IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
v<br />
Do<br />
not<br />
mark<br />
any<br />
certificate<br />
in<br />
the<br />
keyfile<br />
database<br />
as<br />
″default″.<br />
v<br />
Control<br />
the<br />
<strong>WebSEAL</strong><br />
server-side<br />
certificate<br />
response<br />
with<br />
the<br />
webseal-cert-keyfile-label<br />
parameter.<br />
v<br />
Control<br />
the<br />
<strong>WebSEAL</strong><br />
client-side<br />
certificate<br />
response<br />
through<br />
the<br />
–K<br />
junction<br />
option.<br />
Handling<br />
domain<br />
cookies<br />
The<br />
allow-backend-domain-cookies<br />
parameter<br />
in<br />
the<br />
[session]<br />
stanza<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file<br />
allows<br />
you<br />
to<br />
control<br />
how<br />
<strong>WebSEAL</strong><br />
handles<br />
domain<br />
attributes<br />
in<br />
cookie<br />
headers.<br />
When<br />
this<br />
parameter<br />
is<br />
set<br />
to<br />
″no″<br />
(default),<br />
<strong>WebSEAL</strong><br />
per<strong>for</strong>ms<br />
″tail<br />
matching″<br />
to<br />
determine<br />
if<br />
the<br />
domain<br />
(contained<br />
as<br />
an<br />
attribute<br />
in<br />
the<br />
cookie<br />
header)<br />
is<br />
valid.<br />
If<br />
the<br />
domain<br />
in<br />
the<br />
cookie<br />
header<br />
is<br />
valid,<br />
the<br />
cookie<br />
is<br />
sent<br />
to<br />
the<br />
browser<br />
with<br />
the<br />
domain<br />
attribute<br />
removed<br />
from<br />
the<br />
cookie<br />
header.<br />
When<br />
a<br />
browser<br />
receives<br />
a<br />
cookie<br />
with<br />
no<br />
domain<br />
attribute,<br />
it<br />
can<br />
return<br />
the<br />
cookie<br />
only<br />
to<br />
the<br />
originating<br />
server.<br />
If<br />
″tail<br />
matching″<br />
determines<br />
that<br />
the<br />
domain<br />
in<br />
the<br />
cookie<br />
header<br />
is<br />
not<br />
valid,<br />
the<br />
cookie<br />
is<br />
not<br />
sent<br />
to<br />
the<br />
browser.<br />
The<br />
browser<br />
has<br />
no<br />
cookies<br />
to<br />
return.<br />
[session]<br />
allow-backend-domain-cookies<br />
=<br />
no<br />
When<br />
this<br />
parameter<br />
is<br />
set<br />
to<br />
″yes″,<br />
<strong>WebSEAL</strong><br />
does<br />
not<br />
per<strong>for</strong>m<br />
″tail<br />
matching″<br />
and<br />
allows<br />
all<br />
cookies,<br />
regardless<br />
of<br />
the<br />
domain<br />
attribute<br />
value,<br />
to<br />
be<br />
sent<br />
to<br />
the<br />
browser.<br />
The<br />
browser<br />
can<br />
return<br />
the<br />
cookies<br />
to<br />
the<br />
appropriate<br />
server<br />
or<br />
servers.<br />
[session]<br />
allow-backend-domain-cookies<br />
=<br />
yes<br />
<strong>WebSEAL</strong><br />
returns<br />
HTTP/1.1<br />
HTTP/1.0<br />
requests<br />
are<br />
sent<br />
to<br />
junctioned<br />
back-end<br />
servers<br />
only<br />
if<br />
those<br />
servers<br />
return<br />
a<br />
status<br />
of<br />
400<br />
(Bad<br />
Request),<br />
return<br />
a<br />
status<br />
of<br />
504<br />
(HTTP<br />
version<br />
not<br />
supported),<br />
of<br />
if<br />
the<br />
client<br />
browser<br />
specifies<br />
HTTP/1.0<br />
in<br />
the<br />
request.<br />
Otherwise,<br />
if<br />
the<br />
back-end<br />
server<br />
accepts<br />
HTTP/1.1,<br />
<strong>WebSEAL</strong><br />
sends<br />
HTTP/1.1<br />
requests.<br />
However,<br />
even<br />
when<br />
<strong>WebSEAL</strong><br />
sends<br />
an<br />
HTTP/1.0<br />
request<br />
to<br />
a<br />
junctioned<br />
back-end<br />
server<br />
(and<br />
the<br />
back-end<br />
server<br />
returns<br />
an<br />
HTTP/1.0<br />
response),<br />
<strong>WebSEAL</strong><br />
always<br />
returns<br />
an<br />
HTTP/1.1<br />
response<br />
to<br />
the<br />
client<br />
browser.<br />
Junctioned<br />
application<br />
with<br />
Web<br />
Portal<br />
<strong>Manager</strong><br />
Problem:<br />
Web<br />
Portal<br />
<strong>Manager</strong><br />
sends<br />
absolute<br />
or<br />
server-relative<br />
URLs<br />
in<br />
its<br />
Javascript.<br />
These<br />
addresses<br />
are<br />
not<br />
resolved<br />
successfully<br />
by<br />
the<br />
browser<br />
and<br />
require<br />
junction<br />
cookie<br />
in<strong>for</strong>mation<br />
to<br />
complete<br />
the<br />
path<br />
name.<br />
Solution:<br />
If<br />
an<br />
application<br />
server<br />
with<br />
Web<br />
Portal<br />
<strong>Manager</strong><br />
is<br />
junctioned<br />
to<br />
<strong>WebSEAL</strong>,<br />
you<br />
must<br />
use<br />
the<br />
–j<br />
option<br />
when<br />
creating<br />
this<br />
junction.<br />
The<br />
junction<br />
cookie<br />
provided<br />
by<br />
the<br />
–j<br />
option<br />
allows<br />
the<br />
browser<br />
(client)<br />
to<br />
successfully<br />
issue<br />
commands<br />
to<br />
Web<br />
Portal<br />
<strong>Manager</strong>.<br />
In<br />
addition<br />
to<br />
using<br />
the<br />
–j<br />
option,<br />
you<br />
must<br />
also<br />
use<br />
the<br />
–c<br />
iv_user,iv_creds<br />
option.<br />
308<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language