Conguring Security
Securityis about protecting data: how to prevent unauthorized access or damage to it in storage
ortransit. The Enterprise Server; has a dynamic, extensible security architecture based on the
JavaEE standard. Built in security features include cryptography, authentication and
authorization,and public key infrastructure. The Enterprise Server is built on the Java security
model,which uses a sandbox where applications can run safely, without potential risk to
systemsor users. The following topics are discussed:
■“UnderstandingApplication and System Security” on page 97
■“Toolsfor Managing Security” on page 98
■“ManagingSecurity of Passwords” on page 99
■“AboutAuthentication and Authorization” on page 102
■“UnderstandingUsers, Groups, Roles, and Realms” on page 104
■“Introductionto Certicates and SSL”on page 108
■“AboutFirewalls” on page 111
■“AboutCerticate Files” on page 111
■“UsingJava Secure Socket Extension (JSSE) Tools” on page 112
■“UsingNetwork Security Services (NSS) Tools” on page 116
■“UsingHardware Crypto Accelerator With Enterprise Server” on page 120

Understanding Application and SystemSecurity

Broadly,there are two kinds of application security:
■Inprogrammatic security, application code written by the developer handles security chores.
Asan administrator, you don't have any control over this mechanism. Generally,
programmaticsecurity is discouraged since it hard-codes security congurations in the
applicationinstead of managing it through the Java EE containers.
9
CHAPTER 9
97