IBM WebSphere V5.0 Security - CGISecurity

Note: Without initializing the ORB, JAAS will not be able to perform the login.
The application will perform the authentication challenge as it is set in the SAS
client configuration file; it is the GUI login panel by default.
This sample application uses a callback handler called:
ITSOBankCallbackHandler implementing the CallbackHandler interface. It is a
simple implementation collecting the login information from a character-based
console. It is only provided to show how to implement a callback handler and use
it with JAAS. For more information about the handler, see the comments in the
source for ThinAccountViewer, at the end of the file.
Running the client-side login sample
To test the client-side login scenario, launch the ITSOBank thin Java client
application from the command line. The client is provided together with the
ITSOBank sample application as a separate package.
Before running the sample, you should change the server parameters in the
sas.login.props file, under the Properties folder of the Java thin application client
directory. Change the com.ibm.CORBA.securityServerHost and the
com.ibm.CORBA.securityServerPort entries to reflect your environment (the
default port number is 2809).
The following example launches the client using the character-based console to
collect login information:
runclient appsrv01 2809 login
The application will collect the login information: user name, password and realm
on the character-based console; for example: manager01, password,
dirsrv:389.
After a successful authentication the client application GUI comes up; there you
can collect balance information for customers and branches.
8.7.3 Server-side login with JAAS
Server-side login is used when the application has to log the users into the
security domain by providing authentication data and login information on the
server side. In these situations, a server-side component, for example: servlet,
EJB, performs authentication for the application.
For authentication purposes, the Java Authenticaiton and Authorization Services
(JAAS) is used on the server-side. Similar to the client-side login, the login is
performed programmatically coded in the component. The user details can be
collected in any format and have to be presented through the login context during
212 IBM WebSphere V5.0 Security Handbook