IBM WebSphere V5.0 Security - CGISecurity

User Registry
Client
1. Request
2. Auth. Challenge
3. Challenge
Response
BA Header:
c_user:c_pwd
WebSEAL
c_user
c_pwd
4. Authenticate
5: Request
BA Header:
tai_user:tai_pwd
iv_user: c_user
iv_groups: c_groups
iv_creds: c_creds
6. Authenticate
TAI
tai_user
tai_pwd
WebSphere
Application Server
8: Response
7: Response
user:
c_user
Figure 12-7 TAI Information Flow
1. An unauthenticated client issues a request for a secure resource which is
intercepted by the reverse proxy (WebSEAL).
2. WebSEAL issues an HTTP authentication challenge to the client. Note that
WebSEAL could be configured to provide a login form instead, but the overall
flow of information would remain the same.
3. The client responds to the authentication challenge with a new request
containing the client’s userid (c_user) and password (c_pwd) in the HTTP
Basic Authenticaion (BA) Header.
4. WebSEAL authenticates the user against the user registry using c_user and
c_pwd.
5. WebSEAL modifies the BA Header so that the userid (tai_user) and password
(tai_pwd) are those expected by the Trust Association Interceptor. It attaches
the client’s userid and, optionally, group membership and credentials into an
additional HTTP headers (iv_user, iv_groups, and iv_creds) that are sent
along with the request to WebSphere.
6. WebSphere’s Trust Association Interceptor authenticates the userid and
password contained in the BA header(tai_user:tai_pwd) in order to establish
trust, and then extracts the client’s identity (c_user) from the iv_user header.
WebSphere then handles the request as comming from c_user.
7. WebSphere sends output to WebSEAL.
8. WebSEAL sends the output to the client.
392 IBM WebSphere V5.0 Security Handbook