IBM WebSphere V5.0 Security - CGISecurity

server. For example, if the client uses SSL client authentication to
authenticate to the sending server, then the identity token to the downstream
server will contain the certificate chain. This is important because it allows the
receiving server to perform it's own mapping of the certificate chain. It
enables more interoperability with other vendors and platforms.
4. Once the identity format is understood and parsed, the identity is simply
mapped to a credential. All identity token types map to the user ID field of the
active user registry. This is done by mapping Distinguished Name to
Distinguished Name and using filters to allow administrators to control the
mapping.
5. Some user registry methods are called to gather additional credential
information used by authorization. In a stateful server, this is done one time
for the sending server/receiving server pair where the identity tokens are the
same. Subsequent requests will be made via a session ID.
Note: Identity Assertion is only available using the CSIv2 protocol.
6.4.1 Scenarios
The following sections will describe five different cases where identity assertion
is utilized to propagate credentials to downstream servers.
The servers are running individual WebSphere Application Servers; they are not
organized in a cell. For more information on cell configuration and Network
Deployment, refer to 10.15, “Cell Security” on page 337.
Sample application for the scenarios
A testing application is also distributed with this book, besides the ITSOBank
sample application. It is the Identity Assertion sample application made for
testing purposes for the following scenarios (Scenario 1, 2, 3 and 4).
The application is very simple, it consists three modules:
► A J2EE client
► An EJB module for the front-end server
► An EJB module for the back-end server
The application does the following:
1. The client sends a message to the front-end server.
2. On the front-end server, the PassThrough session EJB captures the
message, then passes the message to the back-end server.
108 IBM WebSphere V5.0 Security Handbook