IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Configuring
single
sign-on
to
IBM
WebSphere
(LTPA)
WebSEAL
can
provide
authentication
and
authorization
services
and
protection
to
an
IBM
WebSphere
environment.
When
WebSEAL
is
positioned
as
a
protective
front-end
to
WebSphere,
accessing
clients
are
faced
with
two
potential
login
points.
Therefore,
WebSEAL
supports
a
single
sign-on
solution
to
one
or
more
IBM
WebSphere
servers
across
WebSEAL
junctions.
WebSphere
provides
the
cookie-based
lightweight
third-party
authentication
mechanism
(LTPA).
You
can
configure
WebSEAL
junctions
to
support
LTPA
and
provide
a
single
sign-on
solution
for
clients.
When
a
user
makes
a
request
for
a
WebSphere
resource,
the
user
must
first
authenticate
to
WebSEAL.
After
successful
authentication,
WebSEAL
generates
an
LTPA
cookie
on
behalf
of
the
user.
The
LTPA
cookie,
which
serves
as
an
authentication
token
for
WebSphere,
contains
the
user
identity,
key
and
token
data,
buffer
length,
and
expiration
information.
This
information
is
encrypted
using
a
password-protected
secret
key
shared
between
WebSEAL
and
the
WebSphere
server.
WebSEAL
inserts
the
cookie
in
the
HTTP
header
of
the
request
that
is
sent
across
the
junction
to
WebSphere.
The
back-end
WebSphere
server
receives
the
request,
decrypts
the
cookie,
and
authenticates
the
user
based
on
the
identity
information
supplied
in
the
cookie.
To
improve
performance,
WebSEAL
can
store
the
LTPA
cookie
in
a
cache
and
use
the
cached
LTPA
cookie
for
subsequent
requests
during
the
same
user
session.
You
can
configure
lifetime
timeout
and
idle
(inactivity)
timeout
values
for
the
cached
cookie.
Configuring
an
LTPA
junction
Single
sign-on
to
WebSphere
via
an
LTPA
cookie
requires
the
following
configuration
tasks:
1.
Enable
the
LTPA
mechanism.
2.
Provide
the
location
of
the
key
file
used
to
encrypt
the
identity
information.
3.
Provide
the
password
to
this
key
file.
These
three
configuration
requirements
are
specified
in
three
additional
options
to
the
junction
create
command.
v
The
–A
option
enables
LTPA
cookies.
v
The
–F
″keyfile″
option
and
argument
specifies
the
full
path
name
location
(on
the
WebSEAL
server)
of
the
key
file
used
to
encrypt
the
identity
information
contained
in
the
cookie.
The
shared
key
is
originally
created
on
the
WebSphere
server
and
copied
securely
to
the
WebSEAL
server.
Refer
to
the
appropriate
WebSphere
documentation
for
specific
details
regarding
this
task.
v
The
–Z
″keyfile-password″
specifies
the
password
required
to
open
the
key
file.
The
password
appears
as
encrypted
text
in
the
junction
XML
file.
Use
these
options
in
addition
to
other
required
junction
options
when
you
create
the
junction
between
WebSEAL
and
the
back-end
WebSphere
server.
For
example:
create
...
-A
-F
"/abc/xyz/key.file"
-Z
"abcdefg"
...
324
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide