IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
a
GSO-enabled
WebSEAL
junction
Support
for
GSO
is
configured
at
the
junction
between
WebSEAL
and
a
back-end
server.
To
create
a
junction
that
enables
GSO,
use
the
create
command
with
the
–b
gso
option.
The
following
example
illustrates
the
syntax
for
the
create
command:
create
-t
tcp
-h
host-name
-b
gso
-T
resource
jct-point
Options
for
setting
up
GSO
junctions
are
listed
below:
Options
Description
–b
gso
Specifies
that
GSO
should
provide
authentication
information
for
all
requests
crossing
this
junction.
–T
resource/resource-group
Specifies
the
GSO
resource
or
resource
group.
The
resource
name
used
as
the
argument
to
this
option
must
exactly
match
the
resource
name
as
listed
in
the
GSO
database.
Required
for
gso
junctions.
A
junction
used
in
a
WebSEAL/GSO
solution
can
be
made
secure
through
SSL
by
additionally
applying
the
–t
ssl
option
when
creating
the
junction.
Always
use
SSL
junctions
with
GSO
to
ensure
encryption
of
credentials
and
all
data.
Examples
of
GSO-enabled
WebSEAL
junctions
Junction
the
application
resource
travel-app
on
host
sales_svr
to
junction
point
/sales:
create
-t
tcp
-b
gso
-T
travel-app
-h
sales_svr
/sales
Junction
the
application
resource
payroll-app
on
host
adm_svr
to
junction
point
/admin
and
make
the
junction
secure
with
SSL:
create
-t
ssl
-b
gso
-T
payroll-app
-h
adm_svr
/admin
Note:
In
the
above
example,
the
–t
ssl
option
dictates
a
default
port
of
443.
Configuring
the
GSO
cache
The
Global
Sign-on
(GSO)
cache
functionality
allows
you
to
improve
the
performance
of
GSO
junctions
in
a
high
load
environment.
By
default,
the
GSO
cache
is
disabled.
Without
the
enhancement
of
the
cache,
a
call
to
the
user
registry
server
is
required
for
each
retrieval
of
GSO
target
information
(GSO
user
name
and
GSO
password).
Parameters
for
configuring
the
GSO
cache
are
located
in
the
[gso-cache]
stanza
of
the
WebSEAL
configuration
file.
You
must
first
enable
the
cache.
The
remaining
parameters
configure
the
cache
size
and
the
timeout
values
for
cache
entries.
Larger
lifetime
and
inactivity
timeout
values
improve
performance,
but
increase
the
risk
of
information
being
exposed
in
the
WebSEAL
memory.
Do
not
enable
the
GSO
cache
if
GSO
junctions
are
not
used
in
your
network
solution.
Parameter
Description
gso-cache-enabled
Enable
and
disable
the
GSO
cache
functionality.
Values
are
yes
or
no.
Default
is
no.
322
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide