IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
You<br />
must<br />
create<br />
the<br />
jmt.conf<br />
mapping<br />
table.<br />
This<br />
file<br />
does<br />
not<br />
exist<br />
by<br />
default.<br />
After<br />
you<br />
create<br />
the<br />
file<br />
and<br />
add<br />
data,<br />
use<br />
the<br />
jmt<br />
load<br />
command<br />
to<br />
“load”<br />
the<br />
data<br />
so<br />
that<br />
<strong>WebSEAL</strong><br />
has<br />
knowledge<br />
of<br />
the<br />
new<br />
in<strong>for</strong>mation.<br />
pdadmin><br />
server<br />
task<br />
server-name<br />
jmt<br />
load<br />
JMT<br />
table<br />
successfully<br />
loaded.<br />
The<br />
following<br />
conditions<br />
apply<br />
to<br />
the<br />
junction<br />
mapping<br />
table<br />
solution:<br />
v<br />
This<br />
solution<br />
does<br />
not<br />
require<br />
the<br />
–j<br />
option<br />
or<br />
junction<br />
cookie<br />
v<br />
The<br />
mapping<br />
table<br />
requires<br />
setup<br />
and<br />
activation<br />
by<br />
a<br />
security<br />
administrator<br />
v<br />
This<br />
solution<br />
does<br />
not<br />
handle<br />
links<br />
created<br />
with<br />
absolute<br />
URLs<br />
v<br />
Resource<br />
location<br />
pattern<br />
matching<br />
must<br />
be<br />
unique<br />
across<br />
the<br />
local<br />
Web<br />
space<br />
and<br />
across<br />
junctioned<br />
Web<br />
application<br />
servers<br />
v<br />
If<br />
there<br />
is<br />
a<br />
duplicate<br />
pattern<br />
entry<br />
in<br />
the<br />
file,<br />
the<br />
mapping<br />
table<br />
does<br />
not<br />
load.<br />
However,<br />
<strong>WebSEAL</strong><br />
continues<br />
to<br />
run.<br />
v<br />
If<br />
there<br />
is<br />
an<br />
error<br />
loading<br />
the<br />
mapping<br />
table,<br />
the<br />
mapping<br />
table<br />
is<br />
not<br />
available.<br />
However,<br />
<strong>WebSEAL</strong><br />
continues<br />
to<br />
run.<br />
v<br />
If<br />
the<br />
mapping<br />
table<br />
is<br />
empty<br />
or<br />
there<br />
is<br />
an<br />
error<br />
in<br />
the<br />
table<br />
entries,<br />
the<br />
mapping<br />
table<br />
does<br />
not<br />
load.<br />
However,<br />
<strong>WebSEAL</strong><br />
continues<br />
to<br />
run.<br />
v<br />
Any<br />
errors<br />
that<br />
occur<br />
while<br />
loading<br />
the<br />
mapping<br />
table<br />
result<br />
in<br />
serviceability<br />
entries<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
log<br />
file<br />
(webseald.log).<br />
See<br />
also<br />
“Processing<br />
root<br />
junction<br />
requests.”<br />
Processing<br />
root<br />
junction<br />
requests<br />
You<br />
can<br />
specify<br />
how<br />
<strong>WebSEAL</strong><br />
responds<br />
to<br />
requests<br />
<strong>for</strong><br />
resources<br />
located<br />
at<br />
the<br />
root<br />
(″/″)<br />
junction.<br />
<strong>WebSEAL</strong><br />
can<br />
either<br />
process<br />
the<br />
request<br />
immediately,<br />
or<br />
can<br />
attempt<br />
to<br />
identify<br />
a<br />
junction<br />
point<br />
to<br />
which<br />
to<br />
send<br />
the<br />
request.<br />
Requests<br />
are<br />
sent<br />
by<br />
using<br />
a<br />
junction<br />
mapping<br />
mechanisms<br />
such<br />
as<br />
the<br />
JMT<br />
or<br />
IV_JCT<br />
cookie.<br />
Avoiding<br />
root<br />
junction<br />
processing<br />
prevents<br />
processing<br />
being<br />
per<strong>for</strong>med<br />
<strong>for</strong><br />
incorrect<br />
resources<br />
be<strong>for</strong>e<br />
the<br />
intended<br />
resource<br />
is<br />
identified.<br />
This<br />
has<br />
per<strong>for</strong>mance<br />
benefits<br />
and<br />
prevents<br />
false<br />
authorization<br />
or<br />
file<br />
type<br />
check<br />
failures.<br />
To<br />
configure<br />
root<br />
junction<br />
processing,<br />
set<br />
the<br />
process-root-requests<br />
entry<br />
in<br />
the<br />
[server]<br />
stanza<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
stanza.<br />
[server]<br />
process-root-requests<br />
=<br />
always<br />
Valid<br />
values<br />
are:<br />
v<br />
never<br />
Root<br />
junction<br />
requests<br />
are<br />
never<br />
processed<br />
at<br />
the<br />
root<br />
junction.<br />
When<br />
a<br />
junction<br />
mapping<br />
mechanism<br />
is<br />
configured,<br />
such<br />
requests<br />
are<br />
immediately<br />
mapped,<br />
then<br />
processed<br />
at<br />
a<br />
mapped<br />
junction<br />
point<br />
if<br />
one<br />
is<br />
identified.<br />
v<br />
always<br />
Always<br />
attempt<br />
to<br />
process<br />
requests<br />
<strong>for</strong><br />
the<br />
root<br />
junction<br />
at<br />
the<br />
root<br />
junction<br />
first<br />
be<strong>for</strong>e<br />
attempting<br />
to<br />
use<br />
a<br />
junction<br />
mapping<br />
mechanism.<br />
This<br />
is<br />
not<br />
recommended<br />
unless<br />
the<br />
root<br />
junction<br />
serves<br />
a<br />
large<br />
set<br />
of<br />
resources<br />
or<br />
no<br />
junction<br />
mapping<br />
mechanisms<br />
are<br />
configured<br />
<strong>for</strong><br />
the<br />
set<br />
of<br />
junctions<br />
served<br />
by<br />
this<br />
<strong>WebSEAL</strong><br />
server.<br />
v<br />
filter<br />
All<br />
root<br />
junction<br />
requests<br />
are<br />
examined<br />
to<br />
determine<br />
whether<br />
they<br />
start<br />
with<br />
the<br />
patterns<br />
specified<br />
in<br />
the<br />
[process-root-filter]<br />
stanza.<br />
If<br />
they<br />
do,<br />
they<br />
are<br />
294<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language