IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

HTTP_HTTP_header_name
For
example:
HTTP_PD-USER-SESSION-ID=user_session_id
Terminating
user
sessions
A
user
can
initiate
the
termination
of
the
current
session
through
the
pkmslogout
command.
Additionally,
the
information
in
the
User
Session
ID
allows
administrators
and
back-end
applications
to
track
and
manage
users.
This
section
describes
two
methods
of
terminating
the
user
session
at
an
administration
level:
v
“Using
Administration
API
to
terminate
single
user
sessions”
on
page
345
v
“Using
pdadmin
to
terminate
all
user
sessions”
on
page
345
Using
Administration
API
to
terminate
single
user
sessions
A
back-end
application
can
use
the
Tivoli
Access
Manager
administration
API
to
terminate
a
specific
user
session
based
on
the
User
Session
ID
passed
across
the
junction.
The
application
invokes
the
ivadmin_server_performtask()
function
inside
its
terminate
code.
The
WebSEAL
server
instance
and
the
User
Session
ID
are
included
as
parameters
to
this
function.
WebSEAL
verifies
that
the
back-end
server
initiating
the
terminate
operation
has
appropriate
permissions
before
terminating
the
user
session.
It
is
important
to
consider
the
conditions
under
which
this
command
might
be
used.
If
the
intent
is
to
make
sure
a
user
is
removed
from
the
secure
domain
entirely,
the
termination
of
a
single
user
is
only
effective
when,
in
addition,
the
account
for
that
user
is
made
invalid
(removed).
Certain
authentication
methods—such
as
Basic
Authentication,
client-side
certificate,
and
failover
cookies—return
cached
authentication
information
automatically
with
no
user
intervention.
The
termination
action
would
not
prevent
return
logins
for
a
user
using
any
of
those
authentication
methods.
You
must
additionally
invalidate
the
appropriate
user
account
in
the
registry.
Refer
to
the
IBM
Tivoli
Access
Manager
for
e-business
Administration
C
API
Developer
Reference
for
further
information.
Using
pdadmin
to
terminate
all
user
sessions
An
administrator
can
use
the
pdadmin
utility
to
terminate
all
sessions
for
a
specified
user
based
on
the
user
ID.
pdadmin>
server
task
instance_name-webseald-host_name
terminate
all_sessions
user_id
The
WebSEAL
credentials
cache
is
organized
to
cross-reference
user
ID,
WebSEAL
session
ID,
and
cache
entry
information.
A
user
always
has
the
same
user
ID
across
multiple
sessions.
Each
WebSEAL
session
ID,
however,
is
unique.
The
terminate
all_sessions
command
removes
all
cache
entries
belonging
to
the
user_id.
WebSEAL
checks
for
appropriate
permissions
for
the
administrator
initiating
the
command
before
terminating
user
sessions.
It
is
important
to
consider
the
conditions
under
which
this
command
might
be
used.
If
the
intent
is
to
make
sure
a
certain
group
of
users
are
removed
from
the
secure
domain
entirely,
the
terminate
all_sessions
command
is
only
effective
when,
in
addition,
the
accounts
for
those
users
are
made
invalid
(removed).
Certain
authentication
methods—such
as
Basic
Authentication,
client-side
certificate,
and
failover
cookies—return
cached
authentication
information
Chapter
12.
Application
integration
345