22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

database to ensure portal membership. If the user is not found in the<br />

authentication registry, authentication fails. If the user is found in the<br />

authentication registry, but not in the member database, the user is denied<br />

access to the portal. Both lookups must succeed for the user to successfully log<br />

in to WebSphere Portal Server.<br />

Single sign-on<br />

Single sign-on support in WebSphere Portal Server provides a mechanism that<br />

assists a portlet in retrieving one of several representations of a user's<br />

authenticated identity, which the portlet can then pass to a back-end application.<br />

This is akin to WebSphere Portal Server and the portlet both acting as<br />

authentication proxies to the back-end application. Using single sign-on, a user<br />

can authenticate once when logging into the WebSphere Portal Server, and<br />

thereafter the user's identity is passed on to applications without requiring<br />

additional identity verification for the user. WebSphere Portal Server supports<br />

single sign-on through WebSphere Application Server as well as other<br />

authentication proxies, such as Tivoli Access Manager and SiteMinder. It also<br />

leverages the single sign-on capabilities between WebSphere Application Server<br />

and Domino.<br />

Single sign-on with the WebSphere Portal Server has two levels. The first is a<br />

Credential Service, which encapsulates the functionality of single sign-on for the<br />

portlet writer in an object provided by the Service and for which sample code<br />

exists to make these objects easy to use and code with for the portlet writer. The<br />

second level is more flexible, but requires portlet writers to directly utilize the<br />

single sign-on functions of the WebSphere Portal Server and manage their own<br />

connections and authentication to back-end applications.<br />

The single sign-on functions of Portal Server utilize a subset of Java<br />

Authentication and Authorization Services (JAAS). The subset is the<br />

authentication portion. WebSphere Portal Server does not support true JAAS<br />

authorization. WebSphere Portal Server builds a JAAS Subject for each user that<br />

is logged on. The Subject consists of Principals and Credentials. A Principal is a<br />

piece of data, such as the user ID or user's DN, that gives the identity of the<br />

Subject. A Credential is a piece of data, such as a password or a CORBA<br />

Credential, that can be used to authenticate as a subject. The Subject carries<br />

around the Principals and Credentials that can be used by the portlet directly or<br />

via the credential service.<br />

Credential Service<br />

Credential Service objects exist to handle basic authentication, LTPA token<br />

authentication, and simple form-based user ID/password login challenges.<br />

Chapter 12. Security features of other Lotus products 561

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!