IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
adds<br />
junction<br />
in<strong>for</strong>mation<br />
to<br />
the<br />
path<br />
of<br />
URLs<br />
contained<br />
in<br />
the<br />
page,<br />
the<br />
actual<br />
size<br />
of<br />
the<br />
page<br />
becomes<br />
larger<br />
than<br />
indicated<br />
in<br />
the<br />
Content-Header.<br />
<strong>WebSEAL</strong><br />
has<br />
no<br />
way<br />
of<br />
knowing<br />
what<br />
the<br />
new<br />
content<br />
length<br />
is<br />
until<br />
it<br />
actually<br />
writes<br />
the<br />
stream<br />
to<br />
the<br />
client.<br />
At<br />
this<br />
point,<br />
it<br />
is<br />
too<br />
late<br />
to<br />
insert<br />
a<br />
new<br />
Content-Length<br />
header.<br />
<strong>WebSEAL</strong><br />
responds<br />
to<br />
this<br />
situation<br />
in<br />
the<br />
following<br />
manner:<br />
1.<br />
<strong>WebSEAL</strong><br />
places<br />
the<br />
value<br />
of<br />
the<br />
original<br />
Content-Length<br />
header<br />
in<br />
a<br />
new<br />
header<br />
called<br />
X-Old-Content-Length.<br />
Any<br />
applets<br />
or<br />
applications<br />
written<br />
to<br />
look<br />
<strong>for</strong><br />
this<br />
header<br />
can<br />
have<br />
access<br />
to<br />
the<br />
original<br />
(pre-filtered)<br />
Content-Length<br />
value.<br />
2.<br />
<strong>WebSEAL</strong><br />
logs<br />
the<br />
modified<br />
(post-filtered)<br />
Content-Length<br />
value<br />
in<br />
the<br />
request.log<br />
file.<br />
3.<br />
The<br />
Content-Length<br />
header<br />
no<br />
longer<br />
appears.<br />
Limitation<br />
with<br />
unfiltered<br />
server-relative<br />
links<br />
<strong>WebSEAL</strong><br />
provides<br />
solutions<br />
<strong>for</strong><br />
processing<br />
client-side,<br />
script-generated,<br />
server-relative<br />
URLs<br />
to<br />
resources<br />
on<br />
back-end<br />
junctioned<br />
application<br />
servers.<br />
These<br />
server-relative<br />
URLs,<br />
generated<br />
on<br />
the<br />
client-side<br />
by<br />
applets<br />
and<br />
scripts,<br />
initially<br />
lack<br />
knowledge<br />
of<br />
the<br />
junction<br />
point<br />
in<br />
the<br />
path<br />
expression.<br />
During<br />
a<br />
client<br />
request<br />
<strong>for</strong><br />
a<br />
resource,<br />
<strong>WebSEAL</strong><br />
can<br />
attempt<br />
to<br />
reprocess<br />
a<br />
server-relative<br />
URL<br />
using<br />
junction<br />
cookies<br />
or<br />
a<br />
junction<br />
mapping<br />
table.<br />
However,<br />
be<strong>for</strong>e<br />
the<br />
processing<br />
takes<br />
place,<br />
the<br />
request<br />
actually<br />
specifies<br />
a<br />
resource<br />
located<br />
on<br />
the<br />
local<br />
Web<br />
space<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
itself.<br />
The<br />
corrective<br />
reprocessing<br />
of<br />
the<br />
URL<br />
occurs<br />
only<br />
after<br />
<strong>WebSEAL</strong><br />
receives<br />
the<br />
request<br />
and<br />
per<strong>for</strong>ms<br />
an<br />
ACL<br />
check.<br />
An<br />
ACL<br />
check<br />
on<br />
this<br />
unprocessed<br />
request<br />
(specifying<br />
an<br />
incorrect<br />
or<br />
nonexistent<br />
local<br />
resource)<br />
could<br />
result<br />
in<br />
an<br />
error<br />
that<br />
stops<br />
the<br />
fulfillment<br />
of<br />
the<br />
intended<br />
request.<br />
For<br />
example,<br />
the<br />
following<br />
sequence<br />
takes<br />
place<br />
during<br />
processing:<br />
1.<br />
The<br />
client<br />
makes<br />
a<br />
request<br />
<strong>for</strong><br />
a<br />
resource<br />
using<br />
a<br />
client-side,<br />
script-generated,<br />
server-relative<br />
URL.<br />
2.<br />
The<br />
server-relative<br />
URL<br />
is<br />
received<br />
by<br />
<strong>WebSEAL</strong><br />
as<br />
a<br />
request.<br />
The<br />
unprocessed<br />
URL<br />
specifies<br />
a<br />
resource<br />
located<br />
in<br />
the<br />
Web<br />
space<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
itself<br />
(obviously,<br />
this<br />
is<br />
not<br />
the<br />
intended<br />
resource).<br />
3.<br />
<strong>WebSEAL</strong><br />
per<strong>for</strong>ms<br />
an<br />
ACL<br />
check<br />
on<br />
this<br />
local<br />
resource<br />
specified<br />
in<br />
the<br />
request<br />
URL.<br />
v<br />
If<br />
the<br />
ACL<br />
check<br />
fails,<br />
all<br />
processing<br />
of<br />
the<br />
request<br />
stops<br />
and<br />
the<br />
client<br />
receives<br />
a<br />
403<br />
error<br />
(Forbidden).<br />
This<br />
error<br />
occurs<br />
because<br />
the<br />
ACL<br />
check<br />
was<br />
per<strong>for</strong>med<br />
<strong>for</strong><br />
the<br />
incorrect<br />
(and<br />
probably<br />
nonexistent)<br />
resource.<br />
v<br />
If<br />
the<br />
ACL<br />
check<br />
succeeds<br />
and<br />
the<br />
resource<br />
exists<br />
in<br />
the<br />
local<br />
Web<br />
space,<br />
it<br />
is<br />
returned.<br />
This<br />
error<br />
results<br />
in<br />
the<br />
client<br />
receiving<br />
the<br />
incorrect<br />
resource.<br />
v<br />
If<br />
the<br />
ACL<br />
check<br />
succeeds<br />
and<br />
the<br />
resource<br />
does<br />
not<br />
exist<br />
in<br />
the<br />
local<br />
Web<br />
space,<br />
<strong>WebSEAL</strong><br />
modifies<br />
the<br />
request<br />
URL<br />
(using<br />
the<br />
junction<br />
cookie<br />
or<br />
junction<br />
mapping<br />
table<br />
method)<br />
and<br />
per<strong>for</strong>ms<br />
an<br />
internal<br />
reprocessing<br />
of<br />
the<br />
request.<br />
This<br />
behavior<br />
is<br />
correct.<br />
4.<br />
<strong>WebSEAL</strong><br />
per<strong>for</strong>ms<br />
another<br />
ACL<br />
check<br />
on<br />
the<br />
modified<br />
URL<br />
that<br />
contains<br />
the<br />
corrected<br />
path<br />
that<br />
includes<br />
the<br />
junction<br />
point.<br />
This<br />
modified<br />
URL<br />
now<br />
allows<br />
an<br />
ACL<br />
check<br />
<strong>for</strong><br />
the<br />
correct<br />
resource.<br />
Workaround<br />
Chapter<br />
10.<br />
<strong>WebSEAL</strong><br />
junctions<br />
291