22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

It is possible to configure Application Server to use one of several user registries<br />

to verify this identity: an internal WPS database, a directory service (such as an<br />

LDAP directory), or some other user registry via a CustomRegistry<br />

implementation.<br />

When a third-party authentication provider is configured, such as Policy Director<br />

WebSEAL, then that third-party authentication provider determines the challenge<br />

mechanism and how it does its own authentication. WebSphere Application<br />

Server and Portal Server then trust that authentication through the use of TAIs.<br />

Portal Server authentication in a developer installation<br />

The development installation is the only configuration that does not use<br />

WebSphere Application Server or a third-party authentication proxy to verify<br />

proof of identity. The development installation does not activate WebSphere<br />

Application Server’s Global Security, nor does it protect the /wps/myportal entry<br />

point in the WebSphere Application Server. This model relies on Portal Server to<br />

authenticate using the Portal Server database. Portal Server saves user<br />

identification and preferences to its database tables and verifies identity in this<br />

database during login. This configuration assumes a single machine set up in a<br />

development or demonstration environment only.<br />

Using third-party authentication proxies<br />

Rather than use WebSphere Application Server authentication support, it is<br />

possible to configure a third-party authentication server such as Policy Director<br />

WebSEAL. If a third-party authentication server is used, WebSphere Application<br />

Server typically uses a trust association interceptor (TAI) to trust the external<br />

authentication proxy and set up its security context. The exception is if the<br />

third-party authentication proxy or server has been configured to provide native<br />

WebSphere Application Server identity tokens, such as an LTPA token. Currently,<br />

only Policy Director WebSEAL has this capability.<br />

A trust association interceptor is a WebSphere Application Server function<br />

activated through the Security Center of WebSphere Application Server's<br />

Administrative Console and configured through trustedservers.properties.<br />

Whenever a request attempts to access a secured resource, WebSphere<br />

Application Server invokes the TAI, which is asked to validate that the request is<br />

legitimate, meaning that it is received through a legitimate third-party<br />

authentication proxy, and to return that user's authenticated identity. The TAI<br />

should return either a Distinguished Name (DN) or a shortname. WebSphere<br />

Application Server then performs a registry lookup to verify the Distinguished<br />

Name or convert the shortname to a Distinguished Name before searching for<br />

group memberships for that user. It is important to understand that the<br />

Distinguished Name lookup must not fail, otherwise the WebSphere Application<br />

Server will refuse to trust the identity. If the registry lookup is a success,<br />

Chapter 12. Security features of other Lotus products 559

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!