Select an authentication mechanism
An authentication mechanism defines rules about security information, such as whether a credential is forwardable to another Java process, and the format of how security information is stored in both credentials and tokens. We can select and configure an authentication mechanism using the administrative console.
Authentication is the process of establishing whether a client is who or what it claims to be in a particular context. A client can be either an user, a machine, or an application. An authentication mechanism in WebSphere Application Server typically collaborates closely with a user registry. The user registry is the user and groups account repository that the authentication mechanism consults with when performing authentication. The authentication mechanism is responsible for creating a credential, which is an internal product representation of a successfully authenticated client user. Not all credentials are created equally. The abilities of the credential are determined by the configured authentication mechanism.
WAS provides three authentication mechanisms:
LTPA Supports SSO for users Kerberos Use Kerberos or SPNEGO tokens to enable interoperability with applications such as .NET and DB2. RSA tokens Used for server-to-server communication in a Flexible Management topology Simple WebSphere Authentication Mechanism (SWAM) is deprecated in this release. SWAM does not provide authenticated communication between different servers.
Authentication is required for enterprise bean clients and web clients when they access protected resources. Enterprise bean clients, like a servlet or other enterprise beans or a pure client, send the authentication information to a web application server using one of the following protocols:
- Common Secure Interoperability (CSIv2)
- (iSeries) Secure Authentication Service (SAS)
- z/OS Secure Authentication Service (z/SAS)
Web clients use the HTTP or HTTPS protocol to send the authentication information.
The authentication information can be basic authentication (user ID and password), a credential token, or a client certificate. The web authentication is performed by the web authentication module.
We can configure web authentication for a web client using the administrative console. Click...
Security > Global security > Authentication > Web and SIP security > General settings
Web authentication options:
- Authenticate only when the URI is protected
- The web client can retrieve an authenticated identity only when it accesses a protected Uniform Resource Identifier (URI). WAS challenges the web client to provide authentication data when the web client accesses a URI that is protected by a J2EE role. This default option is also available in previous versions of WAS.
- Use available authentication data when an unprotected URI is accessed
- The web client is authorized to call the getRemoteUser, isUserInRole, and getUserPrincipal methods; retrieves an authenticated identity from either a protected or an unprotected URI. Although the authentication data is not used when we access an unprotected URI, the authentication data is retained for future use. This option is available when we select the Authentication only when the URI is protected check box. This is useful is we are getting SECJ0369E: Authentication failed when using LTPA. The exception is com.ibm.websphere.wim.exception.PasswordCheckFailedException: CWWIM4537E No principal is found from the 'unauthenticated' principal name.
- Authenticate when any URI is accessed
- The web client must provide authentication data regardless of whether the URI is protected.
- Default to basic authentication when certificate authentication for the HTTPS client fails.
- WAS challenges the web client for a user ID and password when the required HTTPS client certificate authentication fails.
The enterprise bean authentication is performed by the EJB authentication module. The EJB authentication module resides in the CSIv2 and SAS layer.
The authentication module is implemented using the JAAS login module. Both the web authenticator and the EJB authenticator pass the authentication data to the login module, which can use the following mechanisms to authenticate the data:
- Kerberos
- LTPA
- RSA token
- SWAM (deprecated)
The authentication module uses the registry configured on the system to perform the authentication. Four types of registries are supported:
- Federated repositories
- Local operating system
- Stand-alone LDAP registry
- Stand-alone custom registry
External registry implementation following the registry interface specified by IBM can replace either the local operating system or the LDAP registry.
The login module creates a JAAS subject after authentication and stores the credential derived from the authentication data in the public credentials list of the subject. The credential is returned to the web authenticator or to the enterprise beans authenticator.
The web authenticator and the enterprise beans authenticator store the received credentials in the Object Request Broker (ORB) current for the authorization service to use in performing further access control checks. If the credentials are forwardable, they are sent to other application servers.
Configure authentication mechanisms
- Click...
Security > Global security > Authentication mechanisms and expiration > authentication mechanism
Subtopics
- LTPA
- Configure LTPA and working with keys
- Kerberos (KRB5) authentication mechanism support for security
- Set up Kerberos as the authentication mechanism for WAS
- RSA token authentication mechanism
- Configure the RSA token authentication mechanism
- Simple WebSphere authentication mechanism (deprecated)
- Message layer authentication
Configure Kerberos as the authentication mechanism Configure a Java client for Kerberos authentication Authenticating users Web authentication settings