web server - Borland Technical Publications

System Contracts
■
You can also use mutual authentication. In this case, Borland Enterprise Server not
only authenticates itself, it also requires authentication from the requesting client.
Clients are required to submit digital certificates issued by a trusted certificate
authority. Mutual authentication is useful when you must restrict access to trusted
clients only. For example, you might restrict access by accepting only clients with
digital certificates provided by you.
For more information, see “Getting Started with Security” in the Developer's Guide.
Security Map
In Section 7.5 of the Connectors 1.0 specification, a number of possible options are
identified for defining a Resource Principal on the behalf of whom sign-on is being
performed. VisiConnect implements the Principal Mapping option identified in the
specification.
Under this option, a resource principal is determined by mapping from the identity of
the initiating caller principal for the invoking component. The resulting resource
principal does not inherit the identity of security attributes of the principal that is it
mapped from. Instead, the resource principal derives its identity and security attributes
based on the defined mapping. Thus, to enable and use container-managed sign-on,
VisiConnect provides the Security Map to specify the initiating principal association
with a resourceprincipal. Expanding upon this model, VisiConnect provides a
mechanism to map initiating caller roles to resource roles.
If container-managed sign-on is requested by the component and no Security Map is
configured for the deployed Resource Adapter, an attempt is made to obtain the
connection using a null JAAS Subject object. This is supported based upon the
Resource Adapter implementation.
While the defined connection management system contracts define how security
information is exchanged between the Borland Enterprise Server and the Resource
Adapter, the determination to use container-managed sign-on or component-managed
sign-on is based on deployment information defined for the component requesting a
connection.
The Security Map is specified with the security-map element in the ra-borland.xml
deployment descriptor. This element defines the initiating role association with a
resource role. Each security-map element provides a mechanism to define appropriate
resource role values for the Resource Adapter and EIS sign-on processing. The
security-map elements provide the means to specify a defined set of initiating roles and
the corresponding resource role to be used when allocating managed connections and
connection handles.
A default resource role can be defined for the connection factory in the security-map
element. To do this, specify a user-role value of “*” and a corresponding resource-role
value. The defined resource-role is then utilized whenever the current identity if not
matched elsewhere in the Security Map.
This is an optional element. However, it must be specified in some form when
container-managed sign-on is supported by the Resource Adapter and any component
uses it. Additionally, the deployment-time population of the connection pool is
attempted using the defined default resource role, given that one is specified.
Security Policy Processing
The Connectors 1.0 specification defines default security policies for any Resource
Adapters running in an application server. It also defines a way for a Resource Adapter
to provide its own specific security policies overriding the default.
In compliance with this specification, Borland Enterprise Server dynamically modifies
the runtime environment for Resource Adapters. If the Resource Adapter has not
defined specific security policies, Borland Enterprise Server overrides the runtime
environment for the Resource Adapter with the default security policies specified in the
Chapter 26: VisiConnect overview 251