IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Junction
″best
practices″
for
application
integration
This
section
includes
“best
practices”
recommendations
when
using
WebSEAL
junctions.
v
“Supplying
complete
HOST
header
information
with
-v”
on
page
339
v
“Supporting
standard
absolute
URL
filtering”
on
page
339
Supplying
complete
HOST
header
information
with
-v
Virtual
host
configurations
and
portal
applications
require
correct
IP
address
information
for
proper
socket
connections,
and
complete
server
name
information
for
accurate
routing.
These
special
back-end
application
services
require
complete
server
name
and
port
designation
information
in
any
requests
from
browsers.
The
HOST
header
of
a
request
contains
this
information
and
makes
it
available
to
the
application.
When
using
WebSEAL
junctions,
this
information
is
supplied
to
the
HOST
header
through
the
use
of
the
–v
junction
option.
Insufficient
or
missing
server
name
and
port
information
degrades
the
performance
of
virtual
hosting
and
portal
applications.
In
addition,
domain
cookies
set
by
these
applications
may
not
contain
sufficient
information.
To
provide
the
most
complete
information
to
the
HOST
header,
the
“best
practices”
recommendation
is
to
always
use
both
the
fully
qualified
domain
name
of
the
junctioned
server
and
the
connection
port
number
in
the
–v
option
when
creating
or
adding
the
junction.
The
–v
option
uses
the
following
syntax:
-v
fully-qualified-host-name[:port]
For
example:
-v
xyz.ibm.com:7001
Note:
The
port
designation
should
be
supplied
only
if
you
are
using
a
non-standard
port
number.
Supporting
standard
absolute
URL
filtering
WebSEAL,
as
a
front-end
reverse
proxy,
provides
security
services
to
back-end
junctioned
application
servers.
Pages
returned
to
the
client
from
back-end
applications
most
often
contain
URL
links
to
resources
located
on
the
back-end
junctioned
server.
It
is
important
that
these
links
include
the
junction
name
to
successfully
direct
the
requests
back
to
the
correct
locations
of
the
resources.
WebSEAL
uses
a
set
of
standard
rules
to
filter
static
URLs
and
supply
this
junction
information.
Additional
configuration
is
required
to
filter
URLs
in
scripts
and
dynamically
generated
URLs.
For
detailed
information
on
URL
filtering,
see
“Modifying
URLs
to
back-end
resources”
on
page
287.
WebSEAL’s
ability
to
properly
filter
absolute
URLs
from
static
HTML
pages
requires
information
about
the
server
name
provided
in
the
–h
junction
option.
This
option
provides
WebSEAL
with
the
name
of
the
back-end
junctioned
server.
Arguments
to
this
option
can
include:
v
Fully
qualified
domain
name
of
the
server
Chapter
12.
Application
integration
339