Good info: 
WebSeal_Doco_1 | WebSeal_Doco_2
| IBM_Admin_Guides
From IBM doco:
IBM Tivoli Access Manager WebSEAL is the resource manager responsible for managing and protecting Web-based information and resources. WebSEAL is a high performance, multi-threaded Web server that applies fine-grained security policy to the Tivoli Access Manager protected Web object space. WebSEAL can provide single sign-on solutions and incorporate back-end Web application server resources into its security policy.
WebSEAL normally acts as a reverse Web proxy by receiving HTTP/HTTPS requests from a Web browser and delivering content from its own Web server or from junctioned back-end Web application servers. Requests passing through WebSEAL are evaluated by the Tivoli Access Manager authorization service to determine whether the user is authorized to access the requested resource. WebSEAL provides the following features:
- Supports multiple authentication methods: Both built-in and plug-in architectures allow flexibility in supporting a variety of authentication mechanisms.
- Accepts HTTP and HTTPS requests
- Integrates and protects back-end server resources through WebSEAL junction technology
- Manages fine-grained access control for the local and back-end server Web space. Supported resources include URLs, URL-based regular expressions, CGI programs, HTML files, Java servlets, and Java class files.
- Performs as a reverse Web proxy: WebSEAL appears as a Web server to clients and appears as a Web browser to the junctioned back-end servers it is protecting.
- Provides single sign-on capabilities
Marcos
Webseal uses macros substitution to allow pages through javascript to customise their output (for errors etc.). These macros dynamically substitute appropriate information that is available.
eg. %ERROR_CODE% marco is substitued with the error code (or "").
<script language="JavaScript" type="text/javascript">
//get any webseal error_code through the marco
var errorCode = new String("%ERROR_CODE%");
</script> (look under "Access Manager For E-Business")
See WebSEAL Junctions wiki page for more info on this.
Conceptually similar in principle to what Oracle AS 10G Web Cache provides
in terms of forwarding to backend servers, rules, high-avail etc
File locations :
$WEBSEAL_HOME=/opt/pdweb
config file: $WEBSEAL_HOME/etc/webseald-default.conf
Following are defined in the config file, but generally:
javascript: $WEBSEAL_HOME/www-default/docs/js
html pages: $WEBSEAL_HOME/www-default/lib/html/C
errors pages: $WEBSEAL_HOME/www-default/lib/errors/C
