test

Sun Java System Web Server 7.0 Developer's Guide to Java Web Applications

Web Server Security Model

Secure applications require a client to be authenticated as a valid application user and have authorization to access servlets and JSPs.

Applications with a secure web container may enforce the following security processes for clients:

Authentication is the process of confirming an identity. Authorization means granting access to a restricted resource to an identity. Access control mechanisms enforce these restrictions. Authentication and authorization can be enforced by a number of security models and services.

Sun Java System Web Server 7.0 provides authentication and authorization support through the following mechanisms, which are discussed in this section:

Whether performed by the ACL subsystem or the Java EE/Servlet authentication subsystem, authentication and authorization are still the two fundamental operations that define secure web content.

ACL-Based Authentication and Authorization

ACL-based access control is described at length in the Configuring Access Control in Sun Java System Web Server 7.0 Administrator’s Guide. This section provides a brief overview of the key concepts.

Sun Java System Web Server 7.0 supports authentication and authorization through the use of locally stored ACLs, which describe what access rights a user has for a resource. For example, an entry in an ACL can grant a user named John read permission to a particular folder named misc:


acl "path=/export/user/990628.1/docs/misc/";
  authenticate (user,group) {
      database = "default";
      method = "basic";
   };
   deny (all)
  (user = "John");
   allow (read);

The core ACLs in Sun Java System Web Server 7.0 support three types of authentication: basic, certificate, and digest.

Basic authentication relies .

The ACL-based access control model includes the following features:

In addition, the Sun Java System Web Server 7.0 SSL engine supports external crypto hardware to offload SSL processing and to provide optional tamper-resistant key storage.

For more information about ACL-based access control and the use of external crypto hardware, see the Sun Java System Web Server 7.0 Administrator’s Guide.

Java EE/Servlet-Based Authentication and Authorization

, In addition to providing ACL-based authentication, Sun Java System Web Server 7.0 also implements the security model defined in the Java EE 1.4 specification to provide several features that help you develop and deploy secure Java web applications.

A typical Java EE-based web application consists of the following parts, access to any or all of which can be restricted:

The Java EE servlet-based access control infrastructure relies on the use of security realms. When a user tries to access the main page of an application through a web browser, the web container prompts for the user's credential information. The container then passes the information for verification to the realm that is currently active in the security service.

A realm, represents a set of known users along with optional group membership information. The main implementation also encapsulates a mechanism for performing authentication against the data set.

The main features of the Java EE/Servlet-based access control model are described below: