In WebSeal, we will need to create two junctions, one connecting to the backend web application that will be protected with two-factor authentication using DualShield, and the other connecting to your DualShield SSO server. As an example in this document, the backend web application to be protected is www.thesafebank.com and the junction we’ll create for the application is called “/thesafebank”. The DualShield SSO server used in the example is dualshield.deepnetsecurity.com and the junction we’ll create for the DualShield SSO server is called “/dualshield”.

Create Junctions

First, create a junction, “/thesafebank”, from the WebSEAL Servers for the protected backend web applications as shown in Listing 1.

Listing 1. Create a junction for the backend web application

# pdadmin -a sec_master -p password

pdadmin sec_master> server task default-webseald-Win2003-32-177 create -t tcp -h

www.thesafebank.com -p 80 -f /thesafebank

Note that default-webseald-Win2003-32-177 is the server name of the WebSeal.

Second, create a junction, “/dualshield”, from the WebSEAL server to the DualShield SSO server as shown in Listing 2.

Listing 2. Create an EAI junction for the DualShield SSO

# pdadmin -a sec_master -p password

pdadmin sec_master> server task default-webseald-Win2003-32-177 create -t tcp -h

dualshield.deepnetsecurity.com -p 8074 -c iv_user -f /dualshield     

Note the -c iv_user junction option. 

Last, the junction for the DualShield SSO server should not be in the protected domain, because unauthenticated users need to access these URLs. In Listing 3, it shows how to create the unauthenticated ACL for allowing unauthenticated access to the junction.

Listing 3. Create the ACL for the unauthenticated users 

pdadmin sec_master> acl create unauth

pdadmin sec_master> acl modify unauth set group iv-admin TcmdbsvaBRrxl

pdadmin sec_master> acl modify unauth set group webseal-servers Tgmdbsrxl

pdadmin sec_master> acl modify unauth set user sec_master TcmdbsvaBRrxl

pdadmin sec_master> acl modify unauth set any-other Trx

pdadmin sec_master> acl modify unauth set unauthenticated Trxc

Then, attach the above ACL to the DualShield junction as shown in Listing 4.

Listing 4. Attach the ACL to the junction for the DualShield SSO server

pdadmin sec_master> acl attach /WebSEAL/Win2003-32-177-default/dualshield unauth

Note that /WebSEAL/Win2003-32-177-default is the object name in the WebSeal server.

Modify Configuration File

Now, we are ready to start the last part of configuring the application the DualShield SSO server with WebSEAL. It is configured through the WebSEAL configuration file, webseald-default.conf. On the Windows OS platforms, this file is located in 

C:\Program Files\Tivoli\PDWeb\etc\webseald-default.conf 

First, enable the EAI authentication for HTTP and HTTPS sessions as shown in Listing 5.

Listing 5. Enable the EAI authentication

[eai]

eai-auth=both

Next, configure the authentication levels for step-up authentication. All levels of authentication will map to the EAI application:

Listing 6. Enable the EAI authentication

[authentication-levels]

level = unauthenticated

#level = password

level=ext-auth-interface

The next step is to specify the EAI authentication interface library in WebSEAL configuration file. Table 1 shows the EAI authentication module of different operating system.

Table 1. EAI authentication module

Operating SystemModule
Solaris™libeaiauthn.so
AIX®libeaiauthn.a
HPUXlibeaiauthn.sl
Linuxlibeaiauthn.so
Windows®eaiauthn.dll

As seen in Listing 7, this document chooses eaiauthn.dll as the authentication module because it uses WebSEAL on the Windows platform.

Listing 7. Configure the EAI authentication module

[authentication-mechanisms]

# EXTERNAL AUTHENTICATION INTERFACE

ext-auth-interface = C:\Program Files\Tivoli\PDWebRTE\bin\eaiauthn.dll

The next step is to configure the trigger URL so that WebSEAL knows if the URL from the browser is for EAI authentication. Set the trigger URL as shown in Listing 8.

Listing 8. Configure the trigger URL

[eai-trigger-urls]

trigger = /dualshield/appsso/defaultauthnresponsepage*

Where /dualshield is the name of the junction for the DualShield SSO server.

Edit Login File

The next step is to edit the WebSeal’s default login file, login.html. Table 2 shows the location of login.html in different operating system.

Table 2. login.html

Operating SystemModule
AIX®/opt/PDWeb/www-default/lib/html/C/
Linux/opt/PDWeb/www-default/lib/html/C/
Windows®

\Program Files\Tivoli\PDWeb\www-default\lib\html\C\

Open login.html file in a text editor. Look for the </BODY> tag near the end of the file, and add the following lines before it:

Listing 9. Login.html

%EAIAUTHN%

<script type="text/javascript" language="javascript">

if( ('%AUTHNLEVEL%' == '1') || ('%AUTHNLEVEL%' == '') )

window.location.href='/dualshield/appsso/login?authLevel=%AUTHNLEVEL%&pctx=/dualshield&dasapplicationname=webseal&entityID=WEBSEAL';

</script>

Note that /dualshield is the name of the EAI junction that you created for the DualShield SSO server in Listing 2, webseal is the name of the application that you created in your DualShield server in section [Create Application], and WEBSEAL is the EntityID of the Service Provider that you created in section [Service Provider]

Finally, restart the WebSEAL server in order to make the changes effective.

  • No labels