IBM WebSphere V5.0 Security - CGISecurity

Message channels and MQ channels can use the SSL protocol to provide linklevel security. A caller MCA is an SSL client and a responder MCA is an SSLserver. You can specify the cryptographic algorithms that are used by the SSLprotocol as part of the channel definition.At each end of a message channel, and at the server end of an MQ channel, theMCA acts on behalf of the queue manager to which it is concerned. During theSSL handshake, the MCA sends the digital certificate of the queue manager toits partner MCA at the other end of the channel. The MCA at the client end of anMQI channel acts on behalf of the user of the WebSphere MQ client application.During the SSL handshake, the MCA sends the user’s digital certificate to itspartner MCA at the server end of the MQ channel.Digital certificates are stored in a key repository. The queue manager attributeSSLKeyRepository specifies the location of the key repository that holds thequeue manager’s digital certificate. On a WebSphere MQ client system, theMQSSLKEYR environment variable specifies the location of the key repositorythat holds the user’s digital certificate. Alternatively, a WebSphere MQ clientapplication can specify its location in the KeyRepository field of the SSLconfiguration options structure, MQSCO, for an MQCONNX call.To create your own certificates for the SSL communication, use IBM’s ikeymantool.7.3 J2C securityThis section briefly describes the J2EE Connector Architecture in WebSphereApplication Server V5 and the security considerations related to connectors.When using connectors, the application requests data from the connector andthe connector gets the data from the resource and returns it to the application.But Enterprise Information Systems are generally very important applicationsand are protected from unauthorized access. So authentication information mustbe passed while requesting a connection.7.3.1 Securing adaptersConnectors in WebSphere let you connect to resources such as data or anapplication on a remote server. These resources are called an “EnterpriseInformation System” (EIS). Typically, a connector accesses non-relational dataand is used by developers to developers to complement the other means ofaccessing Relational DataBase Management Systems (RDBMS) data. Basically,your application request reaches the connector, the connector talks to the EIS,then returns the results back to the requestor application.Chapter 7. Securing Enterprise Integration components 169