What is new for security specialists

This topic highlights what is new or changed in Version 6 for users who are responsible for securing applications and the application serving environment.

New The biggest improvement in security involves the set of supported specifications.

External JACC provider support
The Java Authorization Contract for Containers specification (JACC) version 1.0, introduced in WebSphere Application Server Version 6 and defined by Java 2 Platform, Enterprise Edition (J2EE) Version 1.4, defines a contract between J2EE containers and external authorization providers. Based on this specification, WebSphere Application Server enables you to plug in an external provider to make authorization decisions when you are accessing a J2EE resource. When you use this feature, WebSphere Application Server supports Tivoli Access Manager as the default JACC provider.
For more information, see JACC providers.

Java 2 security manager
WebSphere Application Server Version 6 provides you with greater control over the permission granted to applications for manipulating non-system threads. You can permit applications to manipulate non-system threads using the was.policy file. However, these thread control permissions are disabled, by default.
For more information, see Configure_the_was.policy_file.html.

JCA 1.5 support
WebSphere Application Server Version 6 supports the J2EE Connector Architecture (JCA) Version 1.5 specification, which provides new features such as the inbound resource adapter. For more information, see J2EE Connector Architecture resource adapters.
From a security perspective, Version 6 provides an enhanced custom principal and credential programming interface and custom mapping properties at the resource reference level. The custom JAAS LoginModule, which was developed for JCA principal and credential mapping for WebSphere Application Server Version 5.x, continues to be supported.

SSL channel framework
The Secure Sockets Layer channel framework incorporates the new IBMJSSE2 implementation and separates the security function of Java Secure Sockets Extension (JSSE) from the network communication function.

Web authentication using the Java Authentication and Authorization Service programming model
WebSphere Application Server Version 6 enables you to use the Java Authentication and Authorization Service (JAAS) programming model to perform Web authentication in your application code. To use this function, create your own JAAS login configuration by cloning the WEB_INBOUND login configuration and define a cookie=true login option. After a successful login using your login configuration, the Web login session is tracked by
single signon (SSO) token cookies. This option replaces the SSOAuthenticator interface, which was deprecated in WebSphere Application Server Version 4.
For more information, see Java Authentication and Authorization Service authorization.

Web services security
WebSphere Application Server Version 6 increases the extensibility of Web services security by providing a pluggable architecture. The implementation in WebSphere Application Server includes many of the features described in the Organization for the Advancement of Structured Information Standards (OASIS) Web Services Security Version 1 standard. As part of this standard, WebSphere Application Server supports custom, pluggable tokens that are used for signing and encryption; pluggable signing and encryption algorithms; pluggable key locators for locating a key that is used for digital signature or encryption; signing or encrypting elements in a Simple Object Access Protocol (SOAP) message; and specifying the order of the signing or encryption processes.

Searchable topic ID: welc_newsecurity

External JACC provider support	The Java Authorization Contract for Containers specification (JACC) version 1.0, introduced in WebSphere Application Server Version 6 and defined by Java 2 Platform, Enterprise Edition (J2EE) Version 1.4, defines a contract between J2EE containers and external authorization providers. Based on this specification, WebSphere Application Server enables you to plug in an external provider to make authorization decisions when you are accessing a J2EE resource. When you use this feature, WebSphere Application Server supports Tivoli Access Manager as the default JACC provider. For more information, see JACC providers.

Java 2 security manager	WebSphere Application Server Version 6 provides you with greater control over the permission granted to applications for manipulating non-system threads. You can permit applications to manipulate non-system threads using the was.policy file. However, these thread control permissions are disabled, by default. For more information, see Configure_the_was.policy_file.html.

JCA 1.5 support	WebSphere Application Server Version 6 supports the J2EE Connector Architecture (JCA) Version 1.5 specification, which provides new features such as the inbound resource adapter. For more information, see J2EE Connector Architecture resource adapters. From a security perspective, Version 6 provides an enhanced custom principal and credential programming interface and custom mapping properties at the resource reference level. The custom JAAS LoginModule, which was developed for JCA principal and credential mapping for WebSphere Application Server Version 5.x, continues to be supported.

SSL channel framework	The Secure Sockets Layer channel framework incorporates the new IBMJSSE2 implementation and separates the security function of Java Secure Sockets Extension (JSSE) from the network communication function.

Web authentication using the Java Authentication and Authorization Service programming model	WebSphere Application Server Version 6 enables you to use the Java Authentication and Authorization Service (JAAS) programming model to perform Web authentication in your application code. To use this function, create your own JAAS login configuration by cloning the WEB_INBOUND login configuration and define a cookie=true login option. After a successful login using your login configuration, the Web login session is tracked by single signon (SSO) token cookies. This option replaces the SSOAuthenticator interface, which was deprecated in WebSphere Application Server Version 4. For more information, see Java Authentication and Authorization Service authorization.

Web services security	WebSphere Application Server Version 6 increases the extensibility of Web services security by providing a pluggable architecture. The implementation in WebSphere Application Server includes many of the features described in the Organization for the Advancement of Structured Information Standards (OASIS) Web Services Security Version 1 standard. As part of this standard, WebSphere Application Server supports custom, pluggable tokens that are used for signing and encryption; pluggable signing and encryption algorithms; pluggable key locators for locating a key that is used for digital signature or encryption; signing or encrypting elements in a Simple Object Access Protocol (SOAP) message; and specifying the order of the signing or encryption processes.