IBM WebSphere V5.0 Security - CGISecurity

The attribute layer also provides the means for a client to assert identityattributes that differ from the client’s authentication identity (as established in thetransport or SAS authentication layers). This identity assertion capability is thebasis of a general-purpose impersonation mechanism that makes it possible foran intermediate to act on behalf of some identity other than itself. This canimprove the performance of a system since the authentication of a client isrelatively expensive. The server can validate the request by checking its trustrules.In order to invoke an EJB method that has been secured, a protocol is requiredto determine the level of security and type of authentication to be agreed upon bythe client and server. During the method invocation, the protocol must coalescethe server’s authentication requirements, which is determined by the object’sIOR, with the client’s authentication requirements, which is determined by theclient’s configuration and select the appropriate policy.The Application Server can be configured to support both CSIv2 and IBM’sSecure Association Service (SAS). In fact, both protocols can be supportedsimultaneously; that is to say the Application Server may receive a request usingone protocol and then receive another request using the other protocol. IBM’sSAS is the protocol used in previous versions of the Application Server andalthough deprecated, is provided in version five for interoperability with olderclients and servers. CSIv2, which is the focus of this chapter, allows vendors tosecurely interoperate and provides a greater number of features over SAS.CSIv2 and SAS are add-on IIOP services, where IIOP is the communicationsprotocol used to send messages between two ORBs. In preparation for a requestto flow from client to server, a connection between the two ORBs must beestablished over TCP/IP. The client ORB will invoke the authentication protocol’sclient connection interceptor which is used to read the tagged components in theIOR of the server-based object being requested. This is how the authenticationpolicy is established. Once the policy has been established, the ORB will makethe connection, with the optional addition of the SSL cipher.The client ORB invokes the client request interceptor once the connection hasbeen established and sends security information other than what wasestablished by the transport. This may include a user ID and password token,which is authenticated by the server, an authentication mechanism-specifictoken, which is validated by the server or an identity assertion token, whichallows an intermediate to act on behalf of some identity other than itself. Thisadditional security information is sent with the message in a GIOP servicecontext.Chapter 6. Securing Java clients 101