IBM WebSphere V5.0 Security - CGISecurity

WebSEAL
Authenticated Users
before forwarding
requests for protected
resources
WebSphere Application Server
Container integrated
with Access Manager
J2EE Application
Deployment
Descriptor
Access Manager's
LDAP User Registry
Access Manager
Authorization Server
Access Manager's
Policy Server
Figure 12-24 Access Manager for WebSphere beta Model
When a user requests a protected resource, WebSEAL authenticates the user
against the Access Manager user registry. Junction configuration defines the
type and number of credentials then forwarded to the application server.
The container examines the request for access to a protected resource and from
the J2EE application deployment descriptor, determines the required role that the
user must have to be granted authorization. The container then hands off to the
integrated Access Manager module.
The Access Manager module requests an authorization decision from an
Access Manager authorization server which checks with its local replica of the
Access Manager policy database. Replicas are normally updated on a pull basis
from the single Access Manager Policy Master within the Security Domain.
While these calls can be made to a remote server, without the embedded Access
Manager promised for the final WebSphere Application Server V5, performance
and scalability require that an Access Manager Authorization Server be installed
on the same platform as WebSphere. Of course, this means that the
performance burden is passed to the platform hardware which must be capable
of bearing both loads.
Having returned the access decision, granted or denied, to the container,
WebSphere then acts on it.
432 IBM WebSphere V5.0 Security Handbook