IBM WebSphere V5.0 Security - CGISecurity

– Authorization ServerThe Authorization Servers are used by applications in remote mode.Remote mode means that the application sends a request to the server toanswer the question “Can the user perform the action on the resources?”.Local mode means that the application has an in-memory cache of thepolicy so the application can check this for a decision without sending amessage outside the application; for example, WebSEAL works in localmode.For more information on the Tivoli Access Manager product and integrationwith WebSphere Application server, please refer to Chapter 12, “Tivoli AccessManager” on page 369.The following steps provide a simple technical walkthrough for userauthentication in the sample application, which you can also follow in Figure 11-8on page 362.1. The customer (application end user) uses a browser to locate the Webapplication from the Web.2. The request hits the protocol firewall that only allows appropriate traffic. Fromhere, the traffic is passed to the security reverse proxy. An extension to thiscould be to implement the network dispatcher that would select the Webreverse proxy that is most available at a time.3. The security reverse proxy is responsible for authentication and for sessionestablishment and maintenance. The proxy authenticates the user if it isrequired for the resource, then establishes the session. Authentication ischecked against the LDAP user registry.4. Once a session is established, the security reverse proxy authorizes the userbased on the URL the user is trying to access. This authorization is coarsegrained as it can only affect the URL requested.5. If the request is authorized then it is forwarded to the Web server. The reverseproxy may perform load balancing across the Web servers. An extension canbe introduced here for managing the load between Web servers byintroducing the load balancer between the security reverse proxy and theWeb servers.6. The request is then sent through the second firewall to the applicationservers. The Web application servers execute business logic and call on theauthorization service for finer grained control. This authorization service willbe accessible via an API or through standard J2EE security. If the request isauthorized then a function will be executed on behalf of the authenticateduser. If the function communicates with back-end system through integrationserver, then it is up to the design of the integration layer to call authorizationservice for further, finer, levels of authorization.364 IBM WebSphere V5.0 Security Handbook