Novell Access Manager 3.1 SP 2, Руководство пользователя, Страница: 46 / 126

46 Novell Access Manager 3.1 SP2 J2EE Agent Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
2.2.1 Allowing Direct Access to the J2EE Server
This scenario is most often used when you have users who want to access the application server
behind your firewall. This configuration requires an internal DNS server that resolves the DNS
name of the application server to its IP address.
When you configure the Identity Server to provide authentication for the applications on the J2EE
server, the communication process follows the paths illustrated in
Figure 2-1 .
Figure 2-1
JBoss Applications Using the Identity Server
1. The user requests access to an application on the J2EE server. The user is redirected to the
Identity Server.
2. The Identity Server prompts the user for a username and password.
3. The Identity Server verifies the username and password against a user store (an LDAP
directory).
4. The Identity Server builds the roles for the user and redirects the user back to the application
server.
5. The agent verifies the user’s credentials and obtains the user’s role information.
6. The application server allows access to the requested application.
For configuration information, see Chapter 2, “Configuring the Agent for Authentication,” on
page 45 .
2.2.2 Protecting the Application Server with the Access
Gateway
In this scenario, the J2EE server with the application is protected by the Access Gateway. The
Access Gateway is a reverse proxy server that restricts access to Web-based content, portals, and
Web applications that employ authentication and access control policies.
When you configure the Access Gateway to protect the application server, the communication
process follows the paths illustrated in
Figure 2-2 .
3
Browser
2
LDAP Directories
Identity Server
4
1
4
5
J2EE Server with
Agent and Applications
6