IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
–c
all
option
inserts
all
three
types
of
identity
information
into
the
HTTP
header
(the
short
name
format
(iv_user
)
is
used
in
this
case).
Note:
Separate
multiple
arguments
with
commas
only.
Do
not
enter
any
spaces.
Examples:
-c
all
-c
iv_creds
-c
iv_user,iv_groups
-c
iv_user_l,iv_groups,iv_creds
Note:
To
ensure
security
of
the
iv_creds
value,
use
SSL
junctions.
Note:
Refer
also
to
the
WebSEAL
section
of
the
IBM
Tivoli
Access
Manager
Performance
Tuning
Guide
for
a
description
of
how
to
configure
environment
variables
that
cache
–c
junction
information.
It
is
possible
to
improve
WebSEAL
performance
under
–c
junction
conditions
by
applying
this
caching
configuration.
Supplying
client
IP
addresses
in
HTTP
headers
(–r)
The
–r
option
allows
you
to
insert
client
IP
address
information
into
the
HTTP
headers
of
requests
destined
for
junctioned
application
servers.
The
HTTP
header
information
enables
applications
on
junctioned
third-party
servers
to
perform
actions
based
on
this
IP
address
information.
HTTP
header
information
must
be
transformed
by
the
back-end
server
to
environment
variable
format
for
use
by
a
service
on
the
back-end
server.
Header
information
is
transformed
into
a
CGI
environment
variable
format
by
replacing
all
dashes
(-)
with
under
bars
(_)
and
prepending
″HTTP″
to
the
beginning
of
the
string.
The
value
of
the
HTTP
header
becomes
the
value
of
the
new
environment
variable.
Note:
The
value
of
the
IP
address
does
not
always
represent
the
address
of
the
originating
client
machine.
The
IP
address
value
could
represent
the
address
of
a
proxy
server
or
a
network
address
translator
(NAT).
PD-specific
HTTP
Header
Field
CGI
Environment
Variable
Equivalent
Description
iv-remote-address
HTTP_IV_REMOTE_ADDRESS
The
IP
address
of
the
client.
This
value
could
represent
the
IP
address
of
a
proxy
server
or
a
network
address
translator
(NAT).
The
–r
option
specifies
that
the
IP
address
of
the
incoming
request
be
sent
to
the
back-end
application
server.
The
option
is
expressed
without
any
arguments.
Limiting
the
size
of
WebSEAL-generated
HTTP
headers
You
can
limit
the
size
of
WebSEAL-generated
HTTP
headers
that
are
inserted
in
requests
to
junctioned
back-end
servers.
The
max-webseal-header-size
parameter
in
the
[junction]
stanza
of
the
WebSEAL
configuration
file
specifies
the
maximum
size,
in
bytes,
of
WebSEAL-generated
HTTP
headers.
A
value
of
″0″
disables
this
function:
Chapter
10.
WebSEAL
junctions
299