Sun Microsystems Sun GlassFish Enterprise Server 2.1, Administration Manual

Page: 102 / 256

About Authentication and Authorization
Authentication and authorization are central concepts of application server security. The
following topics are discussed related to authentication and authorization:
■
“Authenticating Entities” on page 102
■
“Authorizing Users” on page 103
■
“Specifying JACC Providers” on page 103
■
“Auditing Authentication and Authorization Decisions” on page 103
■
“Configuring Message Security” on page 104
Authenticating Entities
Authentication is the way an entity (a user, an application, or a component) determines that
another entity is who it claims to be. An entity uses security credentials to authenticate itself.
The credentials may be a user name and password, a digital certificate, or something else.
Typically, authentication means a user logging in to an application with a user name and
password; but it might also refer to an EJB providing security credentials when it requests a
resource from the server. Usually, servers or applications require clients to authenticate;
additionally, clients can require servers to authenticate themselves, too. When authentication is
bidirectional, it is called mutual authentication.
When an entity tries to access a protected resource, the Enterprise Server uses the
authentication mechanism configured for that resource to determine whether to grant access.
For example, a user can enter a user name and password in a Web browser, and if the
application verifies those credentials, the user is authenticated. The user is associated with this
authenticated security identity for the remainder of the session.
The Enterprise Server supports four types of authentication. An application specifies the type of
authentication it uses within its deployment descriptors.
TABLE 9–1
Enterprise Server Authentication Methods
Authentication Method Communication Protocol Description User Credential
Encryption
BASIC HTTP (SSL optional) Uses the server's built-in pop-up
login dialog box. None, unless using SSL.
FORM HTTP (SSL optional) Application provides its own
custom login and error pages. None, unless using SSL.
CLIENT-CERT HTTPS (HTTP over SSL) Server authenticates the client using
a public key certificate. SSL
About Authentication and Authorization
Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008 102