IBM WebSphere V5.0 Security - CGISecurity

For example, in a distributed object environment, a client can request the methodof an object on Server A. The method request results in invoking another methodof an object in server B. Server A performs the authentication of the identity ofthe client and passes the request to server B. Server B assumes that the clientidentity has been verified by server A and responds to that request as shown inFigure 2-2.optionsclientID: user01requestServer Aauthenticatesthe clientID: ServerAID: user01ID: otheruserrequestServer Bauthorizesclient'srequest andperforms theoperationFigure 2-2 Delegation mechanismDepending on the application environment, the intermediary can have one of thefollowing identities when making a request to another server:►►►2.2.2 AuthorizationClient identity: the identity under which the client is making the request to theintermediary.System identity: the identity of the intermediary server.Specified identity: identity specified through configuration.Authorization is the process of checking whether the authenticated user hasaccess to the requested resource. There are two fundamental methods forauthorization:Access Control ListEach resource has associated with it a list of users and what each can do withthe resource (for example: use, read, write, execute, delete or create).Usually, an Access Control List specifies a set of roles allowed to use a particularresource and also designates the people allowed to play these roles.10 IBM WebSphere V5.0 Security Handbook