Specifying the WebSEAL host name

Edit online

Typically, the name of the WebSEAL host computer is automatically determined when this information is required. There are situations, such as with virtual host junctions, where the WebSEAL host can use several names. On systems with many host names, interfaces, or WebSEAL instances, the automatic determination might not be correct for a specific situation. You can specify the correct one.

Before you begin

You must understand the WebSEAL server name in the following situations.

In the configuration file
The name uniquely identifies a WebSEAL server process. You can install and configure multiple WebSEAL servers on one computer system. Therefore, each WebSEAL server process must have a unique name. Each WebSEAL server process is known as an instance.
Each WebSEAL instance has its own configuration file. The server-name stanza entry in the [server] stanza of the configuration file for each WebSEAL instance specifies the unique name for that WebSEAL instance.
The server-name stanza entry is a combination of the host name of the physical computer where WebSEAL is installed and the WebSEAL instance name. Both names are specified during WebSEAL configuration.
[server]
server-name = host_name-instance_name
A computer host name always has a fully qualified name, for example, abc.ibm.com). It also can have a short name, for example, abc. When prompted for the host name during WebSEAL configuration, you can specify either the fully qualified name or the short name. In the following example, the WebSEAL instance name web1 is on a computer with a fully qualified host name of abc.ibm.com, as specified during WebSEAL configuration.
[server]
server-name = abc.ibm.com-web1
The initial WebSEAL server is automatically assigned an instance name of default, unless you modify this name during WebSEAL configuration. For example:
[server]
server-name = abc.ibm.com-default
In the pdadmin server list command
The instance name also affects how the WebSEAL server is listed with the pdadmin server list command. Because the pdadmin command serves the entire Verify Identity Access family, a product component name is required in the command syntax. The component name for WebSEAL is webseald. For the pdadmin server list command, the WebSEAL server name has the following format.
instance_name-webseald-host_name
The following example shows the output from pdadmin server list for the instance web1 installed on the host abc.ibm.com:
web1-webseald-abc.ibm.com
The following pdadmin server list command output displays an initial default WebSEAL server and a second WebSEAL instance named web1:
pdadmin> server list
web1-webseald-abc.ibm.com
default-webseald-abc.ibm.com
In the protected object space
Each WebSEAL instance is represented as a member of the /WebSEAL container object in the protected object space. Two WebSEAL instances (default and web1), on the host abc.ibm.com, appear in the protected object space in the following format:
/WebSEAL/abc.ibm.com-web1
/WebSEAL/abc.ibm.com-default

About this task

You can manually specify the host name in the web-host-name stanza entry in the [server] stanza of the WebSEAL configuration file. The value must be the fully qualified name. This manual setting resolves any conflicts in determining the host name that is used, for example, by WebSEAL HTTP/HTTPS responses and authentication mechanisms in a traditional junction environment.

By default, web-host-name is not enabled and has no value. When required, WebSEAL attempts to automatically determine the host name.

Procedure

  1. Stop the WebSEAL server process.
  2. Manually edit the WebSEAL configuration file to provide a value for the stanza entry.
  3. Uncomment the line.
  4. Restart WebSEAL.

Example

[server]
web-host-name = abc.ibm.com
Notice the difference in syntax between the server-name and the web-host-name values. For example:
[server]
server-name = abc.ibm.com-default
web-host-name = abc.ibm.com