IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Part
2:
-j
junctions
modify
Set-Cookie
Name
attributes
The
–j
option
also
supports
cookies
returned
from
servers
across
multiple
junctions.
Browser
rule:
Browsers
always
replace
any
stored
cookie
with
a
newly
arrived
cookie
containing
the
same
Name
attribute
(Set-Cookie),
unless
the
Path
or
Domain
attributes,
or
both
are
unique.
Problem:
The
previous
section
describes
how
the
–j
junction
option
modifies
the
Path
attribute
of
a
Set-Cookie
header
to
allow
the
browser
to
return
cookies
in
an
environment
where
WebSEAL
is
applying
different
filtering
rules
for
visible
and
embedded
URLs
contained
in
the
response
page.
In
a
scenario
where
multiple
back-end
servers
are
connected
to
WebSEAL
across
different
junctions
(such
as
in
a
WebSphere
environment),
it
is
possible
for
each
server
to
send
cookies
(Set-Cookie)
with
the
same
Name
attribute.
If
the
junctions
use
the
–j
option,
the
Path
attributes
for
each
cookie
become
identical
(Path=/).
Because
the
same
WebSEAL
server
is
the
point
of
contact
for
the
browser,
the
Domain
attribute
likewise
becomes
identical.
Although
these
identical
cookies
arrive
from
unique
back-end
applications,
the
browser
overwrites
the
identically
named
cookies.
Solution:
The
–j
junction
option
provides
an
additional
feature
that
uniquely
renames
any
cookie
returned
with
a
response
from
a
back-end
application
server.
The
Name
attribute
of
a
Set-cookie
header
is
prepended
with
a
special
string.
The
string
contains
the
name
of
the
specific
junction
responsible
for
delivering
the
response
(with
cookie).
AMWEBJCT_jct-name_
For
example,
if
a
cookie
with
the
Name
″JSESSIONID″
arrives
across
a
junction
named
/jctA,
the
cookie
Name
is
changed
to
:
AMWEBJCT_jctA_JSESSIONID
Refer
also
to
“Preserving
cookie
names”
on
page
296.
Preserving
cookie
names
By
default,
WebSEAL
modifies
the
names
of
cookies
(returned
in
responses
from
back-end
applications)
across
junctions
created
with
the
–j
option
or
listed
in
the
junction
mapping
table.
This
functionality
is
described
in
the
preceding
section.
In
the
scenario
just
described,
WebSEAL
creates
unique
cookie
names
to
prevent
possible
naming
conflicts
with
cookies
returned
across
other
–j
junctions.
However,
if
front-end
browsers
and
applications
depend
on
the
specific
cookie
name
generated
by
the
application,
you
can
disable
this
default
cookie
renaming
functionality
for
specific
cookies.
The
name
parameter
in
the
[preserve-cookie-
names]
stanza
of
the
WebSEAL
configuration
file
allows
you
to
list
the
specific
cookie
names
that
are
not
to
be
renamed
by
WebSEAL:
[preserve-cookie-names]
name
=
cookie-name1
name
=
cookie-name2
296
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide