IBM WebSphere V5.0 Security - CGISecurity

4.1 Static componentsWebSphere Application Server can only secure components that it owns. Anystatic pages that are served from the Web server cannot be protected byWebSphere tools. They will require using Web server related securitymechanisms and will be transparent to WebSphere.Most Web servers are able to secure the files that they serve. For example,IBMHTTP Server can protect its own resources, in the following ways:►►►HTTP basic authentication uses user identity in the network or the user IDand password the user submits. The authentication can also be made basedon a combination of these elements.HTTP digest authentication uses MD5 hash function to hash passwords andother data. The main idea of digest authentication is that the Web server doesnot store the users password in its authentication files but stores hashed(encoded) combination of strings that contain user ID, password and theauthentication realm name.Digital certificate authentication using SSL uses SSL certificates to implementtransport layer security for the TCP/IP protocol.In Section 4.1.1, “Authentication with the Web server” on page 39, we provide anexample of how to configure IBM HTTP Server to secure static content withHTTP basic authentication when user registry is stored in the LDAP directory. InSection 4.1.2, “Authorization with the Web server” on page 43, we explain howaccess to this static content can be managed using the .htaccess configurationfile.Describing all the possible options for managing security in IBM HTTP Server isnot in the scope of this book. For detailed information, see the productdocumentation for the appropriate release.External products may also be used to provide the end-to-end securityinfrastructure. For information on how Tivoli Access Manage fits into thisscenario, see Chapter 12, “Tivoli Access Manager” on page 369.38 IBM WebSphere V5.0 Security Handbook