Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Authenticate users > Single sign-on for authentication
Global single sign-on principal mapping for authentication
We can use the JACC provider for Tivoli Access Manager to manage authentication to enterprise information systems (EIS) such as databases, transaction processing systems, and message queue systems that are located within the WAS security domain. Such authentication is achieved using the global single sign-on (GSO) principal mapper JAAS login module for Java EE Connector Architecture resources.
With GSO principal mapping, a special-purpose JAAS login module inserts a credential into the subject header. This credential is used by the resource adapter to authenticate to the EIS. The JAAS login module used is configured on a per-connection factory basis. The default principal mapping module retrieves the user name and password information from XML configuration files. The JACC provider for Tivoli Access Manager bypasses the credential stored in the XML configuration files and uses the Tivoli Access Manager global sign-on (GSO) database instead to provide the authentication information for the EIS security domain.
WAS provides a default principal mapping module that associates user credential information with EIS resources. The default mapping module is defined in the console on the Application login panel.
To access the panel, click Security > Global security. Under JAAS, click Application logins. The mapping module name is DefaultPrincipalMapping.
The EIS security domain user ID and password are defined under each connection factory by an authDataAlias attribute. The authDataAlias attribute does not contain the user name and password; this attribute contains an alias that refers to a user name and password pair that is defined elsewhere.
The Tivoli Access Manager principal mapping module uses the authDataAlias attribute to determine the GSO resource name and the user name that is required to perform the lookup on the Tivoli Access Manager GSO database. The Tivoli Access Manager Policy Server retrieves the GSO data from the user registry.
Tivoli Access Manager stores authentication information on the Tivoli Access Manager GSO database against a resource and user name pair.
GSO principal mapping architecture
Single sign-on for authentication using LTPA cookies
Configure global sign-on principal mapping