IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Table
1.
WebSEAL
instances
sharing
an
IP
address
(continued)
default
1.2.3.4
80
443
web1
1.2.3.4
81
444
For
example,
the
configuration
settings
for
two
WebSEAL
instances
with
unique
IP
addresses
might
be:
Table
2.
WebSEAL
instances
with
unique
IP
addresses
Instance
IP
address
HTTP
port
HTTPS
port
default
1.2.3.4
80
443
web1
1.2.3.5
80
443
Assigning
an
IP
address
to
the
default
WebSEAL
server
instance
In
one
scenario,
the
administrator
must
manually
assign
an
IP
address
to
the
default
WebSEAL
server
instance
before
using
amwebcfg
to
assign
an
IP
address
to
a
new
WebSEAL
server
instance.
The
scenario
occurs
when
the
following
conditions
are
true:
–
When
the
first
(default)
WebSEAL
instance
was
configured,
the
administrator
chose
not
to
use
a
logical
network
interface.
–
When
configuring
a
new
WebSEAL
instance,
the
administrator
wants
to
use
a
logical
network
interface.
–
When
configuring
a
new
WebSEAL
instance,
the
administrator
wants
to
use
the
same
port
for
HTTP,
or
the
same
port
for
HTTPS,
with
each
logical
network
interface.
Note
that
this
scenario
occurs
because
when
the
first
(default)
WebSEAL
instance
is
configured
not
to
use
a
logical
network
interface,
WebSEAL
is
configured
to
listen
on
all
IP
addresses
on
the
specified
ports
(HTTP,
HTTPS).
Thus,
in
order
to
add
WebSEAL
server
instances
that
listen
on
the
same
ports
(for
example,
80
for
HTTP
and
443
for
HTTPS),
the
first
(default)
WebSEAL
instance
must
be
reconfigured
to
receive
an
unique
IP
address.
The
reconfiguration
is
simple.
The
administrator
must
edit
the
WebSEAL
configuration
file
for
the
default
instance,
and
specify
an
IP
address
for
the
default
instance.
The
WebSEAL
configuration
file
for
the
default
instance
is
webseald-default.conf.
For
example,
using
the
default
server
instance
shown
in
the
table
above,
the
following
entry
must
be
added
to
the
configuration
file:
[server]
network-interface
=
1.2.3.4
The
WebSEAL
server
must
then
be
stopped
and
restarted.
Note
that
the
change
to
the
configuration
file
is
needed
only
once.
It
is
not
needed
when
each
additional
server
instance
is
configured.
v
SSL
communication
with
LDAP
server
WebSEAL
communicates
with
the
LDAP
server
during
authentication
procedures.
Use
of
SSL
during
communication
with
the
LDAP
server
is
optional.
However,
use
of
SSL
is
highly
recommended
for
security
reasons
in
all
production
deployments.
Disabling
of
SSL
usage
can
be
considered
for
temporary
testing
or
prototyping
environments.
18
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide