Skip navigation.
Downloads | Product Documentation | Support

Programming Security For Java Applications

# Overview of the Java Security Service Module

The following sections describes audience of this document and provides an overview of the BEA WebLogic Enterprise Java Security Service Module:

- About this Document
- Introduction to the Java Security Service Module

# About this Document

This section covers the following topics:

- Audience for This Guide
- Prerequisites for This Guide
- Product Documentation on the dev2dev Web Site
- Related Information
- Contact Us!

## Audience for This Guide

This document is intended for the following audiences:

- Application Developers—Developers who are Java programmers who focus on developing Java applications, incorporating security into Java applications and Enterprise JavaBeans (EJBs), and who work with other engineering, quality assurance (QA), and database teams to implement security features. Application Developers have in-depth working knowledge of Java (including J2EE components such as servlets/JSPs and JSEE).
- Security Architects—Individuals who are responsible for designing and implementing the overall security architecture for their organization, evaluating BEA WebLogic Enterprise Security features, and determining how to best implement policies. Security Architects have in-depth knowledge of Java programming, Java security, and network security, as well as knowledge of security systems and leading-edge security technologies and tools.
- Security Developers—Developers (including third-party developers) who focus on defining the system architecture and infrastructure for security products and who develop custom security providers for use with BEA WebLogic Enterprise Security services. Security Developers work with Security Architects to ensure that the architecture is implemented according to design specifications and that it does not introduce any security holes. Security Developers also work with administrators to ensure that security is properly configured. Security Developers have a solid understanding of certain concepts, including authentication, authorization, and auditing, and an in-depth knowledge of Java and security provider functionality.

## Prerequisites for This Guide

Prior to reading this guide, you should read the Introduction to BEA WebLogic Enterprise Security. This document describes how the product works and provides conceptual information that is helpful to understanding the necessary installation components.

Additionally, BEA WebLogic Enterprise Security includes many unique terms and concepts that you need to understand. These terms and concepts—which you will encounter throughout the documentation—are defined in the Glossary.

## How this Document is Organized

This document is intended for application developers who are moderate to advanced Java programmers, familiar with the specifics of enterprise security. Wherever possible, through documentation and examples, BEA tries to set examples as to proper use of this product in order to maintain a secure application. BEA, however, assumes no responsibility for the results of improper use of this product or the damage to your business that may result. Security is never only about technology, but attention to detail and proper security policy.

The document describes the Java Security Service Module product, the concepts that must be understood to use it, the application programming interfaces (APIs), and the programming procedures you use to develop secure Java applications.

This document is organized as follows:

- Chapter 1, this chapter, introduces the Java Security Service Module product and describes its components.
- Java Security Service Module Concepts,describes Java Security Service Module concepts as they relate to BEA WebLogic Enterprise Security.
- Naming Authority, describes naming authorities in the context of the Java Security Service Module.
- Java Security Service Module APIs,describes the APIs that you use to develop Java applications using the Java Security Service Module.
- Developing Applications Using the Java Security Service Module,provides step-by-step procedures for developing Java applications. The procedures include code fragments that demonstrate how to implement each programming step.

## Product Documentation on the dev2dev Web Site

BEA product documentation, along with other information about BEA software, is available from the BEA dev2dev web site:

http://dev2dev.bea.com

To view the documentation for a particular product, select that product from the Product Centers menu on the left side of the screen on the dev2dev page. Select More Product Centers. From the BEA Products list, choose WebLogic Enterprise Security 4.2. The home page for this product is displayed. From the Resources menu, choose Documentation 4.2. The home page for the complete documentation set for the product and release you have selected is displayed.

