Setting Up Security in Domains


	BEA Home \| Events \| Solutions \| Partners \| Products \| Services \| Download \| Developer Center \| WebSUPPORT
	http://www.oracle.com/technology/documentation/index.html \| Site Map \| Search \| PDF Files \| Contact \| Glossary

Tuxedo Documentation \| Using the BEA Tuxedo Domains Component \| Local Topics \| Previous Topic \| Next Topic \| Contents

The BEA Tuxedo ATMI environment provides the following application security mechanisms:

Authentication—proves the stated identity of users or system processes; safely remembers and transports identity information; and makes identity information available when needed. The default authentication plug-in provides security at three levels: no authentication (NONE), application password (AP_PW), and user-level authentication (USER_AUTH).
Authorization—controls access to resources based on identity or other information. The default authorization plug-in provides security at two levels: optional access control lists (ACL) and mandatory access control lists (MANDATORY_ACL).
Auditing—safely collects, stores, and distributes information about operating requests and their outcomes. Default auditing security is implemented by the BEA Tuxedo EventBroker and userlog (ULOG) features.
Encryption—security mechanisms to convert data to coded format that is unintelligible to users. The default encryption is RC4 symmetric key encryption.
Security Plug-in Interface—allows installation of third-party security systems such as custom authentication, authorization, and auditing. The plug-in interface is available to applications running BEA Tuxedo release 7.1 or later software. For information on setting up security in domains using the security plug-in interface, see Establishing a Link Between Domains in Using Security in ATMI Applications.

Impact of BEA Tuxedo Application Security on Domains Security

The BEA Tuxedo security mechanisms provided for individual applications and those provided for Domains configurations are relatively independent but compatible:

The BEA Tuxedo ATMI environment provides the following security mechanisms for Domains configurations:
If BEA Tuxedo application security is set to USER_AUTH or above, and the ACL_POLICY and CREDENTIAL_POLICY parameters are set to GLOBAL in the DM_REMOTE_DOMAINS section of the DMCONFIG, then user IDs flow across domains with requests. ACL checking is performed on the user IDs.
If BEA Tuxedo application security is set to USER_AUTH or above, and the ACL_POLICY and CREDENTIAL_POLICY parameters are set to LOCAL in the DM_REMOTE_DOMAINS section of the DMCONFIG, then user IDs do not flow across domains with requests. ACL checking is handled via the Domain ID of the requesting domain.
Even if you assign a security level of NONE to your BEA Tuxedo application, you can still set the Domains connection security to DM_PW. Note, however, that in order to use an application password in a Domains configuration, you must have already set a value of APP_PW (or higher: USER_AUTH, ACL, or MANDATORY_ACL) for the security level in each participating application.

Domains Security Mechanisms

Because distinct domains may exist under different ownership, the native BEA Tuxedo application password scheme may not, of itself, provide sufficient security. Domains, therefore, provides additional security mechanisms:

Access Control Lists—restricts availability of resources in a local domain to a list of selected remote domains. You configure this security level in the DM_ACCESS_CONTROL section of DMCONFIG.
Domains Authentication—techniques are required to ensure the proper identity of each remote domain. Domains provides three levels of password security: NONE specifies no authentication; APP_PW is authentication using the application password, which must match on the two domains; and DM_PW, which is authentication using specific passwords per local/remote domain pair. Each of these is selected by setting the SECURITY parameter in the DM_LOCAL_DOMAINS section for the local domain access point involved to the required level (NONE, APP_PW, DM_PW).
Link-Level Encryption—you can use encryption across domains to ensure data privacy. In this way, a network-based eavesdropper cannot learn the content of BEA Tuxedo messages or application-generated messages flowing from one domain gateway to another. You configure this security mechanism by setting the MINENCRYPTBITS and MAXENCRYPTBITS parameters in the DMCONFIG file.
Local Domains Access—restricts local services to remote domains. If a service is not exported to remote domains, it is simply unavailable to them. A service is exported by placing an entry in the DM_LOCAL_SERVICES section of the DMCONFIG file for the service.
User Identity Mapping to Mainframes—provides a mechanism whereby user identities within a domain can be mapped to and from external user identities. This mechanism is currently used by BEA eLink for Mainframe-SNA to map to and from RACF (remote access control facility) user names on IBM LU6.2 mainframes. To use this mechanism, refer to the following dmadmin configuration commands: