IBM WebSphere V5.0 Security - CGISecurity

The attribute layer also provides the means for a client to assert identity
attributes that differ from the client’s authentication identity (as established in the
transport or SAS authentication layers). This identity assertion capability is the
basis of a general-purpose impersonation mechanism that makes it possible for
an intermediate to act on behalf of some identity other than itself. This can
improve the performance of a system since the authentication of a client is
relatively expensive. The server can validate the request by checking its trust
rules.
In order to invoke an EJB method that has been secured, a protocol is required
to determine the level of security and type of authentication to be agreed upon by
the client and server. During the method invocation, the protocol must coalesce
the server’s authentication requirements, which is determined by the object’s
IOR, with the client’s authentication requirements, which is determined by the
client’s configuration and select the appropriate policy.
The Application Server can be configured to support both CSIv2 and IBM’s
Secure Association Service (SAS). In fact, both protocols can be supported
simultaneously; that is to say the Application Server may receive a request using
one protocol and then receive another request using the other protocol. IBM’s
SAS is the protocol used in previous versions of the Application Server and
although deprecated, is provided in version five for interoperability with older
clients and servers. CSIv2, which is the focus of this chapter, allows vendors to
securely interoperate and provides a greater number of features over SAS.
CSIv2 and SAS are add-on IIOP services, where IIOP is the communications
protocol used to send messages between two ORBs. In preparation for a request
to flow from client to server, a connection between the two ORBs must be
established over TCP/IP. The client ORB will invoke the authentication protocol’s
client connection interceptor which is used to read the tagged components in the
IOR of the server-based object being requested. This is how the authentication
policy is established. Once the policy has been established, the ORB will make
the connection, with the optional addition of the SSL cipher.
The client ORB invokes the client request interceptor once the connection has
been established and sends security information other than what was
established by the transport. This may include a user ID and password token,
which is authenticated by the server, an authentication mechanism-specific
token, which is validated by the server or an identity assertion token, which
allows an intermediate to act on behalf of some identity other than itself. This
additional security information is sent with the message in a GIOP service
context.
Chapter 6. Securing Java clients 101