type=page
status=published
title=Securing Enterprise Information Systems Applications
next=security-advanced007.html
prev=security-advanced005.html
~~~~~~
Securing Enterprise Information Systems Applications
====================================================

[[GLIFD]]

[[securing-enterprise-information-systems-applications]]
Securing Enterprise Information Systems Applications
----------------------------------------------------

In Enterprise Information Systems (EIS) applications, components request
a connection to an EIS resource.

The following topics are addressed here:

* link:#BABBJHIC[Overview of Securing Enterprise Information Systems
Applications]
* link:#GLIHL[Container-Managed Sign-On]
* link:#GLIDP[Component-Managed Sign-On]
* link:#GLIGS[Configuring Resource Adapter Security]
* link:#GLIGW[Mapping an Application Principal to EIS Principals]

[[BABBJHIC]]

[[overview-of-securing-enterprise-information-systems-applications]]
Overview of Securing Enterprise Information Systems Applications
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

As part of this connection, the EIS can require a sign-on for the
requester to access the resource. The application component provider has
two choices for the design of the EIS sign-on.

* Container-managed sign-on: The application component lets the
container take the responsibility of configuring and managing the EIS
sign-on. The container determines the user name and password for
establishing a connection to an EIS instance.
* Component-managed sign-on: The application component code manages EIS
sign-on by including code that performs the sign-on process to an EIS.

You can also configure security for resource adapters. See
link:#GLIGS[Configuring Resource Adapter Security].

[[GLIHL]]

[[container-managed-sign-on]]
Container-Managed Sign-On
~~~~~~~~~~~~~~~~~~~~~~~~~

In container-managed sign-on, an application component does not have to
pass any sign-on security information to the `getConnection()` method.
The security information is supplied by the container, as shown in the
following example (the method call is highlighted in bold):

[source,oac_no_warn]
----
// Business method in an application component
Context initctx = new InitialContext();
// Perform JNDI lookup to obtain a connection factory
javax.resource.cci.ConnectionFactory cxf =
    (javax.resource.cci.ConnectionFactory)initctx.lookup(
    "java:comp/env/eis/MainframeCxFactory");
// Invoke factory to obtain a connection. The security
// information is not passed in the getConnection method
javax.resource.cci.Connection cx = cxf.getConnection();
...
----

[[GLIDP]]

[[component-managed-sign-on]]
Component-Managed Sign-On
~~~~~~~~~~~~~~~~~~~~~~~~~

In component-managed sign-on, an application component is responsible
for passing the needed sign-on security information for the resource to
the `getConnection` method. For example, security information might be a
user name and password, as shown here (the method call is highlighted in
bold):

[source,oac_no_warn]
----
// Method in an application component
Context initctx = new InitialContext();

// Perform JNDI lookup to obtain a connection factory
javax.resource.cci.ConnectionFactory cxf =
    (javax.resource.cci.ConnectionFactory)initctx.lookup(
    "java:comp/env/eis/MainframeCxFactory");

// Get a new ConnectionSpec
com.myeis.ConnectionSpecImpl properties = //..

// Invoke factory to obtain a connection
properties.setUserName("...");
properties.setPassword("...");
javax.resource.cci.Connection cx =
    cxf.getConnection(properties);
...
----

[[GLIGS]]

[[configuring-resource-adapter-security]]
Configuring Resource Adapter Security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A resource adapter is a system-level software component that typically
implements network connectivity to an external resource manager. A
resource adapter can extend the functionality of the Java EE platform
either by implementing one of the Java EE standard service APIs, such as
a JDBC driver, or by defining and implementing a resource adapter for a
connector to an external application system. Resource adapters can also
provide services that are entirely local, perhaps interacting with
native resources. Resource adapters interface with the Java EE platform
through the Java EE service provider interfaces (Java EE SPI). A
resource adapter that uses the Java EE SPIs to attach to the Java EE
platform will be able to work with all Java EE products.

To configure the security settings for a resource adapter, you need to
edit the resource adapter descriptor file, `ra.xml`. Here is an example
of the part of an `ra.xml` file that configures security properties for
a resource adapter:

[source,oac_no_warn]
----
<authentication-mechanism>
    <authentication-mechanism-type>
        BasicPassword
    </authentication-mechanism-type>
    <credential-interface>
        javax.resource.spi.security.PasswordCredential
    </credential-interface>
</authentication-mechanism>
<reauthentication-support>false</reauthentication-support>
----

You can find out more about the options for configuring resource adapter
security by reviewing `_as-install_/lib/schemas/connector_1_7.xsd`. You
can configure the following elements in the resource adapter deployment
descriptor file.

* Authentication mechanisms: Use the `authentication-mechanism` element
to specify an authentication mechanism supported by the resource
adapter. This support is for the resource adapter, not for the
underlying EIS instance.
+
There are two supported mechanism types:

** `BasicPassword`, which supports the following interface:
+
[source,oac_no_warn]
----
javax.resource.spi.security.PasswordCredential
----

** `Kerbv5`, which supports the following interface:
+
[source,oac_no_warn]
----
javax.resource.spi.security.GenericCredential
----
+
GlassFish Server does not currently support this mechanism type.
* Reauthentication support: Use the `reauthentication-support` element
to specify whether the resource adapter implementation supports
reauthentication of existing `Managed-Connection` instances. Options are
`true` or `false`.
* Security permissions: Use the `security-permission` element to specify
a security permission that is required by the resource adapter code.
Support for security permissions is optional and is not supported in the
current release of GlassFish Server. You can, however, manually update
the `server.policy` file to add the relevant permissions for the
resource adapter.
+
The security permissions listed in the deployment descriptor are
different from those required by the default permission set as specified
in the connector specification.
+
For more information on the implementation of the security permission
specification, see the security policy file documentation listed in
link:security-advanced008.html#BABBGBBF[Further Information about
Advanced Security Topics].

In addition to specifying resource adapter security in the `ra.xml`
file, you can create a security map for a connector connection pool to
map an application principal or a user group to a back-end EIS
principal. The security map is usually used if one or more EIS back-end
principals are used to execute operations (on the EIS) initiated by
various principals or user groups in the application.

[[GLIGW]]

[[mapping-an-application-principal-to-eis-principals]]
Mapping an Application Principal to EIS Principals
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When using GlassFish Server, you can use security maps to map the caller
identity of the application (principal or user group) to a suitable EIS
principal in container-managed transaction-based scenarios. When an
application principal initiates a request to an EIS, GlassFish Server
first checks for an exact principal by using the security map defined
for the connector connection pool to determine the mapped back-end EIS
principal. If there is no exact match, GlassFish Server uses the
wildcard character specification, if any, to determine the mapped
back-end EIS principal. Security maps are used when an application user
needs to execute an EIS operation that requires execution as a specific
identity in the EIS.

To work with security maps, use the Administration Console. From the
Administration Console, follow these steps to get to the security maps
page.

1.  In the navigation tree, expand the Resources node.
2.  Expand the Connectors node.
3.  Select the Connector Connection Pools node.
4.  On the Connector Connection Pools page, click the name of the
connection pool for which you want to create a security map.
5.  Click the Security Maps tab.
6.  Click New to create a new security map for the connection pool.
7.  Enter a name by which you will refer to the security map, as well as
the other required information.
+
Click Help for more information on the individual options.
