web server - Borland Technical Publications

Security management with the Security Map
Table 27.1
Unused pool properties (continued)
Property Default Description
cleanup-enabled true Indicates whether or not the Connection Pool
should have unused Managed Connections
reclaimed as a means to control system resources.
cleanup-delta 1 Identifies the amount of time the Connection Pool
Management will wait between attempts to reclaim
unused Managed Connections.
Security management with the Security Map
The Security Map enables the definition of user roles that can be
1 Used directly with the EIS for container-managed sign-on (use-caller-identity).
2 Mapped to an appropriate resource role for container-managed sign-on (run-as).
In the first case, when the user role identified at run time is found in the mapping, the
user role itself is used to provide security information for interacting with an EIS. In the
second case, when the user role identified at run time is found in the mapping, the
associated resource role is used to provide security information for interacting with an
EIS.
The use-caller-identity option is used when user identities in the user role identified at
run time are available to the EIS as well. For example, a user identity, “borland”/
”borland”, belonging to role “Borland”, is available to the Borland Enterprise Server,
and the available EIS, a JDataStore database, has an identity of “borland”/”borland”
available to it. When a Resource Adapter serving JDataStore is deployed with a
Security Map specifying:
Borland
Applications on this server instance which use this JDataStore database can use usecaller-identity
to access it. Note: Due to a limitation currently in VisiSecure, you must
define the caller identity in the resource vault as well as the user vault.
The run-as option is used when it makes sense to map user identities in the user role
identified at run time to identities in the EIS. For example, a user identity, “demo”/
”demo”, belonging to role “Demo”, is available to the Borland Enterprise Server, and
the available EIS, an Oracle database, has an identity of “scott”/”tiger”, which is ideal
for a demo user. When a Resource Adapter serving Oracle is deployed with a Security
Map specifying:
Demo
oracle_demo
Oracle demo role
The role oracle_demo is defined in the resource vault (see below), applications on this
server instance which use this Oracle database can use run-as to access it.
When run-as is used, the vault must be provided for VisiConnect to use to extract the
security information for the resource role. A resource role name and a set of credentials
are written to this vault. When VisiConnect loads a Resource Adapter with a defined
Security Map using run-as, it will read in the credentials for the defined role name(s)
from the vault.
260 BES Developer’s Guide