IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

1.
Client
browser
requests
the
page:
https://webseal/formsso/content.html
2.
WebSEAL
passes
the
request
to
the
junction.
3.
Because
the
back-end
application
requires
the
user
to
authenticate,
a
redirect
to
the
application’s
login
page
(login.html)
is
sent
back
across
the
junction.
4.
WebSEAL
passes
the
redirect
to
the
browser.
5.
The
browser
follows
the
redirect
and
requests:
https://webseal/formsso/login.html
Note:
Everything
to
this
point
in
the
process
flow
is
standard
WebSEAL
functionality.
6.
WebSEAL
has
been
configured
for
forms
single
sign-on
(–S
option
on
the
junction).
WebSEAL
recognizes
the
request
as
a
request
for
a
login
page,
based
on
information
contained
in
the
forms
SSO
configuration
file.
The
request
is
passed
to
the
junction.
WebSEAL
saves
all
cookies
sent
by
the
browser
for
use
in
step
8.
7.
The
application
returns
the
login
page
and
perhaps
application-specific
cookies.
WebSEAL
parses
the
HTML
returned
to
identify
the
login
form.
When
WebSEAL
finds
an
HTML
form
in
the
document,
it
compares
the
action
URI
in
the
form
to
the
value
of
the
login-form-action
parameter
in
the
custom
configuration
file.
If
there
is
a
match,
WebSEAL
uses
the
form
found.
Otherwise,
WebSEAL
keeps
searching
for
other
forms.
If
no
form
in
the
page
matches
the
action
URI
pattern
from
the
configuration
file,
then
WebSEAL
terminates
forms
single
sign-on
processing
and
returns
an
error
to
the
browser.
Client
browser
WebSEAL
Application
Server
junction -S
request
1 2
4
5 6
7
8
3
9
10
11
12
login required
redirect to
login page
browser follows
redirect
fsso begins;
cookies saved
application
returns login form
WebSEAL
completes form
login succeeds;
redirect to request
saved cookies
restored;
fsso ends
browser follows
redirect
application
processes request
Figure
20.
Forms
single
sign-on
process
flow
Chapter
11.
Single
sign-on
solutions
across
junctions
327