title: pass response from external authentication interface (EAI) through webseal to browser
body: <p>I have an application that wants to return a response back to the browser from the EAI.  In this case, the response is a dynamically created XML document.  WebSEAL seems to drop this response and return a 302.  I want both a security session cookie from webseal and the XML response returned in the EAI response to end up at the browser, preferably with an HTTP 200 response, but maybe other response codes.</p>
  
  <p>To elaborate:</p>
  
  <ol>
  <li>form-based authentication, posting userID, password, registered token value to trigger URL</li>
  <li>WebSEAL triggers and passes request to EAI</li>
  <li>EAI authenticates user ID and password, invokes webservice with user ID and registered token value</li>
  <li>web service returns XML in its response</li>
  <li>EAI sets authentication headers based on XML content and passes response onto WebSEAL</li>
  <li>WebSEAL catches authentication headers and creates security session and set cookie header for the credential</li>
  <li>WebSEAL responds with a 302 and removes the response body passed through the EAI from the web service</li>
  </ol>
  
  <p>Question: Can WebSEAL be configured to pass the response untouched other than adding the credential cookie so that the requester gets the credential and the XML message body?</p>