IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Modifying
URLs
to
back-end
resources
Pages
returned
to
the
client
from
back-end
applications
most
often
contain
URL
links
to
resources
located
on
those
application
servers.
It
is
important
that
these
links
are
constructed
to
direct
any
requests
back
to
the
correct
locations
of
these
resources.
For
example
(non-WebSEAL
environment),
the
URL
entered
by
a
client
for
a
resource
on
an
application
server
might
appear
as
follows:
http://www.abc.com/file.html
WebSEAL,
as
a
front-end
reverse
proxy,
provides
security
services
to
back-end
application
servers
via
the
WebSEAL
junctioning
feature.
This
feature
results
in
resources
being
accessed
via
different
URL
expressions.
For
example
(WebSEAL
environment),
the
URL
entered
by
a
client
for
the
same
resource
on
a
junctioned
back-end
application
server
must
appear
as
follows:
http://webseal.abc.com/jct/file.html
The
junction
feature
of
WebSEAL
changes
the
server
and
path
information
that
must
be
used
to
access
resources
on
junctioned
back-end
systems.
A
link
to
a
resource
on
a
back-end
junctioned
server
only
succeeds
if
the
URL
contains
the
identity
of
the
junction.
To
support
the
junction
feature
and
maintain
the
integrity
of
URLs,
WebSEAL
must,
where
possible:
1.
Modify
the
URLs
(links)
found
in
responses
sent
to
clients
2.
Modify
requests
for
resources
resulting
from
URLs
(links)
that
WebSEAL
could
not
change
Note
that
WebSEAL’s
rules
and
mechanisms
for
filtering
and
processing
URLs
do
not
apply
to
links
that
point
to
resources
external
to
the
Tivoli
Access
Manager
junctioned
environment.
The
following
diagram
summarizes
the
solutions
available
to
WebSEAL
for
modifying
URLs
to
junctioned
back-end
resources:
This
section
contains
the
following
topics:
v
“Understanding
path
types
used
in
URLs”
on
page
288
v
“Filtering
URLs
in
responses”
on
page
288
Client WebSEAL
Web
Application
Server
junction
Filtering responses
from back-end servers
Processing requests
for back-end resources
1. junction cookies
2. junction mapping table
(for server-relative URLs)
(for server-relative URLs)
1. standard filtering
2. script filtering
(for server-relative and
absolute URLs)
(for absolute URLs)
Figure
12.
Summary:
Modifying
URLs
to
back-end
resources
Chapter
10.
WebSEAL
junctions
287