|
|
 |
| e-docs > Tuxedo > Using the Tuxedo TOP END Domain Gateway with ATMI Applications > Security Programming |
|
Using the Tuxedo TOP END Domain Gateway with ATMI Applications
|
Security Programming
This topic includes the following sections:
How the TEDG Supports Security
Both the BEA TOP END and BEA Tuxedo systems offer integrated security services. The TEDG works with both sets of services. Authentication of client applications is the responsibility of the local system and is performed in the same way for all configurations, regardless of whether the TEDG is included.
The only consideration to keep in mind when programming security for a configuration that includes a TEDG is that different functions are used in the BEA Tuxedo and BEA TOP END systems to specify client identifiers and passwords to the local programming interfaces. In BEA Tuxedo code, this task is done through the tpinit(3c) function; in BEA TOP END code, through the tp_client_signon(3T), tp_rtq_signon(3T), and tp_rtq_put(3T) calls. In a BEA Tuxedo application, one ID is used for a client program; in a BEA TOP END application, a separate client ID is associated with each dialog. For an administrator's view of security administration on TEDG-based configurations, refer to Configuring Security Between BEA TOP END and BEA Tuxedo Systems.
See Also
How BEA Tuxedo Client Requests Are Authorized
Authorization of client requests is based on each system's local mechanisms. The TEDG configuration and the names used for mapping requests are used in these authorization schemes. A BEA Tuxedo client request to a service name offered by the TEDG (DM_REMOTE_SERVICES) is subjected to standard BEA Tuxedo authorization by the TEDG in the same way that each server in a secure system is authorized. The TEDG then forwards the request to the BEA TOP END system, along with the local domain DOMAINID as the BEA TOP END client user ID. This request is not subjected to further security because the administrator has connected the BEA Tuxedo and BEA TOP END systems in a trusted relationship. When enqueuing requests to a BEA TOP END RTQ queue in a secure BEA TOP END system, the TEDG provides its local domain DOMAINID as the BEA TOP END client ID and its configured password (refer to the dmadmin topendpasswd command) as part of the request so that those client credentials can be used by RTQ when it dequeues the request and schedules shipment of it to a server.
See Also
How to Establish Security for BEA TOP END Services/RTQ Queues
To secure a BEA TOP END service or RTQ queue offered by the TEDG, you must secure the BEA Tuxedo service (SERVICE or QSPACE) name assigned by the TEDG configuration using BEA Tuxedo security tools. To secure a BEA TOP END service that will receive requests from a BEA Tuxedo system through the TEDG using RTQ, secure the BEA TOP END product/function for that service using BEA TOP END security tools and authorize the TEDG local domain ID to access it.
How BEA TOP END Client Requests Are Authorized
A BEA TOP END client request to a product/function or RTQ group/queue offered by the TEDG (DM_LOCAL_SERVICES) is subjected to the standard BEA TOP END authorization by the BEA TOP END client's system. The TEDG then subjects it to an optional access check based on the ACL parameter and the remote domain DOMAINID as configured in the DMCONFIG file. It then forwards the request to the BEA Tuxedo system along with the remote domain identifier of the BEA TOP END node as the client ID. Depending on the BEA Tuxedo security level (that is, if ACL and MANDATORY_ACL are being used), this request is then subjected to BEA Tuxedo authorization that takes place in the server application. Security associated with the dequeuing or forwarding of messages from a BEA Tuxedo /Q is unaffected by the TEDG.
How to Establish Security for BEA Tuxedo Services/Queue Spaces
To establish security for a BEA Tuxedo service or queue space that will receive requests from a BEA TOP END system through the TEDG, use BEA Tuxedo security tools and authorize the BEA Tuxedo remote domain DOMAINID(s) to access the service or queue space. Follow this procedure for systems in which security is provided by the ACL or MANDATORY_ACL method. Use BEA TOP END security tools to authorize the BEA TOP END client to access:
How Security Is Provided for the TEDG Network Connection
The TEDG network connection to the BEA TOP END system is the final element of end-to-end security with the TEDG. If security is configured in the BEA TOP END system, this connection is authenticated based on the BEA TOP END internode security protocol and the credentials installed for the system in the srvtab file. Additionally, based on the configuration level of the TEDG and the BEA TOP END system, link-level encryption is provided for messages passed through the link based on the BEA TOP END internode security protocol. BEA Tuxedo link encryption protocols are not used for the TEDG.
See Also
|
|
|
|
||
 |
|
|
 |
 |
 |
|
||
