10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

FIGURE 30–4 Certificate-Based Mutual Authentication<br />

3<br />

Verifies<br />

certificate<br />

client.keystore<br />

client.cert<br />

Client<br />

trustStore<br />

client.cert<br />

server.cert<br />

1<br />

Requests protected resource<br />

2<br />

Presents certificate<br />

4<br />

Presents certificate<br />

6<br />

Accesses protected resource<br />

Defining Security Requirements forWeb Applications<br />

5<br />

Verifies<br />

certificate<br />

Server<br />

server.keystore<br />

server.cert<br />

In user name- and password-based mutual authentication, the following actions occur:<br />

1. A client requests access to a protected resource.<br />

2. <strong>The</strong> web server presents its certificate to the client.<br />

3. <strong>The</strong> client verifies the server’s certificate.<br />

4. If successful, the client sends its user name and password to the server, which verifies the<br />

client’s credentials.<br />

5. If the verification is successful, the server grants access to the protected resource requested<br />

by the client.<br />

Figure 30–5 shows what occurs during user name- and password-based mutual authentication.<br />

Chapter 30 • SecuringWeb Applications 861

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!