IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Supporting
back-end
server-side
applications
WebSEAL
also
provides
support
for
executable
code
that
runs
as
an
embedded
component
of
a
back-end
Web
server.
Examples
of
such
server-side
executable
code
include:
v
Java
servlets
v
Cartridges
for
Oracle
Web
Listener
v
Server-side
plug-ins
When
you
create
a
junction
to
a
back-end
server
using
the
–c
option,
WebSEAL
inserts
Tivoli
Access
Manager-specific
client
identity
and
group
membership
information
into
the
HTTP
headers
of
requests
destined
for
that
server.
The
Tivoli
Access
Manager-specific
HTTP
header
information
enables
applications
on
junctioned
third-party
servers
to
perform
user-specific
actions
based
on
the
client’s
Tivoli
Access
Manager
identity.
WebSEAL
provides
the
following
Tivoli
Access
Manager-specific
HTTP
headers:
PD-specific
HTTP
Header
Fields
Description
iv-user
=
The
short
or
long
name
of
the
client.
Defaults
to
“Unauthenticated”
if
client
is
unauthenticated
(unknown).
iv-groups
=
A
list
of
groups
to
which
the
client
belongs.
Specified
as
a
comma
separated
list
of
quoted
groups.
iv-creds
=
Encoded
opaque
data
structure
representing
a
Tivoli
Access
Manager
credential.
Supplies
credentials
to
remote
servers
so
mid-tier
applications
can
use
the
authorization
API
to
call
the
authorization
service.
Refer
to
the
IBM
Tivoli
Access
Manager
Authorization
C
API
Developer’s
Reference.
These
HTTP
headers
are
available
to
CGI
applications
as
the
environment
variables
HTTP_IV_USER,
HTTP_IV_GROUPS
and
HTTP_IV_CREDS.
For
other
non-CGI
application
frameworks,
see
their
associated
product
documentation
for
instructions
on
extracting
headers
from
HTTP
requests.
See
also
“Supplying
client
identity
in
HTTP
headers
(–c)”
on
page
298.
Note:
To
ensure
security
of
the
iv_creds
value,
use
SSL
junctions.
338
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide