Borland VisiBroker® 7.0 - Borland Technical Publications

ContentsChapter 1Introduction to Borland VisiBroker 1VisiBroker Overview . . . . . . . . . . . . . . . . . 1VisiBroker features. . . . . . . . . . . . . . . . . 2VisiBroker Documentation . . . . . . . . . . . . . . 2Accessing VisiBroker online help topicsin the standalone Help Viewer . . . . . . . . . . 3Accessing VisiBroker online help topicsfrom within the VisiBroker Console. . . . . . . . 3Documentation conventions . . . . . . . . . . . 4Platform conventions . . . . . . . . . . . . . . . 4Contacting Borland support. . . . . . . . . . . . . . 4Online resources. . . . . . . . . . . . . . . . . . 5World Wide Web . . . . . . . . . . . . . . . . . . 5Borland newsgroups . . . . . . . . . . . . . . . . 5Chapter 2Getting Started with Security 7VisiSecure overview . . . . . . . . . . . . . . . . . 8VisiSecure for Java . . . . . . . . . . . . . . . . 8VisiSecure for C++. . . . . . . . . . . . . . . . . 8Pluggability . . . . . . . . . . . . . . . . . . . . 8VisiSecure design flexibility . . . . . . . . . . . . 8VisiSecure for Java features . . . . . . . . . . . . 8VisiSecure for C++ Features. . . . . . . . . . . . 9Basic security model . . . . . . . . . . . . . . . . . 9Authentication realm (user domain) . . . . . . . . 10Resource domain . . . . . . . . . . . . . . . . . 10Authorization domain . . . . . . . . . . . . . . . 11Distributed environments and VisiSecure SPI . . . . 11Managing authentication and authorizationwith JAAS . . . . . . . . . . . . . . . . . . . . . . 11Authentication and Identification . . . . . . . . . . . 11System identification. . . . . . . . . . . . . . . . 12Authentication and pluggability . . . . . . . . . . 12Server and/or client authentication . . . . . . . . 12Authenticating clients with usernamesand passwords . . . . . . . . . . . . . . . . . . 12Authentication property settings . . . . . . . . . . 13Public-key encryption . . . . . . . . . . . . . . . 13Asymmetric encryption . . . . . . . . . . . . . . 13Symmetric encryption . . . . . . . . . . . . . . . 14Certificates and Certificate Authority . . . . . . . 14Digital signatures . . . . . . . . . . . . . . . . . 14Generating a private key andcertificate request . . . . . . . . . . . . . . . . 14Distinguished names . . . . . . . . . . . . . . 15Certificate chains . . . . . . . . . . . . . . . . 15Certificate authentication . . . . . . . . . . . . . . . 16Certificate Revocation List (CRL) and revokedcertificate serial numbers . . . . . . . . . . . . . . 16Negotiating Quality of Protection (QoP)parameters . . . . . . . . . . . . . . . . . . . . . 16Secure Transportation . . . . . . . . . . . . . . . . 17JSSE and SSL pluggability . . . . . . . . . . . . 17Setting the level of encryption . . . . . . . . . . 17Supported cipher suites . . . . . . . . . . . . 17Authorization. . . . . . . . . . . . . . . . . . . . . 18Access Control List . . . . . . . . . . . . . . . . 18Roles-based access control . . . . . . . . . . . 18Pluggable Authorization . . . . . . . . . . . . . 19Context Propagation . . . . . . . . . . . . . . . . . 19Identity assertions . . . . . . . . . . . . . . . . 19Impersonation . . . . . . . . . . . . . . . . . 20Delegation . . . . . . . . . . . . . . . . . . . 20Trusting Assertions . . . . . . . . . . . . . . . . 21Trust assertions and plug-ins . . . . . . . . . 21Backward trust . . . . . . . . . . . . . . . . 21Forward trust . . . . . . . . . . . . . . . . . 21Temporary privileges . . . . . . . . . . . . . . . 21Using IIOP/HTTPS. . . . . . . . . . . . . . . . . . 22Netscape Communicator/Navigator . . . . . . . 22Microsoft Internet Explorer . . . . . . . . . . . . 22Chapter 3Authentication 25JAAS basic concepts . . . . . . . . . . . . . . . . 25Subjects . . . . . . . . . . . . . . . . . . . . . 25Principals . . . . . . . . . . . . . . . . . . . . . 26Credentials . . . . . . . . . . . . . . . . . . . . 26Public and private credentials . . . . . . . . . 26Authentication mechanisms andLoginModules . . . . . . . . . . . . . . . . . . . 27Authentication realms. . . . . . . . . . . . . . . 27LoginModules. . . . . . . . . . . . . . . . . . . 27LoginContext class and LoginModule interface . . . 28Authentication and stacked LoginModules . . . . 29Associating a LoginModule with a realm . . . . . . 30Syntax of a realm entry. . . . . . . . . . . . . . 31Borland LoginModules . . . . . . . . . . . . . . . . 32Basic LoginModule . . . . . . . . . . . . . . . . 32JDBC LoginModule . . . . . . . . . . . . . . . . 34LDAP LoginModule . . . . . . . . . . . . . . . . 35Host LoginModule . . . . . . . . . . . . . . . . 35Server and Client Identification . . . . . . . . . . . 36Setting the config file for clientauthentication . . . . . . . . . . . . . . . . . . 36System Identification . . . . . . . . . . . . . . . 36Formatted Target . . . . . . . . . . . . . . . . . 37GSSUP mechanism . . . . . . . . . . . . . . 37Certificate mechanism . . . . . . . . . . . . 38Using a Vault . . . . . . . . . . . . . . . . . . . 38Creating a Vault . . . . . . . . . . . . . . . . 39VaultGen example . . . . . . . . . . . . . . . 40Client identification . . . . . . . . . . . . . . . . 41i