IBM WebSphere V5.0 Security - CGISecurity

Upon receiving the message, the server ORB invokes the authenticationprotocol’s server request interceptor, which finds the service context added bythe client’s request interceptor and invokes a method in the Security server toauthenticate the client’s identity. If the client is authentic, the Security server willreturn a credential containing additional client information which it retrieved fromthe user registry in order to allow for authorization decisions to be made whenthe EJB method corresponding to the client request is invoked.Should the server’s request interceptor find no service context, it will look at thetransport connection information to see if a client certificate was supplied whenthe SSL connection between client and server was established. If such acertificate is found, the Distinguished Name (DN) is extracted and is mapped toan identity in the user registry. In the case of LTPA, the DN is used; for SWAM orKerberos, the Common Name (CN) portion of the DN is used.If identity information is not available, an unauthenticated credential will becreated and applied in order to determine if the request is authorized to invokethe required method.invocation credential:user name: user01password: userpwdinvoked method:foo.getCoffee()Client ORB1ClientConnectionInterceptorClient RequestInterceptor25service context:user name: user01password: userpwdRequestfoo.getCoffee()transport connectionReplyCoffeeservice context:steteful requestvalid3Server RequestInterceptor4received credential:security tokenEJB implementation:FooServer ORBFigure 6-1 Authentication Protocol FlowFollow the steps in the flow diagram above:1. Client ORB calls the connection interceptor to create the connection.2. Client ORB calls the request interceptor to get client security information,send_request().3. Server ORB calls the request interceptor to receive the security information,authenticate and set the received credential, receive_request().102 IBM WebSphere V5.0 Security Handbook