IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

In
previous
versions
of
WebSEAL,
forms
login
data
was
always
consumed
by
WebSEAL
with
the
auto
functionality.
This
meant
that
WebSEAL
examined
the
login
data
to
see
if
it
was
in
UTF-8
format.
If
the
data
was
not
in
UTF-8
format,
the
data
was
processed
as
local
code
page.
In
Version
5.1,
this
setting
is
configurable,
as
described
in
“UTF-8
support
for
forms”
on
page
49.
v
Cross-domain
single
sign-on,
e-community
single
sign-on,
and
failover
authentication
Each
of
these
authentication
methods
employs
encoded
tokens.
The
encoding
of
these
tokens
must
be
configured
to
either
use
UTF-8
encoding
or
non-UTF-8
encoding.
For
more
information,
see
“Configuring
multi-locale
support”
on
page
48.
v
Conversion
shared
library
To
maintain
backwards
compatibility
with
customized
authentication
libraries,
such
as
CDASs,
that
expect
data
in
non-UTF-8
format,
WebSEAL
provides
a
conversion
shared
library
for
use
during
authentication.
This
library
automatically
converts
data
between
non-UTF-8
and
UTF-8
format.
Use
of
this
library
requires
a
specific
configuration
step.
For
more
information,
see
the
IBM
Tivoli
Access
Manager
for
e-business
Web
Security
Developer
Reference.
URLs
must
use
only
one
encoding
type
WebSEAL
requires
that
any
URL
presented
for
processing
contain
only
a
single
character
encoding
type
such
as
UTF-8
or
ShiftJIS.
When
URLs
contain
multiple
character
encoding
types,
WebSEAL
cannot
guarantee
the
accuracy
of
the
data
in
the
request
because
the
decoded
value
of
the
UTF-8
characters
might
not
match
the
decoded
value
of
the
same
characters
in
the
local
code
page.
This
possible
inaccuracy
in
the
data
could
cause
WebSEAL
to
mistakenly
grant
unauthorized
users
access
to
protected
objects.
When
WebSEAL
encounters
a
URL
with
multiple
character
encoding
types,
the
URL
is
returned
as
a
Bad
Request.
UTF-8
support
during
WebSEAL
upgrade
Upgrading
of
WebSEAL
from
a
prior
version
(prior
to
Version
5.1)
results
in
the
following
configuration:
v
The
value
of
the
existing
configuration
option
utf8–url-support-enabled
is
preserved.
v
The
new
configuration
option
utf8–form-support-enabled
is
set
to
auto.
This
setting
preserves
the
behavior
of
existing
WebSEAL
servers.
[server]
utf8-form-support-enabled
=
auto
v
All
existing
WebSEAL
junctions
are
migrated
with
the
following
option:
-e
lcp_bin
Use
of
this
value
allows
existing
environments
and
applications
to
operate
without
change.
Note
that
this
is
not
the
default
WebSEAL
Version
5.1
configuration
value.
Chapter
2.
WebSEAL
server
configuration
47