IBM WebSphere V5.0 Security - CGISecurity

An authentication mechanism in WebSphere typically collaborates closely with aUser Registry. The User Registry is the user and groups accounts repository thatthe authentication mechanism consults with when performing authentication. Theauthentication mechanism is responsible for creating a credential which is aWebSphere internal representation of a successfully authenticated client user.Not all credentials are created equal. The abilities of the credential aredetermined by the configured authentication mechanism.Although WebSphere provides several authentication mechanisms, only a single“active” authentication mechanism can be configured at once. The activeauthentication mechanism is selected when configuring WebSphere globalsecurity.WebSphere provides two authentication mechanisms; Simple WebSphereAuthentication Mechanism (SWAM) and Lightweight Third Party Authentication(LTPA). These two authentication mechanisms differ primarily in the distributedsecurity features each supports.► SWAM (Simple WebSphere Authentication Mechanism)The SWAM authentication mechanism is intended for simple, non-distributed,single application server type runtime environments. The single applicationserver restriction is due to the fact that SWAM does not support forwardablecredentials. What this means is that if a servlet or EJB in application serverprocess 1 invokes a remote method on an EJB living in another applicationserver process 2, the identity of the caller identity in process 1 is nottransmitted to server process 2. What is transmitted is an unauthenticatedcredential, which, depending on the security permissions configured on theEJB methods, may cause authorization failures.Since SWAM is intended for a single application server process,single-sign-on (SSO) is not supported.The SWAM authentication mechanism is suitable for simple environments,software development environments, or other environments that do notrequire a distributed security solution.SWAM relies on the session ID; it is not as secure as LTPA, therefore usingSSL with SWAM is strongly recommended.► LTPA (Light Weight Third Party Authentication)Lightweight Third Party Authentication (LTPA) is intended for distributed,multiple application servers and machine environments. It supportsforwardable credentials and SSO. LTPA is able to support security in adistributed environment through the use of cryptography. This permits LTPAto encrypt and digitally sign and securely transmit authentication related dataand later decrypt and verify the signature.Chapter 9. WebSphere Application Server security 225