IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Using
global
sign-on
(GSO)
Tivoli
Access
Manager
supports
a
flexible
single
sign-on
solution
that
features
the
ability
to
provide
alternative
user
names
and
passwords
to
the
back-end
Web
application
server.
Global
Sign-on
grants
users
access
to
the
computing
resources
they
are
authorized
to
use
—
through
a
single
login.
Designed
for
large
enterprises
consisting
of
multiple
systems
and
applications
within
heterogeneous,
distributed
computing
environments,
GSO
eliminates
the
need
for
end
users
to
manage
multiple
user
names
and
passwords.
The
integration
is
achieved
by
creating
″aware″
junctions
between
WebSEAL
and
back-end
Web
servers.
GSO
resources
and
GSO
resource
groups
must
first
be
created
using
the
Web
Portal
Manager
or
the
pdadmin
utility.
When
WebSEAL
receives
a
request
for
a
resource
located
on
the
junctioned
server,
WebSEAL
asks
the
user
registry
server
for
the
appropriate
authentication
information.
The
user
registry
server
contains
a
database
of
mappings—for
each
registered
user—that
provides
alternative
user
names
and
passwords
for
specific
resources
and
applications.
The
following
figure
illustrates
how
the
GSO
mechanism
is
used
to
retrieve
user
names
and
passwords
for
back-end
application
resources.
1.
The
client
authenticates
to
WebSEAL
with
a
request
for
access
to
an
application
resource
on
an
back-end
server.
A
Tivoli
Access
Manager
identity
is
obtained.
Note:
The
single
sign-on
process
is
independent
of
the
initial
authentication
method.
2.
WebSEAL
passes
the
Tivoli
Access
Manager
identity
to
the
user
registry
server.
3.
The
registry
returns
a
user
name
and
password
appropriate
for
the
user
and
the
requested
application
resource.
4.
WebSEAL
inserts
the
user
name
and
password
information
in
the
HTTP
Basic
Authentication
header
of
the
request
that
is
sent
across
the
junction
to
the
back-end
server.
320
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide