IBM WebSphere V5.0 Security - CGISecurity

Required libraries from WebSphere for development are j2ee.jar, security.jar,securityimpl.jar, and wssec.jar.This sample is a sub-class of the WebSphereBaseTrustAssociationInterceptor;for more information about the code, open the CustomTAI.java source inWebSphere Studio and check the comments. You will find all the requiredmethods implemented for the TrustAssociationInterceptor interface.For more information on Custom Trust Association Interceptors, refer to thearticle on the IBM developerWorks Web site, Third-party security servers andWebSphere at:http://www-106.ibm.com/developerworks/library/it-expertprog_tpss/index.htmlConfiguring the custom Trust Association InterceptorFor testing purposes, this example will use Tivoli Access Manager WebSeal as asecurity reverse proxy.Clientwith a Web browserSecurity reverse proxya 3rd party implementationWebSphere Application Serverwith the Custom Trust Association InterceptorclientrequestproxyrequestFigure 8-4 Environment for testing the custom Trust Association InterceptorThe following configuration steps assume that you have already enabled globalsecurity, set the authentication mechanism to LTPA, and enabled SingleSign-On.For testing purposes, it is recommended that you turn on the tracing facility forWebSphere; to do that, follow the steps from “Security trace” on page 235.1. Move the .jar file with the custom association interceptor to the/classes directory, next time you restart the server, it willpick up the .jar file and insert it into the classpath.2. Register the new interceptor with the Administrative Console, navigate to theSecurity -> Authentication Mechanisms -> LTPA item.3. Select TrustAssociation.4. Make sure that Trust Association Enabled is selected, then click Apply.5. Click Interceptors, then click New.192 IBM WebSphere V5.0 Security Handbook