WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Single Sign On for HTTP requests is also possible with SPNEGO Web
authentication. Microsoft Windows users can access WebSphere Application
Server resources without requiring an additional authentication process after
being authenticated by a Domain Controller. Detailed information about
SPNEGO Web authentication can be found in the WebSphere Application Server
V7.0 Information Center at the following Web page:
http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=/
com.ibm.websphere.nd.doc/info/ae/ae/csec_SPNEGO_explain.html
Java Authentication and Authorization Service
The Java Authentication and Authorization Service (JAAS) extends the Java
security architecture with additional support to authenticate and enforce access
control with principals and users. It implements a Java version of the standard
Pluggable Authentication Module (PAM) framework and extends the access
control architecture of the Java platform in a compatible fashion to support
user-based authorization or principal-based authorization. WebSphere
Application Server fully supports the JAAS architecture and extends the access
control architecture to support role-based authorization for Java EE resources
including servlets, JSP files, and EJB components.
Although the applications remain unaware of the underlying authentication
technologies, they need to contain specific code to take advantage of JAAS. If a
new JAAS module is plugged-in, the application will work without a single
modification of its code.
A typical JAAS-secured application has two parts:
► The main application that handles the login procedure and runs the secured
code under the authenticated subject
► The action that is invoked from the main application under a specific subject
When using JAAS to authenticate a user, a subject is created to represent the
authenticated user. A subject consists of a set of principals, where each principal
represents an identity for that user. You can grant permissions in the policy to
specific principals. After the user is authenticated, the application can associate
the subject with the current access control context. For each subsequent
security-checked operation, the Java run time automatically determines whether
the policy grants the required permission to a specific principal only. If so, the
operation is supported if the subject associated with the access control context
contains the designated principal only.
Chapter 12. Security 391