IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

WebSEAL
generates
logging
and
auditing
data
using
UTF-8.
To
prevent
possible
data
loss,
it
is
recommended
that
UTF-8
be
used
to
write
the
data
to
the
appropriate
logging
and
auditing
files.
When
the
local
code
page
is
non-UTF-8,
data
must
be
converted
to
non-UTF-8
before
it
can
be
written.
In
this
case,
the
possibility
of
data
loss
exists.
All
log
audit
files
generated
by
WebSEAL
are
in
the
language
specified
by
the
locale
in
which
the
server
runs.
The
code
page
used
to
write
the
messages
is
configurable
in
the
WebSEAL
routing
file.
For
example,
on
UNIX
systems,
the
file
is
/opt/pdweb/etc/routing.
UTF-8
environment
variables
for
CGI
programs
CGI
scripts
use
environment
variables
are
used
to
communicate
with
WebSEAL,
and
the
environment
variables
must
be
in
the
local
code
page.
Legacy
CGI
scripts
expect
raw
(binary)
local
code
page
strings.
To
enable
CGI
scripts
to
understand
environment
variable
values
that
can
consist
of
UTF-8
data,
WebSEAL
provides
additional
environment
variables.
These
variables
have
the
same
names
as
current
CGI
variables,
but
with
the
characters
″_UTF8″
appended
to
the
end.
The
values
of
these
variables
are
URI
(Uniform
Resource
Indicator)
encoded
UTF-8
strings.
URI
encoding
is
used
to
prevent
data
loss
on
platforms
which
expect
local
code
page
environment
variables
in
spawned
processes.
The
variables
are:
v
REMOTE_USER_UTF8
v
IV_USER_UTF8
v
HTTP_IV_USER_UTF8
v
IV_GROUPS_UTF8
v
HTTP_IV_GROUPS_UTF8
New
CGI
programs
should
use
these
variables
because
their
values
contain
UTF-8
data.
WebSEAL
stores
the
data
for
these
variables
internally
in
UTF-8
format.
The
data
must
be
converted
to
local
code
page
in
order
for
CGI
programs
to
use
it.
When
the
old
CGI
variables
(
for
example,
REMOTE_USER)
are
used,
and
the
local
code
page
is
not
UTF-8
encoded,
the
conversion
of
the
UTF-8
data
to
the
local
code
page
can,
in
some
cases,
result
in
data
corruption.
UTF-8
impact
on
authentication
The
use
of
UTF-8
for
internal
data
handling
has
the
following
impacts
on
WebSEAL’s
processing
of
authentication
requests:
v
UTF-8
logins
over
basic
authentication
not
supported
Use
of
UTF-8
with
basic
authentication
(BA)
login
is
not
supported.
UTF-8
logins
with
BA
cannot
be
supported
because
browsers
transmit
data
in
inconsistent
ways.
In
prior
releases,
WebSEAL
did
not
support
multi-byte
BA
logins
because
of
browser
inconsistency.
This
is
unchanged
for
Version
5.1.
WebSEAL
consumes
BA
login
strings
with
the
expectation
that
they
are
in
local
code
page.
WebSEAL
supports
7-bit
ASCII
and
single-byte
Latin
code
pages.
Thus,
for
example,
a
server
that
wants
to
allow
French
users
to
use
BA
logins
must
run
in
a
Latin
locale.
WebSEAL
consumes
the
BA
login
string
and
converts
it
to
UTF-8
internally.
However,
if
the
French
user
has
a
UTF-8
code
page,
BA
login
is
not
available,
because
the
login
string
will
be
multi-byte.
v
Forms
login
46
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide