WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Note: We recommend using IBM Tivoli Access Manager when an external
JACC provider is needed. WebSphere Application Server V7.0 includes a
Tivoli Access Manager client.
When security is enabled, the default authorization is used unless a JACC
provider is specified. The default authorization does not require special setup,
and the default authorization engine makes all of the authorization decisions.
When a JACC provider is used for authorization, the Java EE application-based
authorization decisions are delegated to the provider per the JACC specification.
Figure 12-2 shows the communications flow.
Access J2EE
resource
Yes / No
Figure 12-2 JACC provider architecture
WebSphere Application
Server V7.0
Policy Object
Check
access
Yes / No
Provider Repository
Policy Object
JACC Provider
Contract
Note: All administrative security authorization decisions are made by the
WebSphere Application Server default authorization engine. The JACC
provider is not called to make the authorization decisions for administrative
security.
Dynamic module updates in JACC
WebSphere Application Server handles the dynamic module update with respect
to JACC for Web modules. When the Web module is updated, only that particular
application has to be restarted in native authorization mode. In the case of JACC
being enabled, it depends on the provider support to handle the dynamic module
updates specific to the security modules.
Chapter 12. Security 393