Borland VisiBroker® 7.0 - Borland Technical Publications

Authentication mechanisms and LoginModulesJava public final class Subject {...public Set getPrivateCredentials()}C++ class Subject {public:Credential::set& getPrivateCredentials();}For Java, permissions are required for code to access private credentials in a Subject.For cpp, all codes are local and therefore trusted. No permission required to accessboth public and private credentials. For more information on permissions in Java,consult the JAAS Specification from Sun Microsystems.Authentication mechanisms and LoginModulesAn authentication mechanism represents the encoding/decoding for communicatingauthentication information between various components of the security subsystem. Forexample, it represents how LoginModules communicate with the mechanism and howthe mechanism on one process communicates with an equivalent mechanism onanother process.VisiSecure includes several common LoginModules for server and client authenticationas well as the Security Provider Interface classes for Java and C++ that enable you to“plug-in” security service provider implementations of authentication and identification.Authentication realmsAn authentication realm represents a single user authentication mechanism,customized to point to a datasource which contains user information . This allows theauthentication mechanism to be independent of the actual user database and thereforebe used with multiple user databases that support the same authenticationmechanism. For example, if a vendor writes an authentication module to work withLDAP, that mechanism can then be used to interact with different LDAP directories indifferent environments, without having to rewrite or otherwise modify the authenticationmechanism.For more information on the authentication realm (user domain), see “Basic securitymodel” on page 9.LoginModulesA LoginModule defines an authentication mechanism and provides the code to interactwith a specific type of authentication mechanism. Each LoginModule is customizedusing authentication options that point it to a specific data source and provide othercustomizable behavior as defined by the author of the LoginModule.Each LoginModule authenticates to a particular authentication realm (anyauthenticating body or authentication provider—;for example, an NT domain). Anauthentication realm is represented by a configuration entry in a JAAS configurationfile. A JAAS configuration entry contains one or more LoginModule entries withassociated options to configure the realm. For more information, see “Associating aLoginModule with a realm” on page 30.Chapter 3: Authentication 27