WebSphere Application Server Network Deployment, Version 6.0.x     Operating Systems: AIX, HP-UX, Linux, Solaris, Windows

Configuring single signon capability with Tivoli Access Manager or WebSEAL

Why and when to perform this task

Either Tivoli Access Manager WebSEAL or Tivoli Access Manager plug-in for Web servers can be used as reverse proxy servers to provide access management and single signon (SSO) capability to WebSphere Application Server resources. With such an architecture, either WebSEAL or the plug-in authenticates users and forwards the collected credentials to WebSphere Application Server in the form of an IV Header. Two types of single signon are available, the TAI interface and the TAI++ interface, so named as both use WebSphere Application Server trust association interceptors (TAI). With the TAI, the end-user name is extracted from the HTTP header and forwarded to embedded Tivoli Access Manager where the end-user name is used to construct the client credential information and authorize the user. With the TAI++, all of the user credential information is available in the HTTP header and not just the user name. The TAI++ is the more efficient of the two solutions because a Lightweight Directory Access Protocol (LDAP) call is not required. TAI functionality is retained for backwards compatibility.

Complete the following tasks to enable single signon to WebSphere Application Server using either WebSEAL or the plug-in for Web servers. These tasks assume that embedded Tivoli Access Manager is configured for use.

Steps for this task

  1. Create a trusted user account for Tivoli Access Manager in the shared Lightweight Directory Access Protocol (LDAP) user registry. For more information, see Creating a trusted user account in Tivoli Access Manager.
  2. Configure either WebSEAL or the Tivoli Access Manager plug-in for Web servers to work with WebSphere Application Server. For more information, see either of the following articles:
  3. Configure single signon using either the TAI or TAI++ interface. For more information, see either of the following articles:



Sub-topics
Single sign-on settings
com.tivoli.pd.jcfg.PDJrteCfg utility for Tivoli Access Manager single signon
com.tivoli.pd.jcfg.SvrSslCfg utility for Tivoli Access Manager single signon
Creating a trusted user account in Tivoli Access Manager
Configuring WebSEAL for use with WebSphere Application Server
Configuring Tivoli Access Manager plug-in for Web servers for use with WebSphere Application Server
Configuring single signon using the trust association interceptor
Configuring single signon using trust association interceptor ++
Configuring global signon principal mapping

Related tasks
Implementing single signon to minimize Web user authentications

Task topic    

Terms of Use | Feedback

Last updated: Dec 11, 2005 4:07:15 PM CST
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/tsec_sso_ws_using.html

© Copyright IBM Corporation 2004, 2005. All Rights Reserved.
This information center is powered by Eclipse technology. (http://www.eclipse.org)