the
junction.
To
create
a
secure
TCP
junction
and
add
an
initial
server,
use
the
create
command
with
the
–t
tcp
option:
pdadmin>
server
task
webseald-instance-name
create
-t
tcp
-h
host-name
\
[-p
port]
jct-point
The
default
port
value
for
a
TCP
junction
(if
not
specified)
is
80.
Creating
SSL
type
junctions
SSL
junctions
function
exactly
like
TCP
junctions,
with
the
added
value
that
all
communication
between
WebSEAL
and
the
back-end
server
is
encrypted.
SSL
junctions
allow
secure
end-to-end
browser-to-application
transactions.
You
can
use
SSL
to
secure
communications
from
the
client
to
WebSEAL
and
from
WebSEAL
to
the
back-end
server.
The
back-end
server
must
be
HTTPS-enabled
when
you
use
an
SSL
junction.
To
create
a
secure
SSL
junction
and
add
an
initial
server,
use
the
create
command
with
the
–t
ssl
option:
pdadmin>
server
task
instance_name-webseald-host-name
create
-t
ssl
-h
host_name
\
[-p
port]
jct_point
The
default
port
value
for
an
SSL
junction
(if
not
specified)
is
443.
Verifying
the
back-end
server
certificate
When
a
client
makes
a
request
for
a
resource
on
the
back-end
server,
WebSEAL,
in
its
role
as
a
security
server,
performs
the
request
on
behalf
of
the
client.
The
SSL
280
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide