IBM WebSphere V5.0 Security - CGISecurity

Now that we have configured WebSphere for TAI support, and we have set upthe trust relationship for our WebSEAL server, we can now define our SSLjunction between WebSEAL and WebSphere. Note that when using TAI, youmust define an SSL junction. TAI support is not provided by WebSphere on anon-SSL connection.We can now define a junction for our WebSEAL server to connect to WebSphereusing TAI. Create a user id and password in the user registry you are using forWebSphere, for example: tai_user with the password: tai_pwd. Issue thefollowing command, with the right parameters for your environment, in pdadminto create your junction:server task Webseald-WebSEALServer create -t SSL -c iv_user -B -U “WebSEALid”-W “WebSEALpassword” -h WebSphereServerName -p SSLport /JunctionName►►►►►►WebSEALServer: the hostname of your WebSEAL server, for example:wsl01.WebSEALid: the user id you have created for your WebSEAL server. Notethat if you have set the com.ibm.Websphere.security.Webseal.loginid, thenyou should specify a dummy id, and not the actual WebSEAL user id.WebSEALpassword: the password for your WebSEAL server.WebSphereServerName: the hostname of your WebSphere server, forexample: appsrv01.SSLport: the port number defined in WebSphere for SSL connections, forexmaple: 9443.JunctionName: the name for this junction, for example: /tai.After defining your junction, you will now be able to connect to WebSphere fromWebSEAL. When you login to WebSEAL, and access your WebSphere serverover your TAI junction, the Access Manager user id will be passed to, and usedby, WebSphere when invoking your application. Your users will no longer see abasic authentication challenge from your application; instead, the usercredentials passed by WebSEAL over the TAI junction will be used byWebSphere, and your users will not have to perform a second login.If you are reading on, something has probably gone wrong, and it appears thatyour TAI junction is not working. Never fear, your battle scarred veteran is here tolend a hand. We will need to turn on tracing in WebSphere to narrow down theproblem. To begin, we will need to enable tracing, in order to perform this step,follow the instructions at Section , “Security trace” on page 235.Once your server has restarted, the first thing to look at is to see if TAI is actuallyenabled. In the example below we have included a portion of the trace file.Chapter 12. Tivoli Access Manager 401