IBM WebSphere V5.0 Security - CGISecurity

J2EE Connector architecture establishes contracts amongst the application, the
resource adapter and the application server, where the application will eventually
be deployed. These contracts imply that all the participating components are
J2EE Connector architecture compliant for the sake of working together. The
application contract is nothing more than the definition for the communication
between connector and the application.
The system contract defines the connection management, transaction
management and the security management.
Application
Application
Contract
Connector
or Resource
Adapter
EIS-specific
interface
Enterprise
Information
System (EIS)
Container
contract
System contract
-Connection
management
-Transaction
management
-Security management
Application Server
Connection
Manager
Transaction
Manager
Security
Manager
Figure 7-27 J2EE Connector architecture
The security contract enables the application server to connect to an Enterprise
Information System using security properties. The application server
authenticates with the EIS system by using the security properties the user
credentials.
There are two different methods the application server can authenticate to an
Enterprise Information System.
► Container-managed sign-on: the security properties are configured when
the resource adapter is deployed on the application server. Again there are
several ways to configure security properties here. With Configured Identity
all resource adapter connections use the same identity when connecting to
the Enterprise Information System. With Principal Mapping the principal
used when connecting to the Enterprise Information System based on a
combination of the current principal in the application server and the mapping.
With Caller Impersonation the principal used in the Enterprise Information
170 IBM WebSphere V5.0 Security Handbook