IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

3.
In
the
Open
dialog
window,
select
Cryptographic
Tokens
from
the
Key
database
type
pull-down
menu.
4.
If
you
have
the
cryptographic
token
specified
in
the
ikmuser.properties
file,
you
will
see
both
the
path
and
the
library
in
the
dialog
box.
If
you
do
not
see
them,
you
can
use
the
Browse...
menu
option.
Click
OK
when
this
is
done.
5.
Additionally,
if
you
want
to
open
an
existing
secondary
key
database
(for
key
data
not
stored
on
the
cryptographic
hardware—such
as
CA
root
certificates),
check
″Open
Existing
Key
Database″.
6.
Browse
for
and
select
the
default
WebSEAL
key
database:
UNIX:
/opt/pdweb/www/certs/pdsrv.kdb
Windows:
C:\Program
Files\Tivoli\pdweb\www\certs\pdsrv.kdb
7.
Click
OK.
The
Token
Password
dialogue
box
appears.
8.
Enter
the
default
password
″pdsrv″.
Click
OK.
9.
The
main
iKeyman
window
returns.
Request
and
store
the
WebSEAL
server
certificate
1.
Follow
instructions
in
the
IBM
Global
Security
Kit
Secure
Sockets
Layer
and
iKeyman
User’s
Guide
to
request
a
secure,
signed
digital
certificate
for
WebSEAL
from
a
Certificate
Authority
(CA).
2.
Follow
instructions
in
the
IBM
Global
Security
Kit
Secure
Sockets
Layer
and
iKeyman
User’s
Guide
to
receive
the
WebSEAL
certificate
from
the
CA
and
store
it
in
a
key
database.
When
performing
this
procedure,
select
the
token
device
representing
the
cryptographic
hardware
as
the
storage
location
for
the
certificate.
3.
When
it
is
stored
on
the
token
device,
the
key
(certificate)
appears
(for
example)
as:
websealtoken:webseal
The
WebSEAL
key
is
stored
on
the
cryptographic
hardware
and
assigned
to
the
token
device
labeled
″websealtoken″.
Configure
WebSEAL
and
GSKit
to
use
the
PKCS#11
shared
library
Configure
WebSEAL
to
use
the
PKCS#11
module
(shared
library).
Edit
the
WebSEAL
configuration
file
and
add
the
appropriate
line
identifying
the
location
of
the
shared
library
under
the
[ssl]
stanza:
UNIX
nCipher
nForce:
[ssl]
pkcs11-driver-path
=
/opt/nfast/toolkits/pkcs11/libcknfast.so
IBM
4758-023
and
IBM
4960:
[ssl]
pkcs11-driver-path
=
/usr/lib/pkcs11/PKCS11_API.so
Eracom
Orange
36
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide