IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

A
generic
password
eliminates
password
administration
and
supports
the
application
on
a
per-user
basis.
The
″dummy″
password
is
set
in
basicauth-dummy-passwd
parameter
of
the
WebSEAL
configuration
file:
[junction]
basicauth-dummy-passwd
=
password
This
scenario
assumes
the
back-end
server
requires
authentication
from
a
Tivoli
Access
Manager
identity.
By
mapping
a
client
user
to
a
known
Tivoli
Access
Manager
user,
WebSEAL
manages
authentication
for
the
back-end
server
and
provides
a
simple
domain-wide
single
sign-on
solution.
The
following
conditions
exist
for
this
solution:
v
WebSEAL
is
configured
to
supply
the
back-end
server
with
the
user
name
contained
in
the
original
client
request
plus
a
generic
(″dummy″)
password.
v
The
″dummy″
password
is
configured
in
the
WebSEAL
configuration
file.
v
The
back-end
server
registry
must
recognize
the
Tivoli
Access
Manager
identity
supplied
in
the
HTTP
BA
header.
v
Because
sensitive
authentication
information
(user
name
and
password)
is
passed
across
the
junction,
the
security
of
the
junction
is
important.
An
SSL
junction
is
highly
recommended.
Limitations
The
same
Tivoli
Access
Manager
″dummy″
password
is
used
for
all
requests;
all
users
have
the
same
password
in
the
back-end
server
registry.
The
use
of
the
common
″dummy″
password
offers
no
basis
for
the
application
server
to
prove
the
legitimacy
of
the
client
logging
in
with
that
user
name.
If
clients
always
go
through
WebSEAL
to
access
the
back-end
server,
this
solution
does
not
present
any
security
problems.
However,
it
is
important
to
physically
secure
the
back-end
server
from
other
possible
means
of
access.
Because
this
scenario
has
no
password-level
security,
the
back-end
server
must
implicitly
trust
WebSEAL
to
verify
the
legitimacy
of
the
client.
The
back-end
server
registry
must
also
recognize
the
Tivoli
Access
Manager
identity
in
order
to
accept
it.
Client WebSEAL
SSL junction Web
Application
Server
WebSEAL supplies Policy
Director identity and "dummy"
password
any
authentication
mechanism
Registry Registry
Figure
18.
BA
Header
contains
identity
and
″dummy″
password
Chapter
11.
Single
sign-on
solutions
across
junctions
317