IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Technical<br />
notes<br />
<strong>for</strong><br />
using<br />
<strong>WebSEAL</strong><br />
junctions<br />
v<br />
“Mounting<br />
multiple<br />
servers<br />
at<br />
the<br />
same<br />
junction”<br />
on<br />
page<br />
307<br />
v<br />
“Exceptions<br />
to<br />
en<strong>for</strong>cing<br />
permissions<br />
across<br />
junctions”<br />
on<br />
page<br />
307<br />
v<br />
“Certificate<br />
authentication<br />
across<br />
junctions”<br />
on<br />
page<br />
307<br />
v<br />
“Handling<br />
domain<br />
cookies”<br />
on<br />
page<br />
308<br />
Mounting<br />
multiple<br />
servers<br />
at<br />
the<br />
same<br />
junction<br />
You<br />
can<br />
mount<br />
multiple<br />
replicated<br />
servers<br />
at<br />
the<br />
same<br />
junction<br />
point.<br />
There<br />
can<br />
be<br />
any<br />
number<br />
of<br />
servers<br />
mounted<br />
at<br />
the<br />
same<br />
point.<br />
All<br />
servers<br />
mounted<br />
at<br />
one<br />
junction<br />
point<br />
must<br />
be<br />
replicas<br />
(mirrored<br />
Web<br />
spaces),<br />
and<br />
must<br />
use<br />
the<br />
same<br />
protocol—HTTP<br />
or<br />
HTTPS.<br />
Do<br />
not<br />
mount<br />
dissimilar<br />
servers<br />
on<br />
the<br />
same<br />
junction<br />
point.<br />
From<br />
the<br />
primary<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
server<br />
Web<br />
space,<br />
access<br />
pages<br />
belonging<br />
to<br />
the<br />
junctioned<br />
servers.<br />
You<br />
should<br />
be<br />
able<br />
to<br />
access<br />
these<br />
pages<br />
(subject<br />
to<br />
permissions,<br />
of<br />
course)<br />
and<br />
the<br />
pages<br />
should<br />
appear<br />
consistent.<br />
If<br />
a<br />
page<br />
cannot<br />
be<br />
found<br />
occasionally,<br />
or<br />
if<br />
it<br />
changes<br />
occasionally,<br />
it<br />
means<br />
that<br />
page<br />
was<br />
not<br />
replicated<br />
properly.<br />
Check<br />
that<br />
the<br />
document<br />
exists<br />
and<br />
is<br />
identical<br />
in<br />
the<br />
document<br />
tree<br />
of<br />
both<br />
replicated<br />
servers.<br />
Exceptions<br />
to<br />
en<strong>for</strong>cing<br />
permissions<br />
across<br />
junctions<br />
Certain<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
permissions<br />
are<br />
not<br />
en<strong>for</strong>ceable<br />
across<br />
a<br />
junction.<br />
You<br />
cannot<br />
control,<br />
<strong>for</strong><br />
example,<br />
the<br />
execution<br />
of<br />
a<br />
CGI<br />
script<br />
with<br />
the<br />
x<br />
permission,<br />
or<br />
a<br />
directory<br />
listing<br />
with<br />
the<br />
l<br />
permission.<br />
<strong>WebSEAL</strong><br />
has<br />
no<br />
means<br />
of<br />
accurately<br />
determining<br />
whether<br />
or<br />
not<br />
a<br />
requested<br />
object<br />
on<br />
a<br />
back-end<br />
server<br />
is,<br />
<strong>for</strong><br />
example,<br />
a<br />
CGI<br />
program<br />
file,<br />
a<br />
dynamic<br />
directory<br />
listing,<br />
or<br />
a<br />
regular<br />
HTTP<br />
object.<br />
<strong>Access</strong><br />
to<br />
objects<br />
across<br />
junctions,<br />
including<br />
CGI<br />
programs<br />
and<br />
directory<br />
listings,<br />
is<br />
controlled<br />
only<br />
through<br />
the<br />
r<br />
permission.<br />
Certificate<br />
authentication<br />
across<br />
junctions<br />
At<br />
installation,<br />
<strong>WebSEAL</strong><br />
is<br />
configured<br />
with<br />
a<br />
non-default<br />
test<br />
certificate.<br />
The<br />
test<br />
certificate<br />
is<br />
designated<br />
as<br />
the<br />
active<br />
server-side<br />
certificate<br />
by<br />
the<br />
webseal-cert-keyfile-label<br />
parameter<br />
in<br />
the<br />
[ssl]<br />
stanza<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file.<br />
If<br />
a<br />
junctioned<br />
back-end<br />
application<br />
server<br />
requires<br />
<strong>WebSEAL</strong><br />
to<br />
identify<br />
itself<br />
with<br />
a<br />
client-side<br />
certificate,<br />
you<br />
must<br />
first<br />
create,<br />
install,<br />
and<br />
label<br />
this<br />
certificate<br />
using<br />
the<br />
iKeyman<br />
utility.<br />
Then,<br />
configure<br />
the<br />
junction<br />
using<br />
the<br />
–K<br />
key-label<br />
option.<br />
See<br />
“Mutually<br />
authenticated<br />
SSL<br />
junctions”<br />
on<br />
page<br />
282.<br />
If<br />
the<br />
junction<br />
is<br />
not<br />
configured<br />
with<br />
–K,<br />
GSKit<br />
handles<br />
a<br />
request<br />
<strong>for</strong><br />
mutual<br />
authentication<br />
by<br />
automatically<br />
sending<br />
the<br />
“default”<br />
certificate<br />
contained<br />
in<br />
the<br />
keyfile<br />
database.<br />
If<br />
this<br />
is<br />
not<br />
the<br />
required<br />
response,<br />
you<br />
must<br />
ensure<br />
that<br />
there<br />
are<br />
no<br />
certificates<br />
marked<br />
as<br />
″default″<br />
(an<br />
asterisk<br />
mark)<br />
in<br />
the<br />
keyfile<br />
database<br />
(pdsrv.kdb).<br />
In<br />
summary:<br />
v<br />
Identify<br />
all<br />
required<br />
certificates<br />
by<br />
label<br />
name.<br />
Chapter<br />
10.<br />
<strong>WebSEAL</strong><br />
junctions<br />
307
Change language