IBM WebSphere V5.0 Security - CGISecurity

Available functionsActiveXclientAppletclientJ2EEclientPluggable clientThinclientEnables initialization ofclient app’s runtimeenvironmentSupportsauthentication to localresourcesRequires app isdistributed to clientmachineNo No Yes No NoNo No Yes No NoNo No Yes Yes YesThis chapter will concentrate on securing the J2EE application client and thinapplication client.6.2 CSIv2 and SASThe Common Secure Interoperability (CSI) security specification is defined bythe OMG (see http://www.omg.org). Currently in its second version, thespecification defines the Security Attribute Service (SAS) protocol to address therequirements of CORBA security for interoperable authentication, delegation andprivileges. The SAS protocol is designed to exchange its protocol elements in theservice context of GIOP request and reply messages that are communicatedover a connection-based transport. The protocol is intended to be used inenvironments where transport layer security, such as that available via SecureSockets Layer (SSL)/ Transport Layer Security (TLS) or Secure InterORBProtocol (SECIOP), is used to provide message protection (that is, integrity andor confidentiality) and server-to-client authentication. The protocol provides clientauthentication, delegation, and privilege functionality that may be applied toovercome corresponding deficiencies in an underlying transport. The SASprotocol facilitates interoperability by serving as the higher-level protocol underwhich secure transports may be unified.The SAS protocol is divided into two layers:► The authentication layer is used to perform client authentication wheresufficient authentication could not be accomplished in the transport.► The attribute layer may be used by a client to deliver security attributes, suchas identity and privilege, to a target where they may be applied in accesscontrol decisions.100 IBM WebSphere V5.0 Security Handbook