IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

A
single
user
that
logs
in
multiple
times
(for
example,
from
different
machines)
has
multiple
WebSEAL
session
IDs.
Because
the
User
Session
ID
is
based
on
the
WebSEAL
session
ID,
there
exists
a
one-to-one
mapping
between
them.
The
unique
user
session
ID
is
stored
as
an
attribute
to
the
user’s
credential.
This
allows
the
value
to
be
passed
across
a
junction
as
an
HTTP
header
(using
tag-value
functionality)
and
made
available
to
a
back-end
application.
Inserting
credential
data
into
the
HTTP
header
The
goal
of
user
session
management
is
to
provide
the
unique
User
Session
ID
to
the
back-end
application
server.
This
goal
is
accomplished
by
configuring
the
HTTP-Tag-Value
extended
attribute
on
the
junction.
You
use
the
pdadmin
object
modify
set
attribute
command
to
set
an
extended
attribute
on
a
junction
object
in
the
WebSEAL
protected
object
space.
pdadmin>
object
modify
object_name
set
attribute
attr_name
attr_value
An
attribute
(“attr-name”)
enables
the
junction
to
perform
a
specific
type
of
functionality.
The
HTTP-Tag-Value
attribute
enables
the
junction
to
extract
a
value
from
a
credential
extended
attribute
and
send
the
value
to
the
back-end
server
in
an
HTTP
header.
The
value
of
the
HTTP-Tag-Value
extended
attribute
uses
the
following
format:
credential_extended_attribute_name=http_header_name
For
User
Session
ID
data,
the
credential_extended_attribute_name
entry
is
the
same
as
the
user_session_id
extended
attribute
name
specified
in
the
configuration
file
but
without
the
″tagvalue_″
prefix.
The
entry
is
not
case-sensitive.
The
value
of
this
extended
attribute
contains
the
unique
User
Session
ID.
The
http_header_name
entry
specifies
the
name
of
the
HTTP
header
used
to
deliver
the
data
across
the
junction.
In
this
example,
a
header
called
PD-USER-
SESSION-ID
is
used:
pdadmin>
object
modify
/WebSEAL/WS1/junctionA
set
attribute
\
HTTP-Tag-Value
user_session_id=PD-USER-SESSION-ID
When
WebSEAL
processes
a
user
request
to
a
back-end
application
server,
it
looks
for
any
HTTP-Tag-Value
extended
attributes
configured
on
the
junction
object.
In
this
example,
the
configured
junction
looks
at
the
credential
of
the
user
making
the
request,
extracts
the
User
Session
ID
value
from
the
tagvalue_user_session_id
extended
attribute
in
the
credential,
and
places
the
value
in
an
HTTP
header
as:
PD-USER-SESSION-ID:user_session_id
In
summary:
Value
of
HTTP-Tag-Value
attribute
set
on
the
junction
object:
user_session_id=PD-USER-SESSION-ID
Attribute
name
and
value
as
they
appear
in
the
user
credential:
tagvalue_user_session_id:user_session_id_number
HTTP
header
name
and
value:
PD-USER-SESSION-ID:user_session_id_number
If
the
back-end
application
is
a
CGI
application,
the
CGI
specification
dictates
that
HTTP
headers
are
made
available
to
CGI
programs
as
environment
variables
in
the
form:
344
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide