IBM WebSphere V5.0 Security - CGISecurity

Outside WorldDemilitarized Zone(DMZ)Internal NetworkPublic KeyInfrastructureDirectoryServicesIP NetworkProtocol firewallWeb ServerRedirectorDomain firewallApplicationServerClientExistingapplicationand dataFigure 11-4 Runtime pattern for Self-Service:: Directly Integrated Single Channelapplication patternThe main nodes of the pattern are listed below, and described from a securitypoint of view.►►►►►The protocol firewall prevents unauthorized access from the Internet to thedemilitarized zone. The role of this node is to allow the Internet traffic accessonly on certain ports and block other ports.Web Server Redirector: in order to separate the Web server from theapplication server, the Web server redirector has been introduced. Its job is toredirect the application requests to the application server node. Theadvantage of using Web server redirector is that we can move the applicationserver and all the application business logic behind the domain firewall.The domain firewall prevents unauthorized access from the demilitarizedzone to the internal network. The role of this firewall is to allow the networktraffic originating only from the demilitarized zone and not from the Internet.The application server provides the infrastructure to run the application logicand communicate with internal back-end systems and databases.Directory services provide the information about the users and theirs rights forthe Web application. The information may contain users’ IDs, passwords,Chapter 11. Security in Patterns for e-business 357