IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
BA
headers
for
single
sign-on
solutions
This
section
discusses
the
possible
solutions
for
creating
single
sign-on
configurations
across
WebSEAL
junctions
using
the
–b
options.
v
“Single
sign-on
(SSO)
concepts”
on
page
316
v
“Supplying
client
identity
in
BA
headers”
on
page
316
v
“Supplying
client
identity
and
generic
password”
on
page
316
v
“Forwarding
original
client
BA
header
information”
on
page
318
v
“Removing
client
BA
header
information”
on
page
318
v
“Supplying
user
names
and
passwords
from
GSO”
on
page
318
Single
sign-on
(SSO)
concepts
When
a
protected
resource
is
located
on
a
back-end
Web
application
server,
a
client
requesting
that
resource
can
be
required
to
perform
multiple
logins
—
one
for
the
WebSEAL
server
and
one
for
the
back-end
server.
Each
login
likely
requires
different
login
identities.
The
problem
of
administering
and
maintaining
multiple
login
identities
can
often
be
solved
with
a
single
sign-on
(SSO)
mechanism.
A
single
sign-on
solution
allows
the
user
to
access
a
resource,
regardless
of
the
resource’s
location,
using
only
one
initial
login.
Any
further
login
requirements
from
back-end
servers
are
handled
transparently
to
the
user.
Supplying
client
identity
in
BA
headers
You
can
configure
WebSEAL
junctions
to
supply
the
back-end
server
with
original
or
modified
client
identity
information.
The
set
of
–b
options
allows
you
to
supply
specific
client
identity
information
in
HTTP
Basic
Authentication
(BA)
headers.
As
the
administrator,
you
must
analyze
your
network
architecture
and
security
requirements,
and
determine
answers
to
the
following
questions:
1.
Is
authentication
information
required
by
the
back-end
server?
(WebSEAL
uses
the
HTTP
Basic
Authentication
header
to
convey
authentication
information.)
2.
If
authentication
information
is
required
by
the
back-end
server,
where
does
this
information
come
from?
(What
information
does
WebSEAL
place
in
the
HTTP
header?)
3.
Does
the
connection
between
WebSEAL
and
the
back-end
server
need
to
be
secure?
(TCP
or
SSL
junction?)
After
the
initial
authentication
between
the
client
and
WebSEAL,
WebSEAL
can
build
a
new
Basic
Authentication
header.
The
request
uses
this
new
header
as
it
continues
across
the
junction
to
the
back-end
server.
You
use
the
–b
options
to
dictate
what
specific
authentication
information
is
supplied
in
this
new
header.
Supplying
client
identity
and
generic
password
–b
supply
The
–b
supply
option
instructs
WebSEAL
to
supply
the
authenticated
Tivoli
Access
Manager
user
name
(client’s
original
identity)
with
a
static,
generic
(″dummy″)
password.
The
original
client
password
is
not
used
in
this
scenario.
316
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide