Borland VisiBroker® 7.0 - Borland Technical Publications

Examining SSL related informationStep Four: If necessary, set up identity assertionWhen a client invokes a method in a mid-tier server which, in the context of thisrequest, invokes an end-tier server, then the identity of the client is internally assertedby the mid-tier server by default. Therefore, if getCallerSubject is called on the end-tierserver, it will return the Client's principal. Here the client's identity is asserted by themid-tier server. The identity can be a username or certificate. The client's privatecredentials such as private keys ore passwords are not propagated on assertion. Thisimplies that such an identity cannot be authenticated at the end-tier.If the user would like to override the default identity assertion, there are APIs availableto assert a given Principal. These APIs can be called only on mid-tier servers in thecontext of an invocation and with special permissions.Examining SSL related informationClientsServersBorland VisiBroker provides APIs to inspect and set SSL-related information. TheSecureContext API is used to inspect the SSL ciphersuites and enable select ciphers.To examine peer certificates, use getPeerSession() to return an SSLSession objectassociated with the target. You can then use standard JSSE APIs to obtain theinformation therein.To examine peer certificates on the server side, you set up the SSL connection withcom.borland.security.Context and use the APIs with com.borland.security.Current toexamine the SSLSession object associated with the thread.Creating Custom PluginsThere are various components of VisiSecure that allow for custom plug-ins. They are:■■■LoginModulesCallBack HandlersAuthorization service provider via the SPI■Assertion Trust via the SPIIn order for VisiSecure for C++ to find user implementations, all plugins must use theREGISTER_CLASS macro provided by VisiSecure to register their classes to the securityservice. When specifying the registered class, the name of the class must be specifiedin full together with the name space. Name spaces must be specified in a normalizedform, with either a “.” or “::” separated string starting from the outermost name space.For example:MyNameSpace {class MyLoginModule {......}}would be specified as either MyNameSpace.MyLoginModule or MyNameSpace::MyLoginModule.74 VisiBroker Security Guide