IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>WebSEAL</strong>-to-<strong>WebSEAL</strong><br />
junctions<br />
over<br />
SSL<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
supports<br />
SSL<br />
junctions<br />
between<br />
a<br />
front-end<br />
<strong>WebSEAL</strong><br />
server<br />
and<br />
a<br />
back-end<br />
<strong>WebSEAL</strong><br />
server.<br />
Use<br />
the<br />
–C<br />
option<br />
with<br />
the<br />
create<br />
command<br />
to<br />
junction<br />
the<br />
two<br />
<strong>WebSEAL</strong><br />
servers<br />
over<br />
SSL<br />
and<br />
provide<br />
mutual<br />
authentication.<br />
Example:<br />
pdadmin><br />
server<br />
task<br />
web1-webseald-cruz<br />
create<br />
-t<br />
ssl<br />
-C<br />
-h<br />
serverA<br />
/jctA<br />
Mutual<br />
authentication<br />
occurs<br />
in<br />
the<br />
following<br />
two<br />
stages:<br />
v<br />
The<br />
SSL<br />
protocol<br />
allows<br />
the<br />
back-end<br />
<strong>WebSEAL</strong><br />
server<br />
to<br />
authenticate<br />
to<br />
the<br />
front-end<br />
<strong>WebSEAL</strong><br />
server<br />
through<br />
its<br />
server<br />
certificate.<br />
v<br />
The<br />
–C<br />
option<br />
enables<br />
the<br />
front-end<br />
<strong>WebSEAL</strong><br />
server<br />
to<br />
pass<br />
its<br />
identity<br />
in<strong>for</strong>mation<br />
to<br />
the<br />
back-end<br />
<strong>WebSEAL</strong><br />
server<br />
in<br />
a<br />
Basic<br />
Authentication<br />
(BA)<br />
header.<br />
Additionally,<br />
the<br />
–C<br />
option<br />
enables<br />
single<br />
sign-on<br />
functionality<br />
provided<br />
by<br />
the<br />
–c<br />
option.<br />
The<br />
–c<br />
option<br />
allows<br />
you<br />
to<br />
place<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong>-specific<br />
client<br />
identity<br />
and<br />
group<br />
membership<br />
in<strong>for</strong>mation<br />
into<br />
the<br />
HTTP<br />
header<br />
of<br />
the<br />
request<br />
destined<br />
<strong>for</strong><br />
the<br />
back-end<br />
<strong>WebSEAL</strong><br />
server.<br />
The<br />
header<br />
parameters<br />
include<br />
iv-user,<br />
iv-groups,<br />
and<br />
iv-creds.<br />
See<br />
“Supplying<br />
client<br />
identity<br />
in<br />
HTTP<br />
headers<br />
(–c)”<br />
on<br />
page<br />
298.<br />
The<br />
following<br />
conditions<br />
apply<br />
to<br />
<strong>WebSEAL</strong>-to-<strong>WebSEAL</strong><br />
junctions:<br />
v<br />
The<br />
junction<br />
is<br />
appropriate<br />
only<br />
with<br />
the<br />
–t<br />
ssl<br />
or<br />
–t<br />
sslproxy<br />
junction<br />
type.<br />
v<br />
Both<br />
<strong>WebSEAL</strong><br />
servers<br />
must<br />
share<br />
a<br />
common<br />
LDAP<br />
registry.<br />
This<br />
allows<br />
the<br />
back-end<br />
<strong>WebSEAL</strong><br />
server<br />
to<br />
authenticate<br />
the<br />
front-end<br />
<strong>WebSEAL</strong><br />
server<br />
identity<br />
in<strong>for</strong>mation.<br />
v<br />
If<br />
the<br />
<strong>WebSEAL</strong>-to-<strong>WebSEAL</strong><br />
junction<br />
and<br />
the<br />
back-end<br />
application<br />
server<br />
junction<br />
both<br />
use<br />
the<br />
–j<br />
junction<br />
option<br />
(<strong>for</strong><br />
junction<br />
cookies),<br />
a<br />
naming<br />
conflict<br />
can<br />
occur<br />
between<br />
the<br />
two<br />
junction<br />
cookies<br />
created<br />
by<br />
each<br />
of<br />
the<br />
two<br />
<strong>WebSEAL</strong><br />
servers.<br />
(Refer<br />
to<br />
the<br />
diagram<br />
at<br />
the<br />
beginning<br />
of<br />
this<br />
section.)<br />
To<br />
prevent<br />
this<br />
conflict,<br />
you<br />
must<br />
configure<br />
the<br />
intermediary<br />
<strong>WebSEAL</strong><br />
server<br />
(<strong>WebSEAL</strong><br />
2<br />
in<br />
the<br />
diagram)<br />
to<br />
uniquely<br />
identify<br />
its<br />
junction<br />
cookie.<br />
On<br />
the<br />
intermediary<br />
<strong>WebSEAL</strong><br />
server<br />
only,<br />
set<br />
the<br />
hostname-junction-cookie<br />
parameter<br />
in<br />
the<br />
[script-filtering]<br />
stanza<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file<br />
to<br />
″yes″<br />
(default<br />
is<br />
″no″):<br />
[script-filtering]<br />
hostname-junction-cookie<br />
=<br />
yes<br />
Junction<br />
cookies<br />
allow<br />
<strong>WebSEAL</strong><br />
to<br />
handle<br />
server-relative<br />
URLs<br />
generated<br />
on<br />
the<br />
client-side.<br />
These<br />
URLs<br />
lack<br />
knowledge<br />
of<br />
the<br />
junction<br />
point<br />
of<br />
the<br />
destination<br />
application.<br />
The<br />
junction<br />
cookie<br />
provides<br />
this<br />
in<strong>for</strong>mation.<br />
For<br />
complete<br />
in<strong>for</strong>mation<br />
on<br />
junction<br />
cookies,<br />
see<br />
“Handling<br />
server-relative<br />
URLs<br />
with<br />
junction<br />
cookies<br />
(-j)”<br />
on<br />
page<br />
292.<br />
286<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language