Use domain session cookies for virtual host single sign-on

We can use domain cookies to support single sign-on and the sharing of a single credential across multiple virtual host junctions in the same WebSEAL instance.

WebSEAL normally uses host cookies for cookie-based session identification. A browser returns a host cookie to the originating host only. Using host cookies in a virtual host environment results in each virtual host that has its own login and credentials.

Use domain cookies if all virtual hosts are on the same WebSEAL instance and contain the same network domain name.

Alternatively, we can configure a distributed session cache environment to support single sign-on across multiple virtual hosts. In a distributed session cache environment, the session can be distributed between different WebSEAL instances.

In an environment without the distributed session cache, we must set another configuration item for WebSEAL. Set another configuration to handle single sign-on across virtual host junctions in the same WebSEAL instance. The shared-domain-cookie configuration item in the [session] stanza of the WebSEAL configuration file must be set to yes. We do not need to use this configuration item in a distributed session cache environment. In a distributed session cache environment, this item must be set to no or not defined at all.

Both standard WebSEAL junctions and virtual host junctions can support domain cookies:

• The domain used by the session cookie for a specific virtual host junction is determined by the closest match to an entry in the [session-cookie-domains] stanza.
• The domain used by the session cookie for a specific standard WebSEAL junction is determined by the closest match to the value of the web-host-name entry in the [server] stanza.

If there is no match, then a host type cookie is used.

Other instances of WebSEAL in the same domain also receive the same domain cookies configured for a particular WebSEAL instance. We can customize the names of the WebSEAL session cookies for a specific WebSEAL instance. The WebSEAL instance configuration file provides default names for both TCP and SSL cookies:

[session]
tcp-session-cookie-name = PD-H-SESSION-ID
ssl-session-cookie-name = PD-S-SESSION-ID

See, Customization of the session cookie name.

To enable domain cookies, modify the WebSEAL configuration file to specify the names of the appropriate domains where domain type cookies are to be used. For example:

[session-cookie-domains]
domain = ibm.com
domain = cruz.tivoli.com

Example

Matching example:

[session-cookie-domains]
domain = ibm.com
domain = tivoli.com

Parent topic: Virtual Hosting