IBM WebSphere V5.0 Security - CGISecurity

6. Upon subsequent requests, only authorizations checks are performed eitherby the Web collaborator or the EJB collaborator, depending on what the useris requesting. User credentials are extracted from the established securitycontext.Administrative tasksThe steps below illustrate how the administration tasks are executed.1. Administrative tasks are issued using either the Web based AdministrativeConsole or the wsadmin scripting tool.2. The administration client generates a request that reaches the server sideORB and JMX MBeans; JMX MBeans represent managed resources and arepart of the management interface system for components. The defaultcommunication protocol is SOAP. It can be changed either by giving aparameter to the wsadmin program or modifying administration settingsthrough the Administrative Console.3. JMX Beans contact the security server for authentication purposes. JAMXbeans have dedicated roles assigned and do not use user registry forAuthentication and Authorization.Java Client communicationThe steps below describe how a Java client interacts with a WebSphereapplication.1. Java clients generates a request that reaches the server side ORB. Therequest may be gotten through the CSIv2 interceptor if the client’s request isgenerated using CSIv2.2. The server side ORB passes the request to the EJB container.3. Authentication is performed by the ORB, before the client gets access toprotected resources.4. After submitting a request to the access protected EJB method, the EJBcontainer passes the request to the EJB collaborator.5. The EJB collaborator reads the deployment descriptor from the .ear file anduser credential from the security context.6. Credentials and security information is passed to the security server whichvalidates user access rights and passes this information back to thecollaborator.7. After receiving a response from the security server, the EJB collaboratorauthorizes or denies access to the user to the requested resource.For more detailed information about securing particular J2EE applicationmodules, please refer to the appropriate sections.Chapter 9. WebSphere Application Server security 229