IBM WebSphere V5.0 Security - CGISecurity

4. Fill out the fields according to the following screen capture.
Figure 4-5 New role for the Web module
5. Click OK.
6. Repeat the steps above to create all the necessary roles for the Web module.
7. Save the .ear file.
Defining security constraints
Providing an authentication mechanism for global application security does not
provide the mechanisms to control access to the Web resources.
Security constraints declare how the content of the application is protected. For a
given security constraint, three things should be defined:
►
►
►
One or more Web resources that define actual application components that
are to be protected by the security constraint. Web resource is a set of URL
patterns and HTTP methods in those resources. All requests that will be
matched with the pattern defined for a given Web resource will be subject to a
security constraint.
An authorization constraint that defines roles which will be provided access to
the Web resources existing within the security constraint. An authorization
constraint is a set of roles that the user must be granted in order to have
access to a Web resource collection existing within a security constraint. In
order to have access to the Web resource, the user should be granted at least
one of the roles that are defined within the Authorization constraint.
Used Data Constraint indicates the transport layer setting for client/server
communication in order to satisfy given security constraint. This setting
should guarantee either content integrity (preventing tampering in transit) or
confidentiality (preventing reading data during transfer). User Data Constraint
may override standard security settings for the application. For example,
access to some functions of the application may require just basic login using
a user ID and password, and at the same time some functions may require a
Chapter 4. Securing Web components 49