IBM WebSphere V5.0 Security - CGISecurity

Message channels and MQ channels can use the SSL protocol to provide link
level security. A caller MCA is an SSL client and a responder MCA is an SSL
server. You can specify the cryptographic algorithms that are used by the SSL
protocol as part of the channel definition.
At each end of a message channel, and at the server end of an MQ channel, the
MCA acts on behalf of the queue manager to which it is concerned. During the
SSL handshake, the MCA sends the digital certificate of the queue manager to
its partner MCA at the other end of the channel. The MCA at the client end of an
MQI channel acts on behalf of the user of the WebSphere MQ client application.
During the SSL handshake, the MCA sends the user’s digital certificate to its
partner MCA at the server end of the MQ channel.
Digital certificates are stored in a key repository. The queue manager attribute
SSLKeyRepository specifies the location of the key repository that holds the
queue manager’s digital certificate. On a WebSphere MQ client system, the
MQSSLKEYR environment variable specifies the location of the key repository
that holds the user’s digital certificate. Alternatively, a WebSphere MQ client
application can specify its location in the KeyRepository field of the SSL
configuration options structure, MQSCO, for an MQCONNX call.
To create your own certificates for the SSL communication, use IBM’s ikeyman
tool.
7.3 J2C security
This section briefly describes the J2EE Connector Architecture in WebSphere
Application Server V5 and the security considerations related to connectors.
When using connectors, the application requests data from the connector and
the connector gets the data from the resource and returns it to the application.
But Enterprise Information Systems are generally very important applications
and are protected from unauthorized access. So authentication information must
be passed while requesting a connection.
7.3.1 Securing adapters
Connectors in WebSphere let you connect to resources such as data or an
application on a remote server. These resources are called an “Enterprise
Information System” (EIS). Typically, a connector accesses non-relational data
and is used by developers to developers to complement the other means of
accessing Relational DataBase Management Systems (RDBMS) data. Basically,
your application request reaches the connector, the connector talks to the EIS,
then returns the results back to the requestor application.
Chapter 7. Securing Enterprise Integration components 169