IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

WebSEAL
attempts
to
distinguish
between
UTF-8
and
other
forms
of
language
character
encoding.
WebSEAL
correctly
processes
any
correctly
constructed
UTF-8
encoding.
If
the
encoding
does
not
appear
to
be
UTF-8,
then
the
coding
is
processed
as
DBCS
or
Unicode.
If
a
URL
has
Unicode
in
the
format
″%uHHHH″,
WebSEAL
converts
it
to
UTF-8.
The
rest
of
the
decoding
proceeds
as
if
the
configuration
settings
was
yes.
IF
the
double-byte-encoding
option
in
the
[server]
stanza
is
set
to
yes,
WebSEAL
converts
%HH%HH
to
UTF-8.
Servers
running
in
a
single-byte
Latin
locale
that
need
to
process
multi-byte
strings
should
use
the
auto
setting.
Servers
running
in
a
multi-byte
locale
but
just
need
to
support
one
language
(for
example,
Japanese)
can
use
the
auto
setting.
A
recommended
deployment
strategy
is
as
follows:
1.
Unless
required
for
content
purposes,
immediately
check
and
set
the
default-webseal
ACL
on
existing
production
deployments
to
NOT
allow
unauthenticated
″r″
access.
This
limits
security
exposure
to
users
who
do
have
a
valid
account
within
the
Tivoli
Access
Manager
domain.
2.
Ensure
that
the
utf8-url-support-enabled
parameter
is
set
to
the
default
value
of
yes.
3.
Test
your
applications.
If
they
function
correctly,
use
this
setting.
4.
If
any
applications
fail
with
″Bad
Request″
errors,
retry
the
application
with
the
utf8-url-support-enabled
parameter
set
to
no
If
this
works,
you
may
deploy
with
this
setting.
Ensure,
however,
that
no
junctioned
Web
server
is
configured
to
accept
UTF-8
encoded
URLs.
5.
If
the
application
continues
to
have
problems,
try
setting
utf8-url-support-
enabled
to
auto.
UTF-8
support
for
forms
The
manner
in
which
WebSEAL
processes
data
from
forms
(for
example,
a
login
form)
can
be
specified
in
the
WebSEAL
configuration
file:
[server]
utf8-form-support-enabled
=
{yes|no|auto}
The
forms
providing
data
to
the
server
are
forms
that
are
part
of
WebSEAL,
such
as
login
forms.
These
forms
all
declare
the
character
set
to
be
UTF-8.
Thus
the
default
value
is
yes.
If
an
administrator
edits
these
forms
and
changes
the
character
set
to
a
non-UTF-8
setting,
such
as
a
local
code
page,
this
configuration
setting
should
be
changed.
If
some
forms
use
UTF-8
and
some
use
a
local
code
page,
use
the
auto
value.
If
all
forms
are
modified
to
use
a
non-UTF-8
setting,
use
the
no
value.
The
three
possible
values
are
as
follows:
v
yes
WebSEAL
only
recognizes
UTF-8
encoding
in
forms
and
the
data
is
used
without
modification.
These
UTF-8
characters
are
then
validated
and
taken
into
account
when
processing
the
data.
Other
encoding
techniques
are
not
accepted.
When
double-byte-encoding
is
set
to
yes,
Unicode
of
the
form
%HH%HH
is
supported.
When
a
double-byte
Unicode
character
is
detected,
the
entire
string
must
be
double-byte
encoded.
This
is
the
default
value,
and
is
recommended.
v
no
Chapter
2.
WebSEAL
server
configuration
49