Borland VisiBroker® 7.0 - Borland Technical Publications

Three-tier authorization schemeThree-tier authorization schemeIn addition to setting up security from your client browser to your Borland webcontainer, you can set up a three-tier authorization scheme to accommodate a morecomplex client/server landscape. A three-tier authorization scheme can include a clientbrowser, a web container, and an EJB container.Figure 8.1Three-tier authorization schemeThe server-side has two different container components with a security mechanism ineach of them. So, when a user (John) sends a client request, his login ID is authorizedand authenticated at the Borland web container level.Lets say that the client request requires the servlet running at the Borland webcontainer to access a bean in the EJB container. However, the EJB container does notknow the user, “John”. You have two options for extending security to the EJBcontainer.■■The first is to make the EJB container knowledgeable of all users.The second is to use the concept of “run-as”—When the web container makes anEJB invocation, the web container will “run as” a user that the EJB containerrecognize. The web application can be configured with a “run as” user to access thethird-tier component. The web application with the servlet making the EJBinvocation can be configured with “run as” user “web container”. In this case, thoughthe real user is “John”, the EJB container acknowledges the user as “webcontainer”.Setting up “run-as” roleThe Borland web container, supports the “run-as” configuration for web applications.The web application can be set up with the “run-as” role which maps to a user.To set up the “run as” configuration:1 Open the .war file in the DDEditor.2 In the Navigation pane, expand the .war file.3 Select a servlet node.4 Access the Properties pane, General tab.84 VisiBroker Security Guide