IBM WebSphere V5.0 Security - CGISecurity

LTPA requires that the configured User Registry be a central sharedrepository such as LDAP or a Windows Domain type registry.The following table summarizes the Authentication Mechanism capabilities anduser registries used with LTPA.Table 9-1 Authentication mechanismsAuthCmech.ForwardableusercredentialsSSOLocal OSuser registryLDAP userregistryCustom userregistrySWAM no no yes yes yesLTPA yes yes yes yes noFuture versions of WebSphere will support the Kerberos authenticationmechanism to provide a broader selection and an industry standard mechanismfor authentication.Authorization mechanismsWebSphere Application Server standard authorization mechanisms are basedon the J2EE security specification and Java Authentication and AuthorizationServices. JAAS extends the security architecture of the Java 2 Platform withadditional support to authenticate and enforce access controls upon users.JAAS programming models allows the developer to design applicationauthentication in a pluggable fashion, which makes the application independentfrom the underlying authentication technology.Java 2 security architecture uses security policy to specify who is allowed toexecute a code of the application. Code characteristics, like a code signature,signer ID, or source server, decide whether the code will be granted access to beexecuted or not. JAAS extends this approach with role-based access control.Permission to execute a code is granted not only based on the codecharacteristics but also on the user, who is running it.For each authenticated user, a Subject class is created and a set of Principals isincluded in the subject in order to identify that user. Security policies are grantedbased on possessed principals.Other security componentsThe following list will show you other security components within WebSphereApplication Server V5.226 IBM WebSphere V5.0 Security Handbook