Borland VisiBroker® 7.0 - Borland Technical Publications

ChapterChapter 3AuthenticationJAAS basic conceptsThe first layer of security protection for any system is authentication (as well as identityrepresentation). This layer defines the process of verifying the entities are who theyclaim to be. Most of the time, credentials are required to verify the identity of an entity.VisiSecure employs the Java Authentication and Authorization Service (JAAS)framework to facilitate the interaction between the entities and the system. At the sametime, the authentication mechanism concept is employed to represent the format(encoding and decoding process) for communicating or transporting authenticationinformation between various components of the security subsystem.The Borland Security Service (BSS) employs the Java Authentication andAuthorization Service (JAAS) framework to facilitate the interaction between theentities and the system. Those who are new to the JAAS should familiarize themselveswith the terms JAAS uses for its services. Of particular importance are the concepts ofsubjects, principals, and credentials.SubjectsJAAS uses the term subject to refer to any user of a computing service or resource.Another computing service or resource, therefore, is also considered a subject when itrequests another service or resource. The requested service or resource relies onnames in order to authenticate a subject. However, different services may requiredifferent names in order to use them.For example, your email account may use one username/password combination, butyour ISP requires a different combination. However, each service is authenticating thesame subject—;namely yourself. In other words, a single subject may have multiplenames associated with it. Unlike the example situation, in which the subject himselfmust know a set of usernames, passwords, or other authentication mechanisms at aspecific time, JAAS is able to associate different names with a single subject and retainthat information. Each of these names is known as a principal.Chapter 3: Authentication 25