IBM WebSphere V5.0 Security - CGISecurity

User RegistryClient1. Request2. Auth. Challenge3. ChallengeResponseBA Header:c_user:c_pwdWebSEALc_userc_pwd4. Authenticate5: RequestBA Header:tai_user:tai_pwdiv_user: c_useriv_groups: c_groupsiv_creds: c_creds6. AuthenticateTAItai_usertai_pwdWebSphereApplication Server8: Response7: Responseuser:c_userFigure 12-7 TAI Information Flow1. An unauthenticated client issues a request for a secure resource which isintercepted by the reverse proxy (WebSEAL).2. WebSEAL issues an HTTP authentication challenge to the client. Note thatWebSEAL could be configured to provide a login form instead, but the overallflow of information would remain the same.3. The client responds to the authentication challenge with a new requestcontaining the client’s userid (c_user) and password (c_pwd) in the HTTPBasic Authenticaion (BA) Header.4. WebSEAL authenticates the user against the user registry using c_user andc_pwd.5. WebSEAL modifies the BA Header so that the userid (tai_user) and password(tai_pwd) are those expected by the Trust Association Interceptor. It attachesthe client’s userid and, optionally, group membership and credentials into anadditional HTTP headers (iv_user, iv_groups, and iv_creds) that are sentalong with the request to WebSphere.6. WebSphere’s Trust Association Interceptor authenticates the userid andpassword contained in the BA header(tai_user:tai_pwd) in order to establishtrust, and then extracts the client’s identity (c_user) from the iv_user header.WebSphere then handles the request as comming from c_user.7. WebSphere sends output to WebSEAL.8. WebSEAL sends the output to the client.392 IBM WebSphere V5.0 Security Handbook