IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
A
user
makes
a
request
for
a
resource
protected
by
WebSEAL.
The
protection
on
the
resource
does
not
require
that
the
user
be
authenticated.
WebSEAL
does
not
prompt
the
user
to
log
in.
v
WebSEAL
builds
an
unauthenticated
credential
for
the
user.
v
No
entry
is
created
in
the
WebSEAL
session/credentials
cache.
v
The
user
can
access
resources
that
contain
the
correct
permissions
for
the
unauthenticated
type
category
of
user.
v
If
the
user
requires
access
to
a
resource
not
available
to
unauthenticated
users,
WebSEAL
prompts
the
user
to
log
in.
v
A
successful
log
in
changes
the
user’s
status
to
authenticated.
v
If
log
in
is
unsuccessful,
a
403
″Forbidden″
message
is
returned.
The
user
can
still
continue
to
access
other
resources
that
are
available
to
unauthenticated
users.
The
WebSEAL
session/credentials
cache
structure
The
WebSEAL
session
cache
is
also
known
as
the
WebSEAL
credentials
cache.
The
cache
can
be
represented
as
an
internal
table
where
WebSEAL
stores
information
about
all
sessions
established
by
authenticated
users.
Each
user
session
is
represented
by
an
entry
in
the
cache
table.
Each
cache
entry
contains
the
following
types
of
information:
v
Session
ID
The
session
ID
is
a
unique
identifier
that
is
sent
with
each
request
made
by
that
user.
The
session
ID
identifies
the
specific
cache
entry
for
that
user.
v
Cache
data
The
most
important
data
stored
in
the
cache
entry
is
the
user
credential.
The
credential
is
required
whenever
the
user
requests
protected
resources.
The
authorization
service
uses
the
credential
information
to
permit
or
deny
access
to
the
resource.
WebSEAL
can
mark,
or
″flag″,
a
cache
entry
to
support
certain
functionality.
For
example,
when
session
inactivity
reauthentication
is
enabled,
a
cache
entry
is
″flagged″
when
the
session
inactivity
value
has
expired.
v
Timestamps
The
creation
timestamp
for
the
cache
entry
becomes
the
reference
point
for
the
session
lifetime
value.
The
″last
active″
timestamp
for
the
cache
entry
becomes
the
reference
point
for
the
session
inactivity
timer.
The
user
credential
contains:
v
User
name
v
Group
memberships
v
Extended
attributes
Extended
attributes
allow
you
to
store
customized
data
in
the
user
credential.
An
example
of
a
credential
extended
attribute
is
the
tagvalue_user_session_id
attribute.
The
value
of
this
attribute
can
be
inserted
in
an
HTTP
header
to
allow
a
back-end
junctioned
server
to
maintain
session
state
with
the
user.
10
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide