IBM WebSphere V5.0 Security - CGISecurity

Property key
com.ibm.Websphere.security.Webseal.loginID
com.ibm.Websphere.security.Webseal.mutualSSL
Value
This property specifies the userID
(e.g. tai_user in the scenario
above) which will be
authenticated, using the
password appearing in the HTTP
Basic Authentication (BA) header
to validate the incomming
request. If this property is used,
the userID appearing in the BA
header is ignored. If this property
is not used, the interceptor
authenticates using both the
userID and password appearing
in the BA header. This property
has no effect when the
mutualSSL property is set to true.
If this property is set to true, the
WebSEAL interceptor implicitly
trusts that the WeEAL junction
has been secured through the
use of one of WebSEAL’s
mutually authenticated SSL
junction capabilities. When this
property is set to true, the
interceptor skips the
authentication step in the
validation of the request.
Important: Setting the mutualSSL property to true effectively disables one of
the mechanisms of validating the WebSEAL server and its authentication of
the client’s identity. In some instances, it may be sufficient for the interceptor to
validate the request on the basis of the originating hostname and port, but in
general this should be done with caution.
Important: If the interceptor ignores or fails to validate a request, the
WebSphere security runtime will proceed to handle the request as if the
interceptor had not been enabled. In other words, requests that are not
handled by the interceptor are not rejected, but rather are passed unchanged
to the security runtime.
394 IBM WebSphere V5.0 Security Handbook