Borland VisiBroker® 7.0 - Borland Technical Publications

Steps to secure clients and serversSteps to secure clients and serversNoteImportantListed below are the common steps required for developing a secure client or secureserver. For CORBA users the properties are all stored in files that are located throughconfig files. Where ever appropriate the usage models for clients and servers areseparately discussed. All properties can be set in the VisiBroker Management Consoleby right-clicking the node of interest in the Navigation Pane and selecting “EditProperties.”These steps are similar for both Java and C++ applications.All security information, including RoleDBs, LoginModule configurations, and such canbe set through the Management Console on the appropriate properties tabs.Step One: Providing an identityClientsServersAn identity can be a username/password/realm triad, or certificates can be used.These can be collected through JAAS modules or through APIs.For clients using usernames and passwords, there can be constraints about what theclient knows about the server's realms. Clients may have intimate knowledge of theserver's supported realms or none at all at the time of identity inquiry. Note also thatclients authenticate at the server end.For servers using username and password identities, authentication is performedlocally since the realms are always known.There can be constraints on certificate identities as well, depending on whether theyare stored in a KeyStore or whether they are specified through APIs.Keeping these constraints in mind, the Borland VisiBroker Server supports thefollowing usage models, any of which could be used to provide an identity to the serveror client:■“Username/password authentication, using JAAS modules, for known realms” onpage 66■“Username/password authentication, using APIs” on page 67■“Certificate-based authentication, using KeyStores through property settings” onpage 67■“Certificate-based authentication, using KeyStores through APIs” on page 67■“Certificate-based authentication, using APIs” on page 67■“pkcs12-based authentication, using KeyStores” on page 67■“pkcs12-based authentication, using APIs” on page 67Username/password authentication, using JAAS modules, for knownrealmsIf the realm to which the client wishes to authenticate is known, the client-side JAASconfiguration would take the following form:vbroker.security.login=truevbroker.security.login.realms=66 VisiBroker Security Guide