IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Mutually<br />
authenticated<br />
SSL<br />
junctions<br />
<strong>WebSEAL</strong><br />
supports<br />
mutual<br />
authentication<br />
between<br />
a<br />
<strong>WebSEAL</strong><br />
server<br />
and<br />
a<br />
back-end<br />
server<br />
over<br />
an<br />
SSL<br />
junction<br />
(–t<br />
ssl<br />
or<br />
–t<br />
sslproxy).<br />
The<br />
following<br />
outline<br />
summarizes<br />
the<br />
supported<br />
functionality<br />
<strong>for</strong><br />
mutual<br />
authentication<br />
over<br />
SSL<br />
(command<br />
options<br />
are<br />
listed<br />
where<br />
appropriate):<br />
1.<br />
<strong>WebSEAL</strong><br />
authenticates<br />
the<br />
back-end<br />
server<br />
(normal<br />
SSL<br />
process)<br />
v<br />
<strong>WebSEAL</strong><br />
validates<br />
the<br />
server<br />
certificate<br />
from<br />
the<br />
back-end<br />
server.<br />
See<br />
“<strong>WebSEAL</strong><br />
validates<br />
back-end<br />
server<br />
certificate.”<br />
v<br />
<strong>WebSEAL</strong><br />
verifies<br />
the<br />
Distinguished<br />
Name<br />
(DN)<br />
contained<br />
in<br />
the<br />
certificate<br />
(–D)<br />
(optional,<br />
but<br />
highly<br />
recommended)<br />
See<br />
“Distinguished<br />
name<br />
(DN)<br />
matching.”<br />
2.<br />
Back-end<br />
server<br />
authenticates<br />
<strong>WebSEAL</strong><br />
(two<br />
methods)<br />
v<br />
Back-end<br />
server<br />
validates<br />
client<br />
certificate<br />
from<br />
<strong>WebSEAL</strong><br />
(–K).<br />
See<br />
“<strong>WebSEAL</strong><br />
authenticates<br />
with<br />
client<br />
certificate”<br />
on<br />
page<br />
283.<br />
v<br />
Back-end<br />
server<br />
validates<br />
<strong>WebSEAL</strong><br />
identity<br />
in<strong>for</strong>mation<br />
in<br />
Basic<br />
Authentication<br />
(BA)<br />
header<br />
(–B,<br />
–U,<br />
–W)<br />
See<br />
“<strong>WebSEAL</strong><br />
authenticates<br />
with<br />
BA<br />
header”<br />
on<br />
page<br />
283.<br />
The<br />
command<br />
options<br />
that<br />
control<br />
mutual<br />
authentication<br />
over<br />
SSL<br />
provide<br />
the<br />
following<br />
features:<br />
v<br />
You<br />
can<br />
specify<br />
client<br />
certificate<br />
or<br />
BA<br />
authentication<br />
method.<br />
v<br />
You<br />
can<br />
apply<br />
authentication<br />
methods<br />
on<br />
a<br />
per-junction<br />
basis.<br />
Special<br />
considerations<br />
<strong>for</strong><br />
combining<br />
the<br />
–b<br />
options<br />
(<strong>for</strong><br />
handling<br />
BA<br />
in<strong>for</strong>mation)<br />
with<br />
mutual<br />
authentication<br />
over<br />
SSL<br />
are<br />
described<br />
in<br />
“Handling<br />
client<br />
identity<br />
in<strong>for</strong>mation<br />
across<br />
junctions”<br />
on<br />
page<br />
284.<br />
<strong>WebSEAL</strong><br />
validates<br />
back-end<br />
server<br />
certificate<br />
<strong>WebSEAL</strong><br />
verifies<br />
a<br />
back-end<br />
server<br />
certificate<br />
according<br />
to<br />
the<br />
standard<br />
SSL<br />
protocol.<br />
The<br />
back-end<br />
server<br />
sends<br />
its<br />
server<br />
certificate<br />
to<br />
<strong>WebSEAL</strong>.<br />
<strong>WebSEAL</strong><br />
validates<br />
the<br />
server<br />
certificate<br />
against<br />
a<br />
pre-defined<br />
list<br />
of<br />
root<br />
Certificate<br />
Authority<br />
(CA)<br />
certificates.<br />
The<br />
Certificate<br />
Authority<br />
(CA)<br />
certificates<br />
that<br />
<strong>for</strong>m<br />
the<br />
trust<br />
chain<br />
<strong>for</strong><br />
the<br />
application<br />
server<br />
certificate<br />
(from<br />
the<br />
signing<br />
CA<br />
up<br />
to<br />
and<br />
including<br />
the<br />
root<br />
certificate)<br />
must<br />
be<br />
included<br />
in<br />
the<br />
key<br />
database<br />
in<br />
use<br />
by<br />
<strong>WebSEAL</strong>.<br />
You<br />
use<br />
the<br />
iKeyman<br />
utility<br />
to<br />
create<br />
and<br />
manage<br />
the<br />
database<br />
of<br />
root<br />
CA<br />
certificates.<br />
Distinguished<br />
name<br />
(DN)<br />
matching<br />
You<br />
can<br />
enhance<br />
server-side<br />
certificate<br />
verification<br />
through<br />
Distinguished<br />
Name<br />
(DN)<br />
matching.<br />
To<br />
enable<br />
server<br />
DN<br />
matching,<br />
you<br />
must<br />
specify<br />
the<br />
back-end<br />
server<br />
DN<br />
when<br />
you<br />
create<br />
the<br />
SSL<br />
junction<br />
to<br />
that<br />
server.<br />
Although<br />
DN<br />
matching<br />
is<br />
an<br />
optional<br />
configuration,<br />
it<br />
is<br />
highly<br />
recommended<br />
that<br />
you<br />
implement<br />
this<br />
feature<br />
with<br />
mutual<br />
authentication<br />
over<br />
SSL<br />
junctions.<br />
During<br />
server-side<br />
certificate<br />
verification,<br />
the<br />
DN<br />
contained<br />
in<br />
the<br />
certificate<br />
is<br />
compared<br />
with<br />
the<br />
DN<br />
defined<br />
by<br />
the<br />
junction.<br />
The<br />
connection<br />
to<br />
the<br />
back-end<br />
server<br />
fails<br />
if<br />
the<br />
two<br />
DNs<br />
do<br />
not<br />
match.<br />
282<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language