Borland VisiBroker® 7.0 - Borland Technical Publications

Authentication and IdentificationSystem identificationAny system first needs to identify itself before being allowed access to resources.Client identification is always required for resource access. In a CORBA/J2EEenvironment, the need for identification also exists for servers as well. Servers needidentification in two cases:■One, when using SSL for transport layer security, the server typically needs toidentify itself to the client.■Two, when mid-tier servers make further invocations to other mid-tier or end-tierservers, they need to identify themselves before being allowed (potentially) to act onbehalf of the original caller.For more information, see “System Identification” on page 36.Authentication and pluggabilityAuthentication in VisiBroker is a JAAS implementation allowing pluggableauthentication. The JAAS logon service separates the configuration fromimplementation. A low-level system programming interface called the LoginModule,provides an anchor point for pluggable security modules.At the same time as system identification, the authentication mechanism concept isemployed to represent the “format” for communicating (or transporting) authenticationinformation between various components of the security subsystem. The securityservice provider for the authentication/identification process implements the specificformat (encoding and decoding process) that is to be used by the underlying coresystem.In a distributed environment, the authentication process is further complicated by thefact that the representation of the entity and the corresponding credential must betransported among peers in a generic fashion. Therefore, the VisiSecure Java SPIemploys the concept of the AuthenticationMechanism and defines a set of classes fordoing authentication/identification in a distributed environment.Server and/or client authenticationWith the VisiBroker implementation of JAAS, you can set different mechanisms ofauthentication. You can have server authentication, where servers are authenticatedby clients using public-key certificates. You can also have client authentication. Clientscan be authenticated using passwords or public-key certificates. That is, the server canbe configured to authenticate clients with a password or clients with public-keycertificates.Authenticating clients with usernames and passwordsIf server-side authentication is not required, authentication can be accomplished usinga standard username/password combination. To authenticate clients using usernamesand passwords, several things need to happen. The server should expose a set ofrealms to which it can authenticate a client. Each realm should correspond to a JAASLoginModule that actually does the authentication. Finally, the client should provide ausername and password, and a realm under which it wishes to authenticate itself. Formore information, see Chapter 3, “Authentication.”12 VisiBroker Security Guide