IBM WebSphere V5.0 Security - CGISecurity

Enabling Single Sign-On for WebSphere
After configuring WebSphere Application Server to use Domino LDAP, the SSO
configuration is identical to the one discussed in the previous section. Please
refer to “Enabling Single Sign-On for WebSphere” on page 494 for details.
Remember that you should always generate LTPA keys after successful
configuration of the LDAP user registry.
Important: Do not forget to enter the domain name in the Single sign-on
section of the LTPA configuration panel.
Enabling Single Sign-On for Domino
When using Domino directory as a user registry, Domino Server does not need to
use directory assistance as described in the previous section. After putting all the
application users and groups into your Domino directory, you can follow the
instruction from “Enabling Single Sign-On for Domino” on page 499 for importing
LTPA keys and enabling Single Sign-On for the Domino Server.
For our sample scenario, we have defined the following users and groups in
Domino Directory:
Table C-2 Users and groups defined in Domino directory for ITSO application
Group name
managergrp/ITSO
clerkgrp/ITSO
accountantgrp/ITSO
consultantgrp/ITSO
Group members
manager01/ITSO
clerk01/ITSO
accountant01/ITSO
consultant01/ITSO
We have mapped Domino directory groups to corresponding user roles in the
ITSO bank application, and accordingly modified ACL in the
ITSOBankComments application database.
If your server is already configured to use Single Sign-On, please remember that
reconfiguration does not mean creating a new Web Single Sign-On Configuration
document. On a server, it may only be one Web Single Sign-On Configuration
Document. So, if you have one already, you should edit it and import new LTPA
keys.
Testing Single Sign-On
For testing this scenario you can follow testing instructions from the previous
section. Please refer to “Testing Single Sign-On” on page 505.
512 IBM WebSphere V5.0 Security Handbook