IBM WebSphere V5.0 Security - CGISecurity

8.6.1 Implementing security with JAAS
This section will explain how JAAS is generally used to implement security in
Java.
Note: JAAS does not require Java 2 security to be enabled. JAAS can be
configured and used without Java 2 security.
Secured application
Concerning security, here we will investigate how it works within an application.
The secured application has two parts:
►
►
The main application that handles the login procedure and runs the secured
code under the authenticated subject.
The action that is invoked from the main application under a specific subject.
Supporting Components
The following objects are required for a secured application using JAAS:
►
►
Principal that is part of a Subject.
First of all, the Subject has to be explained. In JAAS the Subject is some
identity. This identity will be authenticated and permissions will be assigned to
it.
A Subject can have a relationship with several different authorities. In JAAS,
these multiple interactions with authorities are represented by objects that are
implementing the java.security.Principal interface. The principal objects are
listed under a subject.
A callback handler that implements the CallbackHandler interface. This class
is a client provided set of interfaces for entering authentication information.
These interfaces decouple the service provider from the particular input
devices being used.
Definition: callback
Developers conversant in the event-driven programming model of
Microsoft Windows and X Window are accustomed to passing function
pointers that are invoked when something happens. The invocation part of
the process is the “callback”. However, Java does not support method
pointers; Java interfaces provide a solution to implement callbacks.
Chapter 8. Programmatic security 205