## Related Information

The BEA corporate web site provides all documentation for BEA WebLogic Enterprise Security. Other BEA WebLogic Enterprise Security documents that may be of interest to the reader include:

- Programming Security for Java Applications—The document describes how to implement security in Java applications. It include descriptions of the Security Service Application Programming Interfaces and programming instructions for implementing security in Java applications.
- BEA WebLogic Enterprise Security Administration Guide—This document provides a complete overview of the product and includes step-by-step instructions on how to perform various administrative tasks.
- Developing Security Providers for BEA WebLogic Enterprise Security —This document provides security vendors and security and application developers with the information needed to develop custom security providers.
- BEA WebLogic Enterprise Security Policy Managers Guide—This document defines the policy model used by BEA WebLogic Enterprise Security, and describes how to import and export policy data.
- Javadocs for Java API—This document provides reference documentation for the Java Application Programming Interfaces that are provided with and supported by this release of BEA WebLogic Enterprise Security.
- Java Installation—This document describes how to install Java Security Service Module.
- Javadocs for Security Service Provider Interfaces—This document provides reference documentation for the Security Service Provider Interfaces that are provided with and supported by this release of BEA WebLogic Enterprise Security.

## Contact Us!

Your feedback on BEA documentation is important to us. Send us e-mail at docsupport@bea.com if you have questions or comments. Your comments will be reviewed directly by the BEA professionals who create and update the documentation.

In your e-mail message, please indicate the software name and version you are using, as well as the title and date of your documentation. If you have any questions about this version of BEA WebLogic Enterprise Security, or if you have problems installing and running BEA WebLogic Enterprise Security products, contact BEA Customer Support through BEA WebSupport at http://www.bea.com. You can also contact Customer Support by using the contact information provided on the Customer Support Card, which is included in the product package.

When contacting Customer Support, be prepared to provide the following information:

- Your name, e-mail address, phone number, and fax number
- Your company name and company address
- Your machine type and authorization codes
- The name and version of the product you are using
- A description of the problem and the content of pertinent error messages

# Introduction to the Java Security Service Module

The Java Security Service Module is a java-based product that allows an application developer to access sets of interfaces to define and implement security related information and requirements specific to a Java application. These interfaces support the most commonly required security functions and are organized into services that are logically grouped by functionality.

After you use the Java Security Service Module interfaces to implement security functions in your Java application, you can deploy and run your application on any instance of a Java Security Service Module runtime that supports the configuration requirements of your application.

The Java Security Service Module offers five security services: Authentication Service, Authorization Service, Auditing Service, Role Service, and Credential Mapping Service. The name of each service indicates the type of function it is used to implement within a Java application. Each of these services is discussed in more detail later.

Because most major functions required by Java applications developed using the Java Security Service Module are performed within the security framework, this architecture has several benefits, including:

- Application uptime is maximized—Because the Java Security Service Module runs in-process with your application, your application is tightly coupled with its security system. If the application is running, the security system is running as well. Even if providers are designed to use external resources (such as an LDAP server), the Security Service Module is designed to continue operating and to fail securely if that remote resource becomes unavailable for any reason.
- On-the-wire security is enhanced—Because security information is provisioned into the Security Service Module on the same machine as the Java application, the Security Service Module does not need to fetch this information from the network. This prevents unscrupulous programs from listening in on these security-related conversations to determine vulnerability.
- Performance is improved—Another aspect of having security and policy data loaded locally is that the Security Service Module can more quickly retrieve policy information, resulting in improved performance. The locality of security metadata combined with the in-process nature of the Security Service Module allow for a very fast evaluation of security questions.

The following topics provide more information on the Java Security Service Module:

- Java Security Service Module Environment on page 1-6
- Java Security Service Module Functional Description on page 1-7

## Java Security Service Module Environment

Figure 1-1 shows the major components that make up the Security Service Module environment.

Figure 1-1 BEA WebLogic Enterprise Security Service Modules

- Administration Application

The Administration Application allows you to manage and configure multiple Security Service Modules. While Security Service Modules specify and consume configuration data and then services security requests accordingly, the Administration Application allows you to display the security providers that are plugged into the security framework and to display and modify the configuration data for those providers.

