TABLE9–1 EnterpriseServer Authentication Methods (Continued)
DIGEST HTTPand SIP Serverauthenticates the client based
onan encrypted response.
SSLand TLS

VerifyingSingle Sign-On

Singlesign-on enables multiple applications in one virtual server instance to share the user
authenticationstate. With single sign-on, a user who logs in to one application becomes
implicitlylogged in to other applications that require the same authentication information.
Singlesign-on is based on groups. All Web applications whose deployment descriptor denes
thesame group and use the same authentication method (BASIC, FORM, CLIENT-CERT)
sharesingle sign-on.
Singlesign-on is enabled by default for virtual servers dened for the Enterprise Server.
AuthorizingUsers
Oncea user is authenticated, the level of authorization determines what operations can be
performed.A user's authorization is based on his role. For example, a human resources
applicationmay authorize managers to view personal employee information for all employees,
butallow employees to view only their own personal information. For more on roles, see
“UnderstandingUsers, Groups, Roles, and Realms” on page 104.
Specifying JACCProviders
JACC(Java Authorization Contract for Containers) is part of the Java EE specication that
denesan interface for pluggable authorization providers. This enables the administrator to set
upthird-party plug-in modules to perform authorization.
Bydefault, the Enterprise Server provides a simple, le-based authorization engine that
complieswith the JACC specication. It is also possible to specify additional third-party JACC
providers.
JACCproviders use the Java Authenticationand Authorization Service (JAAS) APIs. JAAS
enablesservices to authenticate and enforce access controls upon users. It implements a Java
technologyversion of the standard Pluggable Authentication Module (PAM)framework.
AuditingAuthentication and Authorization Decisions
TheEnterprise Server can provide an audit trail of all authentication and authorization
decisionsthrough audit modules. The Enterprise Server provides a default audit module, as well
asthe ability to customize the audit modules.
AboutAuthenticationand Authorization
Chapter9 • Conguring Security 103