Enabling single sign-on for Tivoli Access Manager

com.ibm.websphere.security.disableGetTokenFromMBean=false

For more information about using the pdadmin command line utility, refer to Server task commands for junctions in the Security Access Manager knowledge center.

acl create lc3-default-acl

acl modify lc3-default-acl set user sec_master TcmdbsvaBRlrx

acl modify lc3-default-acl set any-other Tmdrx

acl modify lc3-default-acl set unauthenticated T

acl modify lc3-default-acl set group iv-admin TcmdbsvaBRrxl

acl modify lc3-default-acl set group webseal-servers Tgmdbsrxl

1. Navigate to SSL certificate and key management > Key stores and certificates > CellDefaultTrustStore> \ signer certs.
2. Restart the Homepage application.

1. To add properties, the administrator needs to edit the fncs-sitePrefs.properties file, located in the FNCS installation directory, before running the configuration wizard.
   Note: For FNCS 2.0.3, the fncs-sitePrefs.properties file is located in <FNCS_HOME>/configure/explodedformat/fncs/WEB-INF/classes/. <FNCS_HOME> is the FNCS installation directory.
2. Add the following properties to the fncs-sitePrefs.properties file at the end of the file after the comments and save it:

   fncsServerURL=http://your http url for the TAM and WebSeal proxy
   fncsServerURLSecure=https://your https url for the TAM and WebSeal proxy
   icUrl=https://your https url for the TAM and WebSeal proxy 

   For example:

   fncsServerURL=http://webseald.your_domain.com
   fncsServerURLSecure=https://webseald.your_domain.com
   icUrl=https://webseald.your_domain.com

3. After setting the properties, you must complete the steps in Configuring FileNet Collaboration Services for the Connections Content Manager.

forms-auth = https

ba-auth = none

[filter-content-types]

type = text/xml

type = application/atom+xml

[script-filtering]

script-filter = yes

rewrite-absolute-with-absolute = yes

Add the following lines:

decode-query = yes

utf8-qstring-support-enabled = yes

Add the following line to the [server] stanza:

web-host-name = fully-qualified-host-name

Add the following line to the [session] stanza:

use-same-session = yes

Block TRACE HTTP method by setting or modifying the following entries:

http-method-disabled-local = TRACE

http-method-disabled-remote = TRACE

Stop and restart your WebSEAL instance.

• AIX: /usr/IBM/HTTPServer/conf
• Linux: /opt/IBM/HTTPServer/conf
• Windows: C:\IBM\HTTPServer\conf

To capture requests to /ibm_security_logout and redirect them to /pkmslogout, add the following rewrite rules to the httpd.conf file:

RewriteEngine On

RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*)

RewriteRule ^/(.*) /pkmslogout [noescape,L,R]

Ensure that the line that enables mod_rewrite is not commented out by removing the preceding # symbol. For example:

LoadModule rewrite_module modules/mod_rewrite.so

The following example illustrates a typical portion of the httpd.conf file after you have implemented the steps described in this step:

RewriteEngine On

RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*)

RewriteRule ^/(.*) /pkmslogout [noescape,L,R]

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

<IfModule mod_ibm_ssl.c>

Listen 0.0.0.0:443

<VirtualHost *:443>

ServerName connections.example.com

SSLEnable

RewriteEngine On

RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*)

RewriteRule ^/(.*) /pkmslogout [noescape,L,R]

</VirtualHost>

</IfModule>

SSLDisable

Use the following example as a guide:

# Maximum lifetime (in seconds) for an entry in the credential cache

# Setting this to zero allows entries in the cache to fill without expiry until the

# cache contains the number of entries specified by max-entries. After that

# point, entries are expired according to a least recently used algorithm.

timeout = 3600

# Lifetime (in seconds) of inactive entries in the credential cache.

# To disable, set to 0.

inactive-timeout = 600