IBM WebSphere V5.0 Security - CGISecurity

WebSEALAuthenticated Usersbefore forwardingrequests for protectedresourcesWebSphere Application ServerContainer integratedwith Access ManagerJ2EE ApplicationDeploymentDescriptorAccess Manager'sLDAP User RegistryAccess ManagerAuthorization ServerAccess Manager'sPolicy ServerFigure 12-24 Access Manager for WebSphere beta ModelWhen a user requests a protected resource, WebSEAL authenticates the useragainst the Access Manager user registry. Junction configuration defines thetype and number of credentials then forwarded to the application server.The container examines the request for access to a protected resource and fromthe J2EE application deployment descriptor, determines the required role that theuser must have to be granted authorization. The container then hands off to theintegrated Access Manager module.The Access Manager module requests an authorization decision from anAccess Manager authorization server which checks with its local replica of theAccess Manager policy database. Replicas are normally updated on a pull basisfrom the single Access Manager Policy Master within the Security Domain.While these calls can be made to a remote server, without the embedded AccessManager promised for the final WebSphere Application Server V5, performanceand scalability require that an Access Manager Authorization Server be installedon the same platform as WebSphere. Of course, this means that theperformance burden is passed to the platform hardware which must be capableof bearing both loads.Having returned the access decision, granted or denied, to the container,WebSphere then acts on it.432 IBM WebSphere V5.0 Security Handbook