IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Supplying
client
identity
in
HTTP
headers
(–c)
The
–c
option
allows
you
to
insert
Tivoli
Access
Manager-specific
client
identity
and
group
membership
information
into
the
HTTP
headers
of
requests
destined
for
junctioned
third-party
servers.
The
HTTP
header
information
enables
applications
on
junctioned
third-party
servers
to
perform
user-specific
actions
(such
as
single
sign-on)
based
on
the
client’s
Tivoli
Access
Manager
identity.
HTTP
header
information
must
be
transformed
by
the
back-end
server
to
environment
variable
format
for
use
by
a
service
on
the
back-end
server.
Header
information
is
transformed
into
a
CGI
environment
variable
format
by
replacing
all
dashes
(-)
with
under
bars
(_)
and
prepending
″HTTP″
to
the
beginning
of
the
string.
The
value
of
the
HTTP
header
becomes
the
value
of
the
new
environment
variable.
PD-specific
HTTP
Header
Fields
CGI
Environment
Variable
Equivalents
Description
iv-user
=
HTTP_IV_USER
=
The
short
or
long
name
of
the
client.
Defaults
to
″Unauthenticated″
if
client
is
unauthenticated
(unknown).
iv-groups
=
HTTP_IV_GROUPS
=
A
list
of
groups
to
which
the
client
belongs.
Consists
of
comma
separated
quoted
entries.
iv-creds
=
HTTP_IV_CREDS
=
Encoded
opaque
data
structure
representing
an
Tivoli
Access
Manager
credential.
Supplies
credentials
to
remote
servers
so
mid-tier
applications
can
use
the
authorization
API
to
call
the
authorization
service.
Refer
to
the
IBM
Tivoli
Access
Manager
Authorization
C
API
Developer’s
Reference.
The
Tivoli
Access
Manager-specific
HTTP
header
entries
are
available
to
CGI
programs
as
the
environment
variables
HTTP_IV_USER,
HTTP_IV_GROUPS
and
HTTP_IV_CREDS.
For
other
application
framework
products,
see
the
product’s
documentation
for
instructions
on
extracting
headers
from
HTTP
requests.
–c
syntax
The
–c
option
specifies
what
Tivoli
Access
Manager-specific
HTTP
header
data
is
sent
to
the
back-end
application
server.
-c
header-types
The
header-types
arguments
include:
all,
iv_user,
iv_user_l,
iv_groups,
and
iv_creds.
Argument
Description
iv_user
Provides
the
user
name
(short
form)
as
the
iv-user
field
in
the
HTTP
header
of
the
request.
iv_user_l
Provides
the
full
DN
of
the
user
(long
form)
as
the
iv-user
field
in
the
HTTP
header
of
the
request.
iv_groups
Provides
the
user’s
list
of
groups
as
the
iv-groups
field
in
the
HTTP
header
of
the
request.
iv_creds
Provides
the
user’s
credential
information
as
the
iv-creds
field
in
the
HTTP
header
of
the
request.
Note:
Use
either
iv_user
or
iv_user_l,
but
not
both.
298
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide