Common Secure Interoperability outbound authentication settings

To specify the features that a server supports when acting as a client to another downstream server go to...

administrative console | Security | Authentication Protocol | CSI Outbound Authentication

Authentication features include three layers of authentication that you can use simultaneously:

Transport layer	The transport layer, the lowest layer, might contain a SSL client certificate as the identity.
Message layer	The message layer might contain a user ID and password or authenticated token.
Attribute layer	The attribute layer might contain an identity token, which is an identity from an upstream server that is already authenticated. The attribute layer has the highest priority, followed by the message layer and then the transport layer. If this server sends all three, only the attribute layer is used by the downstream server. The only way to use the SSL client certificate as the identity is if it is the only information presented during the outbound request.

 

Configuration tab

Basic Authentication	Specifies whether to send a user ID and a password from the client to the server for authentication. This type of authentication occurs over the message layer. Basic authentication also involves delegating a credential token from an already authenticated credential, provided the credential type is forwardable (for example, LTPA). Basic authentication refers to any authentication over the message layer and indicates user ID and password as well as token-based authentication. Select Basic Authentication and determine whether this authentication method is required or supported. Select Required to indicate that when the server goes outbound to downstream servers, the downstream server must support basic authentication for this server to connect. Select Supported to indicate that this server might or might not perform basic authentication to a downstream server. Other methods of authentication can occur if configured. Select Never to indicate that this server never sends a message layer token outbound to a downstream server. If the downstream server requires basic authentication, then the connection is not attempted. Data type... String
Client Certificate Authentication	Specifies whether a client certificate from the configured keystore file is used to authenticate to the server when the SSL connection is made between this server and a downstream server (provided that the downstream server supports client certificate authentication). Typically, client certificate authentication has a higher performance than message layer authentication, but requires some additional setup steps. These additional steps include verifying that this server has a personal certificate and that the downstream server has the signer certificate of this server. If you select client certificate authentication, decide whether it is required or supported. Select Required to indicate that this server can only connect to downstream servers with client certificate authentication also configured. Select Supported to indicate that this server performs client certificate authentication with any downstream server, but might not use client certificate authentication depending on whether it is supported by the downstream server. Select Never to indicate that this client does not perform client certificate authentication to any downstream server. This limitation prevents access to any downstream server that requires client certificate authentication. Data type... String
Identity Assertion	Specifies whether to assert identities from one server to another during a downstream enterprise bean invocation. The identity asserted is the invocation credential that is determined by the RunAs mode for the enterprise bean. If the RunAs mode is Client, the identity is the client identity. If the RunAs mode is System, the identity is the server identity. If the RunAs mode is Specified, the identity is the identity specified. The receiving server receives the identity in an identity token and also receives the sending server identity in a client authentication token. The receiving server validates the identity of the sending server to ensure a trusted identity. When specifying identity assertion on the CSIv2 Authentication Outbound panel, also select basic authentication as supported or required on the CSIv2 Authentication Outbound panel. The server identity can then be submitted with the identity token, so that the receiving server can trust the sending server. Without specifying basic authentication as supported or required, trust is not established and the identity assertion fails. Data type... String
Stateful Sessions	Specifies whether to reuse security information during authentication. This option is usually used to increase performance. The first contact between a client and server must fully authenticate. However, all subsequent contacts with valid sessions, reuse the security information. The client passes a context ID to the server, and that ID is used to look up the session. The context ID is scoped to the connection, which guarantees uniqueness. Whenever the security session is invalid and if authentication retry is enabled (it is enabled by default), the client-side security interceptor invalidates the client-side session and resubmits the request transparently. For example, if the session does not exist on the server; the server fails and resumes operation. When this value is disabled, every method invocation must re-authenticate. Data type... String