- Service Control Manager

The Service Control Manager (SCM) is an essential component of the BEA WebLogic Enterprise Security configuration provisioning mechanism and of a fully-distributed security enforcement architecture. An Service Control Manager is a machine agent that exposes a provisioning interface to the Administration Application to facilitate the management of a potentially large number of distributed Security Service Modules. A Service Control Manager can receive and store metadata updates, both full and incremental, initiated by the Administration Application.

The Administration Application uses the provisioning mechanism of the Service Control Manager to distribute configuration and policy data to each Security Service Module where it is consumed locally (see Figure 1-2). Security Service Modules (which can be distributed throughout an enterprise) can be embedded in Java applications, application servers, and web servers. After you use the Administration Application to configure an instance of an Security Service Module with configuration and policy data, the Security Service Module does not require any additional communication with the Service Control Manager to perform security functions. However, the Service Control Manager maintains communication with the Security Service Module to distribute full and incremental updates.

Figure 1-2 Deploying Configuration and Policy Data to Security Service Modules

## Java Security Service Module Functional Description

Figure 1-3 shows the major components of the Java Security Service Module. The Java Security Service Module comprises the security service APIs, the security framework, and the security providers that you configure in any given instance of a Java Security Service Module runtime.

The following topics describe these components:

- Security Service APIs on page 1-8.
- Security Framework on page 1-9
- Security Providers on page 1-9

Figure 1-3 BEA WebLogic Enterprise Security Java Security Service Module Components

### Security Service APIs

The Java Security Service Module supports the following security service APIs:

- Authentication Service on page 1-8.
- Authorization Service on page 1-9.
- Auditing Service on page 1-9.
- Role Service on page 1-9.
- Credential Mapping Service on page 1-9.

#### Authentication Service

The Authentication Service provides functions to an application related to establishing, verifying, and transferring a person or a process. Thus, the Authentication Service provides two main functions: authentication and identity assertion.

#### Authorization Service

The Authorization Service is a service that allows an application to determine if a specific identity is permitted to access a specific resource. This decision may then be enforced in the application directly at the policy enforcement point.

#### Auditing Service

The Auditing Service allows an application to log events based upon activity related to enterprise security. The Java Security Service Module runtime uses these mechanisms to log appropriate data when events occur.

#### Role Service

The Role Service allows an application to extract role information about specific identities and resources within the context of the application. These roles may then be used to customize interfaces.

Note: Roles themselves should not be used for authorization, as many policies allowing or disallowing access to a resource may be written against a role. It is best that you use the Authorization Service to determine actual rights.

#### Credential Mapping Service

The Credential Mapping Service allows an application to fetch credentials of certain types that are associated with a specific identity for a specific resource. These credentials may then be used on behalf of that identity to provide some privileged function, such as logging into a database or sending e-mail.

### Security Framework

The primary function of the Security Framework is to provide an application programming interface (API) that security and application developers use to implement security functions in Java applications. Within that context, the Security Framework also acts as an intermediary between security functions that you implement in Java applications using the Java security service APIs and security providers configured into the Java Security Service Module. For more information on the Security Framework, see Introduction to BEA WebLogic Enterprise Security.

### Security Providers

When you install the Java Security Service Module, a JAR file is deployed that contains all the default security providers that ship with the product. However, before any of the security providers can be used, you must use the Administration Application to configure them in the Java Security Service Module. You have the option of configuring either the default security providers that ship with the product or custom security providers, which you develop or purchase from third-party security vendors. The Java Security Service Module supports the following types of security providers:

- Authentication provider
- Authorization provider
- Auditing provider
- Credential mapping provider
- Identity asserter
- Principal validator
- Role mapping provider

For more information on the security providers, see Introduction to BEA WebLogic Enterprise Security. For information on developing custom security providers, see Developing Security Providers for BEA WebLogic Enterprise Security.