IBM WebSphere V5.0 Security - CGISecurity

[8/22/02 7:42:51:655 CDT] 277a2e5c WebAuthentica d Mapped credential forTrustAssociation was validated successfully.[8/22/02 7:42:51:655 CDT] 277a2e5c WebAuthentica < handleTrustAssociation: OK[8/22/02 7:42:51:655 CDT] 277a2e5c WebAuthentica d Successful authentication[8/22/02 7:42:51:700 CDT] 277a2e5c WebAuthentica > createCookie LtpaTokenQNu+31OoJ9pOIKcC+IcAuAubI5rFE4JedMHq2YlKJVOcQsNWkC12.4.2 Forms Authentication Single Sign-OnWith the Single Sign-On solution provided with Access Manager, you have theability to provide your users with the capability to access your WebSphereapplications transparently, without them being aware that Access Manager ishandling authentication for them to your applications. Up until now, if yourexisting applications require the use of a login form to authenticate, it was stillnecessary for your users to login again to your applications, after performing alogin to Access Manager. Howerver, with the release of V3.9 of Access Managerfor eBusiness, it is now possible to acheive a Single Sign-On solution to yourapplications, even for those applications which require the use of a login form.Tivoli Access Manager for eBusiness V3.9 provides support to login an AccessManager user to a WebSphere application using HTML forms for authentication.When you enable Single Sign-On forms authentication, the WebSEALcomponent of Access Manager will intercept the login form from yourWebSphere application, and will supply the authentication information requiredback to the application. Your back-end WebSphere application will be unawarethat the response is from WebSEAL, and not the user, and the user will beunaware that a second login occured.To enable Single Sign-On forms authentication to a back-end application, theAccess Manager administrator must do two things. First, a configuration file mustbe created defining to WebSEAL how to identify a login form when it is receivedfrom the back-end application, and second, a junction must be created to theback-end Web server using the -S option, which specifies the location of theconfiguration file. Once this is completed, WebSEAL will provide login support forAccess Manager users to the back-end WebSphere application.For further information on enabling single-sign on forms authentication, refer tothe Access Manager for eBusiness WebSEAL Administrators Guide.Creating the Single Sign-On forms authentication configuration fileThe purpose of the configuration file for Single Sign-On forms authentication is todefine the following to WebSEAL:►A pattern which WebSEAL can use to identify the URI which indicates arequest to the back-end application for a login form.408 IBM WebSphere V5.0 Security Handbook