Session security support
Security integration is enabled in the Session Management facility. You cannot mix secured and unsecured resources accessing sessions when security integration is turned on. Security integration in the Session Management facility is not supported in form-based login with SWAM.
Security integration rules for HTTP sessions
Only authenticated users can access sessions created in secured pages and are created under the identity of the authenticated user. Only this authenticated user can access these sessions in other secured pages. To protect these sessions from unauthorized users, you cannot access them from an unsecure page.
Programmatic details and scenarios
IBM WAS maintains the security of individual sessions.
An identity or user name, readable by the com.ibm.websphere.servlet.session.IBMSession interface, is associated with a session. An unauthenticated identity is denoted by the user name anonymous. IBM WAS includes the com.ibm.websphere.servlet.session.UnauthorizedSessionRequestException class, which is used when a session is requested without the necessary credentials.
The Session Management facility uses the WAS security infrastructure to determine the authenticated identity associated with a client HTTP request that either retrieves or creates a session. WebSphere Application Server security determines identity using certificates, LPTA, and other methods.
After obtaining the identity of the current request, the Session Management facility determines whether to return the session requested using a getSession() call or not.
The following table lists possible scenarios in which security integration is enabled with outcomes dependent on whether the HTTP request is authenticated and whether a valid session ID and user name was passed to the Session Management facility.
Unauthenticated HTTP request is used to retrieve a session HTTP request is authenticated, with an identity of "TIGER" used to retrieve a session No session ID was passed in for this request, or the ID is for a session that is no longer valid A new session is created. The user name is anonymous A new session is created. The user name is TIGER A session ID for a valid session is passed in. The current session user name is "anonymous" The session is returned. The session is returned. Session Management changes the user name to TIGER A session ID for a valid session is passed in. The current session user name is TIGER The session is not returned. An UnauthorizedSessionRequest Exception error is thrown* The session is returned. A session ID for a valid session is passed in. The current session user name is BOB The session is not returned. An UnauthorizedSessionRequestException error is thrown* The session is not returned. An UnauthorizedSessionRequestException error is thrown*
* A com.ibm.websphere.servlet.session.UnauthorizedSessionRequestException error is thrown to the servlet.