Definition
Tivoli Access Manager provides authentication, authorization, and management services for a network. In a Web-based network, these services are best provided by one or more front-end WebSEAL servers that integrate and protect Web resources and applications located on back-end Web servers.
The connection between a WebSEAL server and a back-end Web application server is known as a WebSEAL junction. A WebSEAL junction is a TCP/IP connection between a front-end WebSEAL server and a back-end server.
The back-end server can be another WebSEAL server or, more commonly, a third-party Web application server. The back-end server Web space is "connected" to the WebSEAL server at a specially designated junction (mount) point in the WebSEAL Web space.
For more info see article this came from: 
http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1359-00/en_US/HTML/am51_webseal_guide16.htm#i1032080
Creating junctions
To create WebSEAL junctions, you use the pdadmin server task create command:
pdadmin> server task server_name-host_name create options
For example, if the configured name of a single WebSEAL server is default , the server_name is default-webseald followed by -host_name. For example, the server name would be:
default-webseald-cruz.dallas.ibm.com
If you install multiple WebSEAL server instances on the same machine, the Access-Manager-server is the configured name of the WebSEAL server instance, followed by webseald, followed by the host name:
instance_name-webseald-host-name
For example, if the configured names for two additional WebSEAL instances are webseal2 and webseal3, the server identifications appear as:
webseal2-webseald-cruz
webseal3-webseald-cruz
Use the server list command to verify server identification:
pdadmin> server list
default-webseald-cruz
webseal2-webseald-cruz
webseal3-webseald-cruz
