IBM WebSphere V5.0 Security - CGISecurity

4. Server ORB calls the request interceptor to allow security to send informationback to the client along with the reply, send_reply().5. Client ORB calls the request interceptor to allow the client to cleanup and setthe session status as validor invalid, receive_reply().The SAS protocol supports the establishment of both stateless and statefulsecurity contexts. Stateless contexts exist only for the duration of the GIOPrequest that was used to establish the context. Stateful contexts endure until theyare discarded and can be referenced for use with subsequent requests. The SASprotocol includes a simple negotiation protocol that defines aleast-common-denominator form of interoperability between implementationsthat support only stateless contexts and those that support both stateless andstateful forms. While the J2EE Specification requires that only stateless mode isimplemented, the Application Server implements both in order to improve theperformance of a multiple message application. This is achieved by invoking theserver request interceptor when the EJB method has completed and sending anew reply service context to client containing the outcome. This extra step is onlynecessary for the first request in the session.6.3 Configuring the Java clientIt is necessary to configure the Java client so that it can access securedapplications. It must be made aware of certain properties, such as the securitysettings for the client ORB. The properties are provided in a file calledsas.client.props. The JVM in which the application client will run should be set touse this property file by adding the directive:com.ibm.CORBA.ConfigURL=.So, to start the JVM, enter:java-Dcom.ibm.CORBA.ConfigURL=file://properties/sas.client.props com.abc.myJavaAppwhere should be replaced with the directory in which theApplication Server, or the WebSphere Application Client, was installed, forexample C:\WebSphere\AppServer on a Windows machine.Chapter 6. Securing Java clients 103