Secure >
WebSphere Commerce authentication model
The WebSphere Commerce authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
WebSphere Commerce security model
Challenge mechanisms
A challenge mechanism specifies how a server challenges and retrieves authentication data from a user. WebSphere Commerce supports the following authentication methods or challenge mechanisms:
- Form-based or custom authentication
- This authentication mechanism permits a site or store specific login through an HTML page or a JSP form.
- Certificate-based authentication (X.509 certificate)
- The certificate challenge mechanism implies that the Web server is configured to perform mutual authentication over SSL. The client is required to present a certificate in order to establish the connection. This certificate is then credential mapped to a user registry.
Authentication mechanisms
An authentication mechanism verifies user authentication data against an associated user registry. WebSphere Commerce issues an authentication token that is associated with a user on every subsequent request after the authentication process. It is terminated when the user logs off or closes the browser.
- Database authentication
- This is the process of verifying that the logon ID and password supplied by the user are valid when compared to the authentication information stored in the WebSphere Commerce database.
- LDAP bind
- This is process of verifying that the logon ID and password supplied by the user are valid by performing an LDAP bind operation.
- Third-party authentication
- This is the process of verifying the logon ID and password supplied by the user against a third-party user registry.
To use third-party authentication, provide an implementation of the ExternalSystemAuthenticationCmd interface.
- Certificate validation
- This is the process of verifying that the X.509 client certificate is trusted by the Web server and that it complies with the Web server's certificate policy. WebSphere Commerce also verifies the X.509 certificate against the WebSphere Commerce database. The Web server performs the coarse-grain access control on the certificate, while WebSphere Commerce performs a fine-grain access control on the certificate.
To configure the authentication mechanism to be used by the WCS instance, select the following options as the authentication mode in the Instance Properties > Member Subsystem node of the Configuration Manager:
- Database for database authentication
- Member Manager for LDAP bind
- Other for third-party authentication
To configure certificate validation, see Enable X.509 certificates.
User registry
The user registry is a repository that contains user information, and the user's authentication information (for example, the password). Authentication information provided by a principal (that is, the representation of a human user or system entity in a user registry) can be verified or validated against the user registry.
WebSphere Commerce supports user registries based on two user domains: LDAP user registry and the WebSphere Commerce database.
WebSphere Commerce supports the following LDAP providers:
- IBM Tivoli Directory Server
- IBM Lotus Domino Directory Server
- IBM Directory Server for iSeries
- Windows 2000 Active Directory
- Windows Server 2003 Active Directory
- Sun Java System Directory Server
An LDAP server is typically used when multiple software applications need to interact with a common set of users and organizations. For example, in a WebSphere Commerce enabled Portal solution, WebSphere Commerce and WebSphere Portal both interact with a common LDAP server. Another scenario where the use of an LDAP server is needed is in a WebSphere Commerce Single Sign-On solution.
- Credentials
The WebSphere Commerce Server supports authentication mechanisms based on validating credentials, such as certificates, tokens, or user ID and password pairs. Credentials are verified against a user registry that supports such a scheme. - Single sign-on
HTTP single sign-on preserves user authentication on different Web Applications. By using HTTP single sign-on the user is not prompted multiple times for security credentials within a given trust domain. - Authentication policies
An authentication policy is a set of rules that are applied to the authentication process and to the verification of authentication data by WebSphere Commerce. WebSphere Commerce supports account policies and other authentication-related policies, as described in the following subsections.