IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Forwarding<br />
original<br />
client<br />
BA<br />
header<br />
in<strong>for</strong>mation<br />
–b<br />
ignore<br />
The<br />
–b<br />
ignore<br />
option<br />
instructs<br />
<strong>WebSEAL</strong><br />
to<br />
pass<br />
the<br />
original<br />
client<br />
Basic<br />
Authentication<br />
(BA)<br />
header<br />
straight<br />
to<br />
the<br />
back-end<br />
server<br />
without<br />
interference.<br />
<strong>WebSEAL</strong><br />
can<br />
be<br />
configured<br />
to<br />
authenticate<br />
this<br />
BA<br />
client<br />
in<strong>for</strong>mation<br />
or<br />
ignore<br />
the<br />
BA<br />
header<br />
supplied<br />
by<br />
the<br />
client<br />
and<br />
<strong>for</strong>ward<br />
the<br />
header,<br />
without<br />
modification,<br />
to<br />
the<br />
back-end<br />
server.<br />
Note:<br />
This<br />
is<br />
not<br />
a<br />
true<br />
single<br />
sign-on<br />
mechanism,<br />
but<br />
rather<br />
a<br />
direct<br />
login<br />
to<br />
the<br />
third-party<br />
server,<br />
transparent<br />
to<br />
<strong>WebSEAL</strong>.<br />
The<br />
following<br />
conditions<br />
exist<br />
<strong>for</strong><br />
this<br />
solution:<br />
v<br />
The<br />
back-end<br />
server<br />
requires<br />
client<br />
identity<br />
in<strong>for</strong>mation<br />
via<br />
BA<br />
The<br />
back-end<br />
server<br />
will<br />
send<br />
a<br />
Basic<br />
Authentication<br />
challenge<br />
back<br />
to<br />
the<br />
client.<br />
The<br />
client<br />
responds<br />
with<br />
user<br />
name<br />
and<br />
password<br />
in<strong>for</strong>mation<br />
which<br />
the<br />
<strong>WebSEAL</strong><br />
server<br />
passes<br />
through<br />
without<br />
modification.<br />
v<br />
The<br />
back-end<br />
server<br />
maintains<br />
its<br />
own<br />
client-supplied<br />
passwords<br />
v<br />
<strong>WebSEAL</strong><br />
is<br />
configured<br />
to<br />
supply<br />
the<br />
back-end<br />
server<br />
with<br />
the<br />
user<br />
name<br />
and<br />
password<br />
contained<br />
in<br />
the<br />
original<br />
client<br />
request.<br />
v<br />
Because<br />
sensitive<br />
authentication<br />
in<strong>for</strong>mation<br />
(user<br />
name<br />
and<br />
password)<br />
is<br />
passed<br />
across<br />
the<br />
junction,<br />
the<br />
security<br />
of<br />
the<br />
junction<br />
is<br />
important.<br />
An<br />
SSL<br />
junction<br />
is<br />
highly<br />
recommended.<br />
Removing<br />
client<br />
BA<br />
header<br />
in<strong>for</strong>mation<br />
–b<br />
filter<br />
The<br />
–b<br />
filter<br />
option<br />
instructs<br />
<strong>WebSEAL</strong><br />
to<br />
remove<br />
all<br />
Basic<br />
Authentication<br />
header<br />
in<strong>for</strong>mation<br />
from<br />
any<br />
client<br />
requests<br />
be<strong>for</strong>e<br />
<strong>for</strong>warding<br />
the<br />
requests<br />
to<br />
the<br />
back-end<br />
server.<br />
In<br />
this<br />
scenario,<br />
<strong>WebSEAL</strong><br />
becomes<br />
the<br />
single<br />
security<br />
provider.<br />
The<br />
following<br />
conditions<br />
exist<br />
<strong>for</strong><br />
this<br />
solution:<br />
v<br />
Basic<br />
Authentication<br />
is<br />
configured<br />
between<br />
the<br />
client<br />
and<br />
<strong>WebSEAL</strong><br />
v<br />
The<br />
back-end<br />
server<br />
does<br />
not<br />
require<br />
Basic<br />
Authentication<br />
v<br />
The<br />
back-end<br />
server<br />
can<br />
be<br />
accessed<br />
only<br />
through<br />
<strong>WebSEAL</strong><br />
v<br />
<strong>WebSEAL</strong><br />
handles<br />
authentication<br />
on<br />
behalf<br />
of<br />
the<br />
back-end<br />
server<br />
If<br />
you<br />
need<br />
to<br />
supply<br />
the<br />
back-end<br />
server<br />
with<br />
some<br />
client<br />
in<strong>for</strong>mation,<br />
you<br />
can<br />
combine<br />
this<br />
option<br />
with<br />
the<br />
–c<br />
option<br />
to<br />
insert<br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
client<br />
identity<br />
in<strong>for</strong>mation<br />
into<br />
HTTP<br />
header<br />
fields.<br />
See<br />
“Supplying<br />
client<br />
identity<br />
in<br />
HTTP<br />
headers<br />
(–c)”<br />
on<br />
page<br />
298.<br />
Supplying<br />
user<br />
names<br />
and<br />
passwords<br />
from<br />
GSO<br />
–b<br />
gso<br />
The<br />
–b<br />
gso<br />
option<br />
instructs<br />
<strong>WebSEAL</strong><br />
to<br />
supply<br />
the<br />
back-end<br />
server<br />
with<br />
authentication<br />
in<strong>for</strong>mation<br />
(user<br />
name<br />
and<br />
password)<br />
obtained<br />
from<br />
a<br />
server<br />
that<br />
is<br />
set<br />
up<br />
to<br />
handle<br />
global<br />
sign-on<br />
(GSO).<br />
The<br />
following<br />
conditions<br />
exist<br />
<strong>for</strong><br />
this<br />
solution:<br />
v<br />
The<br />
back-end<br />
server<br />
applications<br />
require<br />
different<br />
user<br />
names<br />
and<br />
passwords<br />
that<br />
are<br />
not<br />
contained<br />
in<br />
the<br />
<strong>WebSEAL</strong><br />
registry.<br />
318<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language