IBM WebSphere V5.0 Security - CGISecurity

also ask for a X.509 certificate file, although the response can be empty (just
press Enter). In this case, the certificate check will not be made. For details on
creating a digital certificate, refer to 10.9.1, “Generating a self-signed certificate”
on page 264.
8.4 Custom Trust Association Interceptor
The application server can be configured to use a third-party product to provide
authentication services, while continuing to perform authorisation. These
products are often referred to as reverse proxy servers. To delegate the role of
authentication to a reverse proxy, two conditions must be met.
►
►
The reverse proxy must provide a Trust Association Interceptor, which
WebSphere will use to receive requests from the reverse proxy server.
A trust association between WebSphere and the reverse proxy must be
established.
In order to provide an interceptor, the
com.ibm.websphere.security.TrustAssociationInterceptor interface, which
defines three methods, must be implemented.
►
►
►
public boolean isTargetInterceptor(HttpServletRequest) throws
com.ibm.websphere.security.WebTrustAssociationException
Determines whether the request originated with the proxy server associated
with the interceptor. The implementation code must examine the incoming
request object and determine if the proxy server forwarding the request is a
valid proxy server for this interceptor.
public void validateEstablishedTrust(HttpServletRequest) throws
com.ibm.websphere.security.WebTrustAssociationFailedException
Determines whether or not the proxy server from which the request originated
is trusted. This method is called after the isTargetInterceptor method. The
implementation code must authenticate the proxy server. The authentication
mechanism is proxy-server-specific.
public String getAuthenticatedUsername(HttpServletRequest) throws
com.ibm.websphere.security.WebTrustAssociationUserException
The application server has accepted the proxy server's authentication of the
request and must now authorise the request. This method extracts the
request’s user name from the HTTP header to allow for authorisation.
190 IBM WebSphere V5.0 Security Handbook