Borland VisiBroker® 7.0 - Borland Technical Publications

Server and Client IdentificationIn this code sample:■■The process will already know something about the realms to which it needs toauthenticate through the property vbroker.security.login.realms.The process knows it will authenticate to the host on which it is running (logicallyrepresenting the “payroll” realm), and so sets itself up to invoke this LoginModule.■The process also knows that it must log into the “hr” realm, and so sets up aLoginModule to this end as well.The format of the realm information passed into vbroker.security.login.realms is asfollows:#This format is called Formatted Target.Formatted TargetA “realm” represents a configuration entry that represents an authenticating target. Inthe absence of a configuration file (such as in a client process, or for certificates, whichhave no representation in a JAAS config file), there needs to be a way to represent atarget realm. This is done using a “formatted target”. A formatted target is of the form:#For example:Realm1, Realm3, GSSUP#Realm4, and Certificate#ALL.An authentication mechanism represents a “format” for communicating authenticationinformation between various components of the security subsystem. For example, itrepresents how LoginModules communicate with the mechanism and how themechanism on one process communicates with an equivalent mechanism on anotherprocess. The mechanism specific target name represents how the mechanismrepresents this target.NoteGSSUP mechanismVisiSecure provides a mechanism for a simple username/password authenticationscheme. This mechanism is called GSSUP. The OMG CSIv2 standard defines theinteroperable format for this mechanism. The LoginModule to mechanism interactionmodel is defined by Borland. This is because the mechanism implementation needs totranslate the information provided by a LoginModule to information (to a specificformat) it can transmit over the wire using CSIv2.As mentioned above, the target name for a mechanism is specific to that mechanism.For the GSSUP mechanism, the target name is a simple string representing a targetrealm (for example, in the JAAS configuration file, on the receiving tier). So, if a serverhas a configuration file with one realm defined, for example “ServerRealm”, a clientside representation of this realm would be:GSSUP#ServerRealmFor convenience, since the GSSUP mechanism is always available in VisiBroker, youcan omit the “GSSUP#” from the target name. However, this is only for the GSSUPmechanism. When the security service interprets a “realm” name, it first attempts toresolve the realm name with a local JAAS configuration entry. If that fails, it treats thatrealm name as representing “GSSUP#”.Chapter 3: Authentication 37