What the security exit does
This section describes what the SSPI channel-exit programs do.
The supplied channel-exit programs provide either one-way or two-way (mutual) authentication of a partner system when a session is being established. For a particular channel, each exit program has an associated principal (similar to a user ID, see WebSphere MQ access control and Windows principals). A connection between two exit programs is an association between the two principals.
After the underlying session is established, a secure connection between two security exit programs (one for the sending MCA and one for the receiving MCA), is established. The sequence of operations is as follows:
- Each program is associated with a particular principal, for example as a result of an explicit login operation.
- The context initiator requests a secure connection with the partner from the security package (for Kerberos, the named partner) and receives a token (called token1). The token is sent, using the underlying session that is already established, to the partner program.
- The partner program (the context acceptor) passes token1 to the security package, which verifies that the context initiator is authentic. For NTLM, the connection is now established.
- For the Kerberos-supplied security exit (that is, for mutual authentication), the security package also generates a second token (called token2), which the context acceptor returns to the context initiator by using the underlying session.
- The context initiator uses token2 to verify that the context acceptor is authentic.
- At this stage, if both applications are satisfied with the authenticity of the partner's token, the secure (authenticated) connection is established.
Parent topic:
Introduction to security exits
fg16740_