22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

300 Lotus Security Handbook<br />

can also choose to completely service the request. pEventData is a pointer to the<br />

structure, FilterMapURL.<br />

kFilterAuthorized Event<br />

This event occurs after the authentication phase has taken place and the user's<br />

group names list has been computed. The filter can override the default<br />

implementation of the authorization phase and grant or deny access to the target<br />

resource. pEventData is a pointer to the structure, FilterAuthorize. It contains<br />

information about the target resource to serve. Note that the filter can get access<br />

to the authenticated user information by using the services via the ServerSupport<br />

callback with the flag, kGetAuthenticatedUserInfo. This will allow the user to gain<br />

access to the user's authenticated name as well as to his or her group names list.<br />

If the filter denies access to the target resource, it must send the appropriate<br />

response to the client, and set the field, isAuthorized, in the FilterAuthorize<br />

structure to 0. It can then return either kFilterHandledRequest or<br />

kFilterHandledEvent. The DSAPI layer will then signal the HTTP stack to<br />

terminate the processing of the current request.<br />

kFilterProcessRequest Event<br />

This is the last step in servicing an HTTP request. This event can be used to<br />

override the default implementation of the processing of the request. In this<br />

phase the response data is computed and sent to the client. pEventData is a<br />

pointer to the structure, FilterMapURL.<br />

kFilterEndRequest Event<br />

This event is used to advise the filter code that it is time to clean up and release<br />

resources allocated to handle a given HTTP request. pEventData is NULL in this<br />

case.<br />

kFilterAuthUser Event<br />

This event is replaced with the kFilterAuthenticate event, but is still supported for<br />

compatibility with previously written DSAPI filters. In this event, the filter<br />

authenticates the Web user. pEventData is an instance of the structure,<br />

FilterAuthenticate. The usage is described in the kFilterAuthenticate event<br />

described previously.<br />

This event allows you to customize the authentication of the Web users, which is<br />

often one part of implementing single sign-on within a corporation. In this case,<br />

the DSAPI filter is notified when Domino authenticates a user. The DSAPI filter<br />

can then parse the user name, validate user names and passwords against a<br />

legacy mainframe system, and if successful, notify the Domino Web server that it<br />

has handled the user's authentication and return to Domino the user's<br />

credentials.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!