Borland VisiBroker® 7.0 - Borland Technical Publications

Basic security model■■■■Web Container Integration: VisiSecure integrates with the web container byproviding mechanisms to the web container that allow its own authentication andauthorization engines to propagate security information to other EJB containers, asnecessary. For example, a servlet trying to invoke an EJB container's bean will acton behalf of the original browser client that triggered the initial request. Securityinformation supplied from the client will be propagated seamlessly to the EJBcontainer. In addition, the web container authentication and authorization enginecan be configured to use authentication LoginModules and authorization rolemapssupplied by Borland.Security Services Administrator: The administration and configuration ofVisiSecure is performed using simple-to-use properties and supports tools like theJava keytool.GateKeeper: You can use GateKeeper to enable authenticated connections acrossa high-level firewall. This allows clients to connect to the server, even if the serverand the application client are on opposite sides of a firewall. Use of the GateKeeperis fully documented in the VisiBroker GateKeeper Guide.Secure Transport Layer: VisiSecure utilizes SSL, the primary secure transportlevel communication protocol on the Internet, as a secure transport layer. SSLprovides message confidentiality, message integrity, and certificate-basedauthentication support through a trust model.Basic security modelVisiSecure for C++ FeaturesVisiSecure for C++ has the following features:■■■Authentication and Authorization: The Authentication and Authorization modelare similar to VisiSecure for Java. This extends the capability of VisiSecure for C++applications.Security Services Administrator: The administration and configuration ofVisiSecure is performed using simple-to-use properties.Secure Transport Layer: VisiSecure utilizes SSL, the primary secure transportlevelcommunication protocol on the Internet, as a secure transport layer. SSLprovides message confidentiality, message integrity, and certificate-basedauthentication support through a trust model.The basic security model describes VisiSecure and its components from a user'sperspective. This is the logical model that VisiSecure users need to understand,configure and interact with. The security service groups entities of a system into thefollowing three logical groups (domains):■■■Authentication realm (User domain): simply a database of users. Eachauthentication realm describes a set of users and their associated credentials andPrivileges attributes.Resource Domain: represents a collection of resources of a single application. Theapplication developer defines the access control policies for access to resources inthe application.Authorization Domain: defines the set of rules that determines whether an accessattempt to a particular resource is allowed.Chapter 2: Getting Started with Security 9