WebSEAL

The connection between the WebSEAL server and a back-end Web application server is referred to as a WebSEAL junction.

In extreme cases where a high number of active user sessions are anticipated, it might be necessary to add WebSEAL instances.

The front-end reverse proxy also handles load balancing between the WebSEAL servers.

Even though WebSEAL can be configured to pass the end user identity in other ways, the iv-user header is the only one supported by the TAI.

WebSEAL is intelligent enough to filter JavaScript, but you need to tell it to do so.

First, TAM WebSEAL must be configured to send its user ID and password to the application servers for the junction being configured.

In this configuration, the WebSEAL server identifies and authenticates itself to the Web server using its own client-side certificates.

The difference between the two configurations is how WebSEAL proves itself to the application server.

However for a multi-tenant SaaS delivery platform, the level of customization provided by WebSeal is not sufficient.

This solution deploys a cluster of WebSEAL instances that are configured for both basic authentication and form-based authentication.

The Web server for Application Server must have the signing certificates for the WebSEAL server's client certificate.

WebSEAL can front-end any Web application server or Web server in an enterprise e-business infrastructure.

You should, of course, configure SSL from WebSEAL to the application server to ensure that the secret password is not sent in cleartext.

Depending on how WebSEAL is configured, clients can connect to a secure domain as either authenticated or unauthenticated.

For this reason, we configure a TAI to use password authentication from WebSEAL in the example described later in this article.

This URL information will not be re-written by WebSEAL, and as such can cause a variety of issues, mainly around dead links.

A WebSEAL junction can be considered a logical mount point in the WebSEAL Web space and is illustrated in Figure 3.

The TAI accepts password-based authentication from WebSEAL, rather than assuming an SSL trusted connection.

If script filtering was enabled, the variable url_1 defined in example. js would be re-written by WebSEAL.

You also must alter its trust store to include only the client certificate that WebSEAL is using.

The WebSEAL TAI validates this password against the registry when it is received.

Continue through the following screens to enter a name for WebSEAL instance, the hostname, and listening port, which by default is 7234.

After completing these steps, you will have created a trusted link from WebSEAL to the Web server.

What happens when the WebSEAL proxy session expires because of a timeout or the maximum number of sessions is exceeded?

In the scenario described later in this article, you configure a WebSEAL junction and TAI.

The role of WebSEAL in the overall solution will be explained in more details in future articles.

In that case, there is then only one (presumably closely guarded secret) valid password sent from WebSEAL.

In that case, there is then only one (presumably closely guarded secret) valid password that can be sent from WebSEAL.

WebSEAL will receive a URL request from the client and, based on the junction configuration, will issue a request to the server.

If you are using TCP, instead of SSL for your WebSEAL junction, skip this step and proceed to Step 5.

is the protocol of the WebSEAL machine (http or https).

Traffic is routed to the appropriate WebSEAL instance based on the HTTP header in the incoming request.

If the request has a basic access header (that is: HTTP: Authorization), it forwards the request to the basic access enabled WebSEAL.

After you add data to the file, use the jmt load command to "load" the data so that WebSEAL has knowledge of the new information.

When you set mutualSSL=true, the TAI validates the WebSEAL host using the hostname property, and does no further validation.

Next, configure a WebSEAL junction from the WebSEAL Server to the Web server.

You have completed importing the HTTP Server Certificate into the Key database of WebSEAL.

This is the keyring used by WebSEAL to store acceptable CA certificates for SSL junctions.

However, if there is URL content defined in the JavaScript, then you will need to enable script filtering in WebSEAL.

Stop and start the WebSEAL server.

In this step, you will import the WebSphere Portal users and groups into WebSEAL using the pdadmin utility.

We have a WebSeal server sitting in front of our back-end application servers.

This should give you the newly configured instance of WebSEAL.

When the login form has been submitted, WebSEAL and the user re-authenticated WebSEAL resubmit the request.

The simplest method to determine if there is an issue is to use WebSEAL statistics. Specifically, monitor the output of the pdweb. threads

Now you need to load the certificate you created in the last step into the key database of WebSEAL

In this case, the TAI will do no further validation of the WebSEAL server. This configuration is set in TAI using

Step 4. Load the certificate into the WebSEAL key store

Step 7. Configure WebSEAL junction to HTTP Server