IBM WebSphere V5.0 Security - CGISecurity

Available functions
ActiveX
client
Applet
client
J2EE
client
Pluggabl
e client
Thin
client
Enables initialization of
client app’s runtime
environment
Supports
authentication to local
resources
Requires app is
distributed to client
machine
No No Yes No No
No No Yes No No
No No Yes Yes Yes
This chapter will concentrate on securing the J2EE application client and thin
application client.
6.2 CSIv2 and SAS
The Common Secure Interoperability (CSI) security specification is defined by
the OMG (see http://www.omg.org). Currently in its second version, the
specification defines the Security Attribute Service (SAS) protocol to address the
requirements of CORBA security for interoperable authentication, delegation and
privileges. The SAS protocol is designed to exchange its protocol elements in the
service context of GIOP request and reply messages that are communicated
over a connection-based transport. The protocol is intended to be used in
environments where transport layer security, such as that available via Secure
Sockets Layer (SSL)/ Transport Layer Security (TLS) or Secure InterORB
Protocol (SECIOP), is used to provide message protection (that is, integrity and
or confidentiality) and server-to-client authentication. The protocol provides client
authentication, delegation, and privilege functionality that may be applied to
overcome corresponding deficiencies in an underlying transport. The SAS
protocol facilitates interoperability by serving as the higher-level protocol under
which secure transports may be unified.
The SAS protocol is divided into two layers:
► The authentication layer is used to perform client authentication where
sufficient authentication could not be accomplished in the transport.
► The attribute layer may be used by a client to deliver security attributes, such
as identity and privilege, to a target where they may be applied in access
control decisions.
100 IBM WebSphere V5.0 Security Handbook