ConguringMessage Security

MessageSecurity enables a server to perform end-to-end authentication of web service
invocationsand responses at the message layer. The Enterprise Server implements message
securityusing message security providers on the SOAP layer. The message security providers
provideinformation such as the type of authentication that is required for the request and
responsemessages. The types of authentication that are supported include the following:
■Senderauthentication, including username-password authentication.
■Contentauthentication, including XML Digital Signatures.
Twomessage security providers are included with this release. The message security providers
canbe congured for authentication for the SOAP layer. The providers that can be congured
includeClientProvider and ServerProvider.
Supportfor message layer security is integrated into the Enterprise Server and its client
containersin the form of (pluggable) authentication modules. By default, message layer security
isdisabled on the Enterprise Server.
Messagelevel security can be congured for the entire Enterprise Server or for specic
applicationsor methods. Conguring message security at the Enterprise Server level is
discussedin Chapter 10, “Conguring Message Security.”Conguring message security at the
applicationlevel is discussed in the Developer's Guide.
Understanding Users,Groups, Roles, and Realms
TheEnterprise Server enforces its authentication and authorization policies upon the following
entities:
■“Users”on page 105: An individual identity dened in the Enterprise Server. In general, a user
isa person, a software component such as an enterprise bean, or even a service. A user who
hasbeen authenticated is sometimes called a principal. Users are sometimes referred to as
subjects.
■“Groups”on page 105: A set of users dened in the Enterprise Server, classied by common
traits.
■“Roles”on page 106: A named authorization level dened by an application. A role can be
comparedto a key that opens a lock. Many people might have a copy of the key. The lock
doesn'tcare who seeks access, only that the right key is used.
■“Realms”on page 106: A repository containing user and group information and their
associatedsecurity credentials. A realm is also called a security policy domain.
UnderstandingUsers,Groups, Roles, and Realms
SunGlassFishEnterprise Ser ver2.1 Administration Guide • December 2008104