About Authentication and Authorization
Authenticationand authorization are central concepts of application server security. The
followingtopics are discussed related to authentication and authorization:
■“AuthenticatingEntities” on page 102
■“AuthorizingUsers” on page 103
■“SpecifyingJACC Providers” on page 103
■“AuditingAuthentication and AuthorizationDecisions” on page 103
■“ConguringMessage Security” on page 104

AuthenticatingEntities

Authenticationis the way an entity (a user, an application, or a component) determines that
anotherentity is who it claims to be. An entity uses security credentials to authenticate itself.
Thecredentials may be a user name and password, a digital certicate, or something else.
Typically,authentication means a user logging in to an application with a user name and
password;but it might also refer to an EJB providing security credentials when it requests a
resourcefrom the server. Usually, servers or applications require clients to authenticate;
additionally,clients can require servers to authenticate themselves, too. When authentication is
bidirectional,it is called mutual authentication.
Whenan entity tries to access a protected resource, the Enterprise Server uses the
authenticationmechanism congured for that resource to determine whether to grant access.
Forexample, a user can enter a user name and password in a Web browser, and if the
applicationveries those credentials, the user is authenticated. The user is associated with this
authenticatedsecurity identity for the remainder of the session.
TheEnterprise Server supports four types of authentication. An application species the type of
authenticationit uses within its deployment descriptors.
TABLE9–1 EnterpriseServer AuthenticationMethods
AuthenticationMethod CommunicationProtocol Description UserCredential
Encryption
BASIC HTTP(SSL optional) Usesthe server's built-in pop-up
logindialog box.
None,unless using SSL.
FORM HTTP(SSL optional) Applicationprovidesits own
customlogin and error pages.
None,unless using SSL.
CLIENT-CERT HTTPS(HTTP over SSL) Serverauthenticates the client using
apublic key certicate.
SSL
AboutAuthenticationand Authorization
SunGlassFishEnterprise Ser ver2.1 Administration Guide •December 2008102