IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

processed
at
the
root
junction
first.
If
they
do
not
start
with
patterns
specified
in
the
[process-root-filter]
stanza,
they
are
remapped
immediately.
When
process-root-requests
=
filter,
you
must
specify
the
patterns
for
which
you
want
root
junction
requests
processed
at
the
root
junction.
Use
the
[process-local-filter
stanza].
The
syntax
for
specifying
a
pattern
is:
root
=
pattern
Pattern
must
be
a
standard
WebSEAL
wildcard
pattern.
For
example:
[process-local-filter]
root
=
/index.html
root
=
/cgi-bin*
For
information
on
junction
mapping
mechanisms,
see
the
following
sections:
v
“Handling
server-relative
URLs
with
junction
cookies
(-j)”
on
page
292
v
“Handling
server-relative
URLs
with
junction
mapping”
on
page
293
Handling
cookies
from
servers
across
multiple
-j
junctions
This
section
describes
WebSEAL’s
default
handling
of
cookies
generated
by
back-end
applications
and
returned
to
clients
across
–j
junctions.
Part
1:
-j
junctions
modify
Set-Cookie
Path
attributes
In
addition
to
providing
a
junction
identifier
cookie
to
the
browser,
a
junction
configured
with
the
–j
option
also
supports
the
handling
of
cookies
sent
with
responses
from
the
back-end
application.
Browser
rule:
If
a
Set-Cookie
header
in
a
response
from
the
server
contains
a
Path
attribute
(such
as
Path=/xyz),
the
browser
returns
the
cookie
only
when
a
request
URL
(activated
from
the
returned
page)
begins
with
this
path
(such
as
/xyz/memo.html).
Problem:
When
the
junction
environment
contains
mixed
solutions
for
handling
visible
and
embedded
URLs
in
responses,
the
ability
of
the
browser
to
return
cookies
is
compromised.
For
example,
standard
WebSEAL
filtering
of
visible
server-relative
URLs
normally
adds
the
junction
name
to
the
Path
attribute
of
a
server
cookie
(for
example,
Path=/jct/xyz)
in
addition
to
modifying
the
URL
itself.
This
match
between
URL
path
name
and
the
cookie
Path
attribute
allows
the
browser
to
return
the
cookie
when
the
link
is
activated
by
the
user.
However,
the
–j
junction-cookie-based
solution
adds
the
junction
name
to
a
URL
only
after
the
link
(URL)
has
been
activated
by
the
user.
When
the
pre-modified
link
is
activated,
the
URL
path
name
(/xyz/memo.html)
does
not
match
the
Path
attribute
(Path=/jct/xyz).
The
server
cookie
is
not
returned.
Solution:
The
–j
option
converts
the
Path
attribute
for
any
server
cookie
(Set-Cookie)
to
″/″
(for
example,
Path=/).
Because
all
server-relative
path
names
begin
with
a
″/″,
all
server
cookies
are
returned
regardless
of
the
requirements
of
the
original
Path
attribute
specifications.
Chapter
10.
WebSEAL
junctions
295