IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Maintaining
session
state
between
client
and
back-end
applications
WebSEAL
can
maintain
session
state
with
clients
over
HTTP
and
HTTPS.
Additionally,
you
can
configure
WebSEAL
to
provide
user
session
information
to
back-end
junctioned
application
servers.
With
this
user
session
information,
back-end
applications
can
maintain
session
state
with
clients.
Background
to
user
session
management
A
secure
connection,
or
session,
between
a
client
and
a
server
requires
that
the
server
have
the
ability
to
remember—over
numerous
requests—who
it
is
talking
to.
The
server
must
have
some
form
of
session
state
information
that
identifies
the
client
associated
with
each
request.
Without
an
established
session
state
between
client
and
server,
the
communication
between
the
client
and
the
server
must
be
renegotiated
for
each
subsequent
request.
Session
state
information
improves
performance
by
eliminating
repeated
closing
and
re-opening
of
client/server
connections.
The
client
can
log
in
once
and
make
numerous
requests
without
performing
a
separate
login
for
each
request.
WebSEAL
maintains
session
state
information
through
the
GSKit
SSL
session
ID
cache
and
the
WebSEAL
session/credentials
cache.
The
GSKit
session
cache
supports
HTTPS
(SSL)
communication
when
the
SSL
session
ID
is
used
to
maintain
session
state.
The
WebSEAL
credentials
cache
stores
a
WebSEAL
session
ID
for
each
client
plus
any
credential
information
specific
to
each
client.
You
can
configure
WebSEAL
to
store
a
unique
User
Session
ID
for
each
authenticating
client
as
an
extended
attribute
in
the
credential
of
each
client.
Using
extended
attributes
for
Tivoli
Access
Manager
objects,
you
can
configure
a
junction
to
provide
this
User
Session
ID
information
to
the
back-end
server.
An
application
on
this
back-end
server
can
take
advantage
of
the
user
session
information
to
manage
the
client-server
interaction,
such
as
tracking
the
activity
of
users.
Enabling
user
session
id
management
The
user-session-ids
parameter
in
the
[session]
stanza
of
the
WebSEAL
configuration
file
allows
you
to
enable
and
disable
the
creation
of
a
unique
User
Session
ID
in
the
credential
of
each
client
making
a
request.
The
default
value
is
“no”
(disabled):
[session]
user-session-ids
=
no
To
enable
the
creation
of
unique
User
Session
IDs,
set
user-session-ids
=
yes.
The
unique
User
Session
ID
is
stored
in
a
user’s
credential
as
an
extended
attribute
with
a
name
and
value:
tagvalue_user_session_id
=
user_session_id
In
the
credential
itself,
the
credential
extended
attribute
name
(user_session_id)
appears
with
a
“tagvalue_”
prefix
to
prevent
any
conflicts
with
other
existing
information
in
the
credential.
The
value
of
the
User
Session
ID
is
a
string
that
uniquely
identifies
a
specific
session
for
an
authenticated
user.
The
User
Session
ID
is
a
MIME-64
encoded
string
that
includes
the
WebSEAL
instance
names
and
the
standard
WebSEAL
session
ID
for
the
user.
Chapter
12.
Application
integration
343