IBM WebSphere V5.0 Security - CGISecurity

►Application Security determines application specific requirements. In somecases, these values may override global security settings, but in most casesthey complement them. Application security includes such elements as: amethod for authenticating the users, a mechanism for authorizing the usersinto application specific resources, roles-based access control to theseresources, roles to user/user groups mapping, and so on. Application securityis administered during assembly phase using the Application Assembly Tool(AAT) and during the deployment phase using the WebSpherE AdministrativeConsole and the wsadmin client program.The diagram below presents a general overview of building blocks of a singleapplication server and how they interact in a Java client and Web browsercommunication. For a more detailed description of the security communicationflow, please refer to “Other security components” on page 226.NodeNodeAgentWebbrowserclientHTTP serverWebSphereplug-inApplication ServerWeb containerEmbeddedHTTP serverWebServicesengineConfigrepository(file)AdminUIClient containerJavaclientEJB containerAdminapplicationCustomerapplication (ear)Admin serviceApplicationDatabaseJ2C containerScriptingclientName Server (JNDI)Security serverEmbedded JMS ServerFigure 9-5 Single Application Server building blocksThis section presents a general overview of security components of theWebSphere Application Server and how they are used to create a flexiblepluggable architecture.222 IBM WebSphere V5.0 Security Handbook