IBM WebSphere V5.0 Security - CGISecurity

6.4 Identity AssertionDefinition: Identity assertion is basically the process taking place when theinvocation credential is asserted to the downstream server during a call.When a client authenticates to a server, the received credential is set. Whenauthorization checks the credential to see if it is allowed access, it will also setthe invocation credential so that if the EJB method calls another EJB methodlocated on other servers, the invocation credential can be used as the identity toinvoke the downstream method. Depending on the RunAs mode for the EJB, theinvocation credential will be set as the originating client identity, the server'sidentity, or a specified different identity. Regardless of the identity that is set,when Identity Assertion is enabled, it is the invocation credential that is assertedto the downstream server.The invocation credential identity is sent to the downstream server in an identitytoken. In addition, the sending server's identity, including password or token, issent in the client authentication token. Both are needed by the receiving server toaccept the asserted identity. The receiving server does the following to acceptthe asserted identity.1. First, it is determined whether the sending server's identity is on the trustedprincipal list of the receiving server. That is, is the sending server one which isallowed to send an identity token to the receiving server?2. Second, once we have determined that the sending server is on the trustedlist, we need to make sure it truly is the sending server by authenticating it.This could be simply comparing the user ID and password from the sendingserver to that of the receiving server. Or it could require a real authenticatecall.3. If the sending server's credentials are authenticated and on the trustedprincipal list, then evaluation of the identity token can proceed. Evaluation ofthe identity token consists of the following. There are four formats of identitieswhich can be present in an identity token:– Principal name– Distinguished name– Certificate chain– Anonymous identityThe WebSphere Application Servers that receive authentication informationtypically support all four identity types. The sending server decides which onewill be chosen based on how the original client authenticated. The type that ispresent depends on how the client originally authenticates to the sendingChapter 6. Securing Java clients 107