Borland VisiBroker® 7.0 - Borland Technical Publications
Borland VisiBroker® 7.0 - Borland Technical Publications Borland VisiBroker® 7.0 - Borland Technical Publications
CORBA authorizationCORBA authorizationAuthorization in the CORBA environment allows only identities in specific roles for agiven object can access that object. An object's access policy is specified by means ofa Quality of Protection policy for the Portable Object Adapter (POA) hosting the objectin question. Note that access policies can only be applied at the POA level.Rolemaps are also used to implement authorization for CORBA objects. Similarly, theJ2EE roles and concepts therein are also used in the CORBA environment.Setting up authorization for CORBA objectsIn order to set up authorization for an object, you need to perform the following:1 Create a ServerQopPolicy.2 Initialize the ServerQopPolicy with a ServerQopConfig object.3 Implement an AccessPolicyManager interface, which takes the following form:Java interface AccessPolicyManager {public java.lang.String domain();public com.borland.security.csiv2.ObjectAccessPolicy getAccessPolicy(org.omg.PortableServer.Servant servant, byte[] object_id byte []adapter_id);}C++ class AccessPolicyManager {public:virtual char* domain() =0;ObjectAccessPolicy_ptr getAccessPolicy(PortableServer_ServantBase*_servant,const ::PortableServer::ObjectId& id,const::CORBA::OctetSequence& _adapter_id) =0;}This interface should return the authorization domain from the domain() method anduses it to set the access manager in the ServerQopConfig object. The domain specifiesthe name of the authorization domain associated with the proper rolemap. You set thelocation and name of the rolemap by setting the property:vbroker.security.domain..48 VisiBroker Security Guide
CORBA authorizationwhere is a tautology, and is a relative pathto the rolemap file. The getAccessPolicy() method takes an instance of the servant, theobject identity, and the adapter identity and returns an implementation of theObjectAccessPolicy interface.1 Implement the ObjectAccessPolicy interface that returns the required roles and a runasrole for accessing a method of the object. There is no difference between J2EEand CORBA run-as roles in Borland's implementation. The ObjectAccessPolicyinterface takes the following form:Java interface ObjectAccessPolicy {public java.lang.String[] getRequiredRoles(java.lang.String method);public java.lang,String getRunAsRole(java.lang.String method);}C++ class ObjectAccessPolicy {public:getRequiredRoles (const char* _method) =0;}The getRequiredRoles() method takes a method name as its argument and returns asequence of roles. The getRunAsRole() method returns a run-as role, if any, foraccessing the method.Identities can be supplied using Callback Handlers. For more details, see Chapter 3,“Authentication.”Chapter 4: Authorization 49
- Page 3 and 4: ContentsChapter 1Introduction to Bo
- Page 5 and 6: Security for the Borland web contai
- Page 7 and 8: Chapter1Introduction to Borland Vis
- Page 9 and 10: VisiBroker DocumentationImportant
- Page 11 and 12: Contacting Borland support■■■
- Page 13 and 14: Chapter2Getting Started with Securi
- Page 15 and 16: Basic security model■■■■Web
- Page 17 and 18: Distributed environments and VisiSe
- Page 19 and 20: Authentication and IdentificationAu
- Page 21 and 22: Authentication and IdentificationDi
- Page 23 and 24: Secure TransportationSecure Transpo
- Page 25 and 26: Context PropagationContext Propagat
- Page 27 and 28: Context PropagationTrusting Asserti
- Page 29 and 30: Using IIOP/HTTPSHere are several ex
- Page 31 and 32: ChapterChapter 3AuthenticationJAAS
- Page 33 and 34: Authentication mechanisms and Login
- Page 35 and 36: LoginContext class and LoginModule
- Page 37 and 38: Associating a LoginModule with a re
- Page 39 and 40: Borland LoginModulesThe elements in
- Page 41 and 42: Borland LoginModulesLDAP LoginModul
- Page 43 and 44: Server and Client IdentificationIn
- Page 45 and 46: Server and Client IdentificationCre
- Page 47 and 48: Server and Client IdentificationCli
- Page 49 and 50: ChapterChapter4AuthorizationAuthori
- Page 51 and 52: Defining access control with Role D
- Page 53: Authorization domainsTo accomplish
- Page 57 and 58: Chapter5Configuring Security Profil
- Page 59 and 60: Security ProfilesEnabling SecurityF
- Page 61 and 62: Security ProfilesConfiguring Authen
- Page 63 and 64: Security ProfilesTo access the Auth
- Page 65 and 66: Security ProfilesWorking with Autho
- Page 67 and 68: Security ProfilesAdding and Removin
- Page 69 and 70: Associating a Profile with a Domain
- Page 71 and 72: Chapter6Making Secure Connections (
- Page 73 and 74: Steps to secure clients and servers
- Page 75 and 76: Examining SSL related informationEx
- Page 77 and 78: Chapter7Making Secure Connections (
- Page 79 and 80: Steps to secure clients and servers
- Page 81 and 82: Creating Custom PluginsLoginModules
- Page 83 and 84: ChapterChapter8Security for the Web
- Page 85 and 86: Security for the Apache web serverC
- Page 87 and 88: Enabling certificate passthrough to
- Page 89 and 90: Security for the Borland web contai
- Page 91 and 92: Three-tier authorization schemeNote
- Page 93 and 94: Chapter9Security Properties for Jav
- Page 95 and 96: Security Properties for JavaPropert
- Page 97 and 98: Chapter10Security Properties for C+
- Page 99 and 100: Security Properties for C++Property
- Page 101 and 102: Chapter11VisiSecure for C++ APIsCha
- Page 103 and 104: General APIUse this to login to the
CORBA authorizationwhere is a tautology, and is a relative pathto the rolemap file. The getAccessPolicy() method takes an instance of the servant, theobject identity, and the adapter identity and returns an implementation of theObjectAccessPolicy interface.1 Implement the ObjectAccessPolicy interface that returns the required roles and a runasrole for accessing a method of the object. There is no difference between J2EEand CORBA run-as roles in <strong>Borland</strong>'s implementation. The ObjectAccessPolicyinterface takes the following form:Java interface ObjectAccessPolicy {public java.lang.String[] getRequiredRoles(java.lang.String method);public java.lang,String getRunAsRole(java.lang.String method);}C++ class ObjectAccessPolicy {public:getRequiredRoles (const char* _method) =0;}The getRequiredRoles() method takes a method name as its argument and returns asequence of roles. The getRunAsRole() method returns a run-as role, if any, foraccessing the method.Identities can be supplied using Callback Handlers. For more details, see Chapter 3,“Authentication.”Chapter 4: Authorization 49
Change language