IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Communication
protocol
configuration
The
following
sections
describe
general
information
about
the
WebSEAL
server:
v
“Configuring
WebSEAL
for
HTTP
requests”
on
page
28
v
“Configuring
WebSEAL
for
HTTPS
requests”
on
page
28
v
“Restricting
connections
from
specific
SSL
versions”
on
page
30
v
“Timeout
parameters
for
HTTP/HTTPS
communication”
on
page
30
v
“Additional
WebSEAL
server
timeout
parameters”
on
page
30
Configuring
WebSEAL
for
HTTP
requests
WebSEAL
typically
handles
many
HTTP
requests
from
unauthenticated
users.
For
example,
it
is
common
to
allow
anonymous
users
read-only
access
to
selected
documents
on
the
public
section
of
your
Web
site.
Parameters
for
handling
HTTP
requests
over
TCP
are
located
in
the
[server]
stanza
of
the
WebSEAL
configuration
file.
Enabling/disabling
HTTP
access
Enable
or
disable
HTTP
access
during
WebSEAL
configuration:
http
=
{yes|no}
IBM
HTTP
Server,
WebSphere
Application
Server
(which
installs
IBM
HTTP
Server),
and
WebSEAL
all
use
port
80
as
the
default
port.
If
you
install
WebSEAL
on
the
same
system
as
IBM
HTTP
Server,
ensure
that
you
change
the
default
port
to
one
of
these
servers.
Edit
the
httpd.conf
configuration
file
or
the
WebSEAL
configuration
file.
Setting
the
HTTP
access
port
value
The
default
port
for
HTTP
access
is
80:
http-port
=
80
To
change
to
port
8080,
for
example,
set:
http-port
=
8080
Configuring
WebSEAL
for
HTTPS
requests
Parameters
for
handling
HTTP
requests
over
SSL
(HTTPS)
are
located
in
the
[server]
stanza
of
the
WebSEAL
configuration
file.
SSL
connections
using
the
WebSEAL
test
certificate
(this
belongs
in
an
SSL
discussion)
Client-side
certificate
authentication
must
take
place
over
a
Secure
Socket
Layer
(SSL)
connection.
The
SSL
connection
is
established
prior
to
the
certificate
authentication
process.
The
SSL
connection
can
be
established
when
a
client
attempts
to
access
a
resource
over
HTTPS.
When
the
resource
does
not
require
authenticated
access,
the
client
negotiates
an
SSL
session
with
the
WebSEAL
server.
The
SSL
session
is
established
when
the
client
and
server
(WebSEAL)
examine
each
other’s
certificate
and
accept
the
validity
of
the
signing
authority.
In
order
to
enable
the
establishment
of
SSL
sessions
on
a
new
WebSEAL
server,
WebSEAL
contains
a
self-signed
test
server
certificate.
WebSEAL
can
present
the
self-signed
certificate
to
the
client.
If
the
client
accepts
the
certificate,
the
SSL
session
is
established.
28
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide