IBM WebSphere V5.0 Security - CGISecurity

6. Upon subsequent requests, only authorizations checks are performed either
by the Web collaborator or the EJB collaborator, depending on what the user
is requesting. User credentials are extracted from the established security
context.
Administrative tasks
The steps below illustrate how the administration tasks are executed.
1. Administrative tasks are issued using either the Web based Administrative
Console or the wsadmin scripting tool.
2. The administration client generates a request that reaches the server side
ORB and JMX MBeans; JMX MBeans represent managed resources and are
part of the management interface system for components. The default
communication protocol is SOAP. It can be changed either by giving a
parameter to the wsadmin program or modifying administration settings
through the Administrative Console.
3. JMX Beans contact the security server for authentication purposes. JAMX
beans have dedicated roles assigned and do not use user registry for
Authentication and Authorization.
Java Client communication
The steps below describe how a Java client interacts with a WebSphere
application.
1. Java clients generates a request that reaches the server side ORB. The
request may be gotten through the CSIv2 interceptor if the client’s request is
generated using CSIv2.
2. The server side ORB passes the request to the EJB container.
3. Authentication is performed by the ORB, before the client gets access to
protected resources.
4. After submitting a request to the access protected EJB method, the EJB
container passes the request to the EJB collaborator.
5. The EJB collaborator reads the deployment descriptor from the .ear file and
user credential from the security context.
6. Credentials and security information is passed to the security server which
validates user access rights and passes this information back to the
collaborator.
7. After receiving a response from the security server, the EJB collaborator
authorizes or denies access to the user to the requested resource.
For more detailed information about securing particular J2EE application
modules, please refer to the appropriate sections.
Chapter 9. WebSphere Application Server security 229