IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

WebSEAL
parses
the
HTML
page
to
identify
the
request
method,
the
action
URI,
and
any
other
input
fields
in
the
form,
and
saves
them
for
use
in
step
8.
8.
WebSEAL
generates
the
authentication
request
(completes
the
login
form)
and
sends
it
to
the
back-end
application.
9.
The
application
authenticates
the
user
using
the
authentication
data
supplied
by
WebSEAL
in
the
form.
The
application
returns
a
redirect
to
content.html.
10.
WebSEAL
combines
any
cookies
saved
from
the
responses
at
step
7
and
step
9,
and
returns
these
cookies
with
the
redirect
to
the
browser.
Note:
This
completes
the
forms
SSO-specific
functionality.
11.
The
browser
follows
the
redirect
and
requests:
https://webseal/formsso/content.html
12.
WebSEAL
passes
the
request
to
the
back-end
application
across
the
junction.
During
this
process,
the
browser
makes
three
requests
to
WebSEAL.
From
the
user’s
perspective,
only
a
single
request
for
https://webseal/formsso/content.html
is
made.
The
other
requests
occur
automatically
through
HTTP
redirects.
Requirements
for
application
support
Single
sign-on
for
forms
authentication
is
supported
on
applications
that
meet
the
following
requirements:
v
The
login
page
or
pages
for
the
application
must
be
uniquely
identifiable
via
a
single
regular
expression
or
several
regular
expressions.
v
The
login
page
can
include
more
than
one
HTML
form.
However,
the
login
form
must
be
identified
by
applying
a
regular
expression
to
the
action
URIs
of
each
of
the
login
forms,
or
the
login
form
must
be
the
first
form
in
the
login
page.
Note
that
when
using
the
″action″
attribute
to
identify
the
login
form,
the
″action″
attribute
has
not
passed
through
WebSEAL’s
HTML
filtering.
The
regular
expression
should
match
the
action
URI
prior
to
being
filtered.
v
Client-side
scripting
may
be
used
to
validate
input
data,
but
it
must
not
modify
the
input
data
(such
as
using
Javascript
to
set
cookies
in
the
user’s
browser).
v
Login
data
is
submitted
at
only
one
point
in
the
authentication
process.
v
The
junction
where
the
authentication
request
is
directed
must
be
the
same
junction
where
the
login
page
is
returned.
Creating
the
configuration
file
for
forms
single
sign-on
The
forms
single
sign-on
configuration
file
is
custom-created
by
the
administrator
and
saved
in
any
location.
The
–S
option
on
the
junction
enables
the
forms
single
sign-on
functionality
and
specifies
the
location
of
the
configuration
file.
See
“Enabling
forms
single
sign-on”
on
page
332.
A
sample
configuration
file
(containing
commented
instructions)
is
provided
with
the
WebSEAL
installation
and
is
located
in
the
following
directory:
UNIX:
/opt/pdweb/etc/fsso.conf.template
Windows:
C:\Program
Files\Tivoli\PDWeb\etc\fsso.conf.template
The
configuration
file
must
begin
with
the
[forms-sso-login-pages]
stanza
and
has
the
following
format
328
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide