IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

To
enable
the
server
DN
matching,
specify
the
back-end
server
DN
when
you
create
the
SSL
junction
using
the
–D
″DN″
option.
To
preserve
any
blank
spaces
in
the
string,
surround
the
DN
string
with
double
quotation
marks.
For
example:
-D
"/C=US/O=Tivoli/OU=SecureWay/CN=Access
Manager"
The
–D
option
is
appropriate
only
when
used
with
the
–K
or
–B
option.
WebSEAL
authenticates
with
client
certificate
Use
the
–K
option
to
enable
WebSEAL
to
authenticate
to
the
junctioned
back-end
server
using
its
client
certificate.
-K
"key_label"
The
conditions
for
this
scenario
include:
v
The
back-end
server
is
set
up
to
require
verification
of
WebSEAL’s
identity
with
a
client
certificate.
v
Using
the
iKeyman
utility
to
create,
label,
and
store
a
special
key
that
is
used
solely
as
WebSEAL’s
client
certificate
when
authenticating
to
a
junctioned
back-end
server.
v
It
is
also
highly
recommended
that
you
configure
the
junction
for
DN
matching
(–D).
The
–K
option
uses
an
argument
that
specifies
the
key-label
of
the
required
certificate
as
stored
in
the
GSKit
key
database.
Use
the
iKeyman
utility
to
add
new
certificates
to
the
key
database.
You
must
surround
the
key-label
argument
with
quotation
marks.
For
example:
-K
"cert1_Tiv"
If
the
key
resides
on
cryptographic
hardware,
you
must
specify
the
WebSEAL
token
device
with
the
key
label.
-K
"token_name:key-label"
For
example:
-K
"websealtoken:junctionkey"
See
“Cryptographic
hardware
for
encryption
and
key
storage”
on
page
32.
See
“Configuring
WebSEAL
key
database
parameters”
on
page
229.
WebSEAL
authenticates
with
BA
header
Use
the
–B
–U
″username″
–W
″password″
option
to
enable
WebSEAL
authentication
via
Basic
Authentication.
-B
-U
"username"
-W
"password"
The
conditions
for
this
scenario
include:
v
The
back-end
server
is
set
up
to
require
verification
of
WebSEAL’s
identity
with
a
BA
header.
v
Do
not
configure
the
junction
with
any
–b
option.
(Internally,
however,
the
–B
option
uses
–b
filter.)
v
WebSEAL
is
configured
to
pass
its
identity
information
in
a
BA
header
to
authenticate
to
the
back-end
server.
Chapter
10.
WebSEAL
junctions
283