IBM WebSphere V5.0 Security - CGISecurity

Outside World
Demilitarized Zone
(DMZ)
Internal Network
Public Key
Infrastructure
Directory &
Security
Server
Registry
data
IP Network
Protocol firewall
Security
Proxy
Domain firewall
Application
Servers
Client
Existing
application
and data
Client
Tier
Single
Sign-On
Application 1
Application 2
Figure 11-5 Web Single Sign-On (heterogeneous applicaiton servers) runtime pattern
Another decision that was made was to use credential propagation from the
Web-tier down to the business logic tier and back-end applications. This will
enable non-repudiation of back-end transactions initiated by Web users. We can
achieve this by using the same security server to manage the Web tier and
business logic and back-end applications. No credential mapping or
transformation is required; this might be an option if separate security
mechanisms were used in different application tiers. The security context is
presented all the way from the Web down to the back-end resources.
This approach significantly simplifies users’ and policy management by unifying
the user profile across the entire business process supported by the Web
application. It doeas requires some complex configurations and usage of security
servers that are supported by the chosen application servers.
Chapter 11. Security in Patterns for e-business 359