IBM WebSphere V5.0 Security - CGISecurity

LTPA requires that the configured User Registry be a central shared
repository such as LDAP or a Windows Domain type registry.
The following table summarizes the Authentication Mechanism capabilities and
user registries used with LTPA.
Table 9-1 Authentication mechanisms
AuthC
mech.
Forwardable
user
credentials
SSO
Local OS
user registry
LDAP user
registry
Custom user
registry
SWAM no no yes yes yes
LTPA yes yes yes yes no
Future versions of WebSphere will support the Kerberos authentication
mechanism to provide a broader selection and an industry standard mechanism
for authentication.
Authorization mechanisms
WebSphere Application Server standard authorization mechanisms are based
on the J2EE security specification and Java Authentication and Authorization
Services. JAAS extends the security architecture of the Java 2 Platform with
additional support to authenticate and enforce access controls upon users.
JAAS programming models allows the developer to design application
authentication in a pluggable fashion, which makes the application independent
from the underlying authentication technology.
Java 2 security architecture uses security policy to specify who is allowed to
execute a code of the application. Code characteristics, like a code signature,
signer ID, or source server, decide whether the code will be granted access to be
executed or not. JAAS extends this approach with role-based access control.
Permission to execute a code is granted not only based on the code
characteristics but also on the user, who is running it.
For each authenticated user, a Subject class is created and a set of Principals is
included in the subject in order to identify that user. Security policies are granted
based on possessed principals.
Other security components
The following list will show you other security components within WebSphere
Application Server V5.
226 IBM WebSphere V5.0 Security Handbook