IBM WebSphere V5.0 Security - CGISecurity

8.6.1 Implementing security with JAASThis section will explain how JAAS is generally used to implement security inJava.Note: JAAS does not require Java 2 security to be enabled. JAAS can beconfigured and used without Java 2 security.Secured applicationConcerning security, here we will investigate how it works within an application.The secured application has two parts:►►The main application that handles the login procedure and runs the securedcode under the authenticated subject.The action that is invoked from the main application under a specific subject.Supporting ComponentsThe following objects are required for a secured application using JAAS:►►Principal that is part of a Subject.First of all, the Subject has to be explained. In JAAS the Subject is someidentity. This identity will be authenticated and permissions will be assigned toit.A Subject can have a relationship with several different authorities. In JAAS,these multiple interactions with authorities are represented by objects that areimplementing the java.security.Principal interface. The principal objects arelisted under a subject.A callback handler that implements the CallbackHandler interface. This classis a client provided set of interfaces for entering authentication information.These interfaces decouple the service provider from the particular inputdevices being used.Definition: callbackDevelopers conversant in the event-driven programming model ofMicrosoft Windows and X Window are accustomed to passing functionpointers that are invoked when something happens. The invocation part ofthe process is the “callback”. However, Java does not support methodpointers; Java interfaces provide a solution to implement callbacks.Chapter 8. Programmatic security 205