IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[junction]
max-webseal-header-size
=
0
This
parameter
can
be
useful
if
a
back-end
application
server
rejects
WebSEAL-generated
HTTP
headers
because
they
are
too
large.
For
example,
an
iv-creds
header
for
a
user
belonging
to
many
groups
could
be
too
large.
When
configured,
this
parameter
causes
WebSEAL-generated
headers
exceeding
the
maximum
value
to
split
across
multiple
headers.
The
following
example
output
from
a
CGI
application
illustrates
the
effect
of
split
headers:
HTTP_IV_CREDS_1=Version=1,
BAKs3DCCBnMMADCCBm0wggZpAgIDkDCCAYUwKzA
HTTP_IV_CREDS_2=+0+8eAgI8iAICEdYCAgCkAgFUBAaSVNCJqncMOWNuPXNlY21==
HTTP_IV_CREDS_SEGMENTS=2
If
you
enable
this
function,
you
must
modify
the
back-end
application
to
recognize
split
headers,
instead
of
standard
WebSEAL-specific
HTTP
headers.
Passing
session
cookies
to
junctioned
portal
servers
(–k)
A
Web
portal
is
a
server
that
offers
a
broad
array
of
personalized
resources
and
services.
The
–k
option
allows
you
to
send
the
Tivoli
Access
Manager
session
cookie
(originally
established
between
the
client
and
WebSEAL)
to
a
back-end
portal
server.
This
option
currently
exists
to
directly
support
the
integration
of
WebSEAL
with
the
Plumtree
Corporate
Portal
solution.
When
a
client
requests
a
personal
resource
list
from
the
portal
server,
the
portal
server
builds
this
list
by
accessing
resources
located
on
other
supporting
application
servers,
also
protected
by
WebSEAL.
The
session
cookie
allows
the
portal
server
to
perform
seamless
single
sign-on
to
these
application
servers,
on
behalf
of
the
client.
You
include
the
–k
option,
without
arguments,
when
you
create
the
junction
between
WebSEAL
and
the
back-end
portal
server.
Conditions
to
consider
for
a
portal
server
configuration:
v
For
access
via
user
name
and
password,
Forms
authentication
is
required.
Do
not
use
Basic
Authentication
(BA).
v
The
ssl-id-sessions
parameter
in
the
[session]
stanza
of
the
WebSEAL
configuration
files
must
be
set
to
″no″.
For
HTTPS
communication,
this
setting
forces
the
use
of
a
session
cookie,
instead
of
the
SSL
session
ID,
to
maintain
session
state.
v
If
the
portal
server
is
front-ended
by
a
WebSEAL
cluster,
enable
the
failover
type
cookie.
The
failover
cookie
contains
encrypted
credential
information
that
allows
authentication
to
succeed
with
any
replicated
WebSEAL
server
that
processes
the
request.
Supporting
case-insensitive
URLs
(–i)
By
default,
Tivoli
Access
Manager
treats
URLs
as
case-sensitive
when
performing
checks
on
access
controls.
The
–i
option
is
used
to
specify
that
WebSEAL
treat
URLs
as
case-insensitive
when
performing
authorization
checks
on
a
request
to
a
junctioned
back-end
server.
When
you
set
this
option
on
the
junction,
WebSEAL
does
not
distinguish
between
uppercase
and
lowercase
characters
when
parsing
URLs.
By
default,
Web
servers
are
expected
to
be
case-sensitive.
300
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide