IBM WebSphere V5.0 Security - CGISecurity

8.7.1 JAAS in WebSphere
In the previous version of WebSphere Application Server V4.0, other
mechanisms were used to perform programmatic login. There was a distinction
between server-side and client-side programmatic login. One was using the
LoginHelper class together with CORBA authentication methods, while the other
was utilizing the ServerSideAuthenticator class. In WebSphere V5.0 these
classes, together with the mechanism, are deprecated; use the JAAS
programmatic login instead.
With JAAS the client-side and server-side login work in the same way, but the
challenge for authentication works a bit differently. On the client-side, any
challenge mechanism can be used that is compatible with the client’s runtime
environment; while on the server side there is no place to pull up an
authentication challenge window or provide a command line prompt for
username and password. On the server-side, credentials have to be collected in
the code, then provided to the JAAS login facility.
8.7.2 Client-side login with JAAS
Client-side login is useful when the user needs to log in to the security domain on
a remote system using the client application. In this case, the client application
has to collect the login information for authentication purposes. WebSphere
provides built-in mechanisms to collect the necessary information: user name,
password, realm.
There are two scenarios in this client-side login section, one is an example for
J2EE Java applications, and the other is for thin Java applications. For more
information about Java client security, refer to Chapter 6, “Securing Java clients”
on page 97.
J2EE Java application
The following code snippet shows how to perform various types of login using
character-based console (stdin), graphical user interface, and direct login without
a login prompt.
Example 8-7 Client side login in the ITSOBank J2EE client
...
private static void loginClient() {
LoginContext lc = null;
try {
// using the console (stdin) to collect the login information
if(logintype.equals("stdin")) {
System.out.println("Performing stdin login...");
Chapter 8. Programmatic security 209