Sun-microsystems GLASSFISH ENTERPRISE 820433510 Manual de usuario descargar pdf (Pagina 102)

About Authentication and Authorization

Authentication and authorization are central concepts of application server security. The

following topics are discussed related to authentication and authorization:

■

“Authenticating Entities” on page 102

■

“Authorizing Users” on page 103

■

“Specifying JACC Providers” on page 103

■

“Auditing Authentication and Authorization Decisions” on page 103

■

“Conguring Message Security” on page 104

Authenticating Entities

Authentication is the way an entity (a user, an application, or a component) determines that

another entity is who it claims to be. An entity uses security credentials to authenticate itself.

The credentials may be a user name and password, a digital certicate, or something else.

Typically, authentication means a user logging in to an application with a user name and

password; but it might also refer to an EJB providing security credentials when it requests a

resource from the server. Usually, servers or applications require clients to authenticate;

additionally, clients can require servers to authenticate themselves, too. When authentication is

bidirectional, it is called mutual authentication.

When an entity tries to access a protected resource, the Enterprise Server uses the

authentication mechanism congured for that resource to determine whether to grant access.

For example, a user can enter a user name and password in a Web browser, and if the

application veries those credentials, the user is authenticated. The user is associated with this

authenticated security identity for the remainder of the session.

The Enterprise Server supports four types of authentication. An application species the type of

authentication it uses within its deployment descriptors.

TABLE 9–1 Enterprise Server Authentication Methods

Authentication Method Communication Protocol Description User Credential

Encryption

BASIC HTTP (SSL optional) Uses the server's built-in pop-up

None, unless using SSL.

FORM HTTP (SSL optional) Application provides its own

custom login and error pages.

None, unless using SSL.

CLIENT-CERT HTTPS (HTTP over SSL) Server authenticates the client using

a public key certicate.

SSL

About Authentication and Authorization

Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008102

1 2 ... 97 98 99 100 101 102 103 104 105 106 107 ... 255 256

Sin comentarios

Sun-microsystems GLASSFISH ENTERPRISE 820433510 Manual de usuario Pagina 102