Configure inbound messages

We can use the administrative console to configure inbound messages for CSIv2.

1. In the administrative console, click Security > Global security > Authentication, expand RMI/HOP security.

2. Click CSIv2 inbound communication.

3. Optional: Click Propagate security attributes or Use identity assertion. The Propagate security attributes option enables support for security attribute propagation during login requests. When you select this option, the application server retains additional information about the login request, such as the authentication strength used, and retains the identity and location of the request originator.

   The Use identity assertion option specifies that identity assertion is a way to assert identities from one server to another during a downstream EJB invocation.

4. Under CSIv2 Message layer authentication, select Supported, Never or Required.

   Never

   Specifies that this server cannot accept an authentication mechanism selected under Allow client to server authentication with:.

   Supported

   Specifies that clients communicating with this server can specify an authentication mechanism selected under Allow client to server authentication with:. However, a method might be invoked without this type of authentication. For example, an anonymous or client certificate might be used instead.

   Required

   Specifies that clients communicating with this server must specify an authentication mechanism selected under Allow client to server authentication with:.

   Avoid trouble: Upon enabling Location Service Daemon (LSD), CSIv2 inbound and CSIv2 outbound message layer authentication in global security needs to be set as either Required or Supported.gotcha

5. Under Allow client to server authentication with:, select Kerberos, LTPA and or Basic authentication. We can optionally select:

   Kerberos

   Select to enable authentication using the Kerberos token.

   LTPA

   Select to enable authentication using the Lightweight Third-Party Authentication (LTPA) token.

   Basic authentication

   This type of authentication typically involves sending a user ID and a password from the client to the server for authentication. This is also know as Generic Security Services Username Password (GSSUP).

   This authentication also involves delegating a credential token from an already authenticated credential, provided the credential type is forwardable; for example, LTPA.

   If we select supported under CSIv2 Message layer authentication, and check KRB5 and LTPA under Allow client to server authentication with:, then the server does not accept the user name and password.

6. Click OK.

Results

You have now configured messages for CSIv2 inbound.

Related tasks

Configure Kerberos as the authentication mechanism using the administrative console

Configure outbound messages

Configure inbound transports

Configure outbound transports

Kerberos authentication settings

CSIv2 inbound communications settings

CSIv2 outbound communications settings