Configure single sign-on capability with Tivoli Access Manager or WebSEAL

 

+

Search Tips   |   Advanced Search

 

Use the following information to enable single sign-on to WebSphere Application Server using either WebSEAL or the plug-in for Web servers.

 

Overview

Either Tivoli Access Manager WebSEAL or Tivoli Access Manager plug-in for Web servers can be used as reverse proxy servers to provide access management and SSO capability to WAS resources.

With such an architecture, either WebSEAL or the plug-in authenticates users and forwards the collected credentials to WAS in the form of an IV Header. Two types of single sign-on are available, the TAI interface and the TAI++ interface, so named as both use WAS trust association interceptors (TAI).

With the TAI, the end-user name is extracted from the HTTP header and forwarded to embedded TAM where the end-user name is used to construct the client credential information and authorize the user.

With the TAI++, all of the user credential information is available in the HTTP header and not just the user name. The TAI++ is the more efficient of the two solutions because an LDAP call is not required. TAI functionality is retained for backwards compatibility.

Complete the following tasks to enable single sign-on to WAS using either WebSEAL or the plug-in for Web servers. These tasks assume that embedded TAM is configured for use.

 

Procedure

  1. Create a trusted user account for TAM in the shared LDAP user registry.

  2. Configure either WebSEAL or the TAM plug-in for Web servers to work with WAS.

  3. Configure single sign-on using either the TAI or TAI++ interface.


Single sign-on settings
com.tivoli.pd.jcfg.PDJrteCfg utility for TAM single sign-on
com.tivoli.pd.jcfg.SvrSslCfg utility for TAM single sign-on
Creating a trusted user account in TAM
Configure WebSEAL for use with WAS
Configure TAM plug-in for Web servers for use with WAS
Configure single sign-on using the trust association interceptor
Configure single sign-on using trust association interceptor ++
Configure global sign-on principal mapping

 

Related tasks


Implementing single sign-on to minimize Web user authentications