WebSphere Commerce authentication model
The WebSphere Commerce authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
WebSphere Commerce security model
Challenge mechanisms
A challenge mechanism specifies how a server challenges and retrieves authentication data from a user. WebSphere Commerce supports the following authentication methods or challenge mechanisms:
- Form-based or custom authentication
- This authentication mechanism permits a site or store specific login through an HTML page or a JSP form.
Authentication mechanisms
An authentication mechanism verifies user authentication data against an associated user registry. WebSphere Commerce issues an authentication token associated with a user on every subsequent request after the authentication process. It is terminated when the user logs off or closes the browser.
- Database authentication
- This is the process of verifying that the logon ID and password supplied by the user are valid when compared to the authentication information stored in the WebSphere Commerce database.
- LDAP bind
- This is process of verifying that the logon ID and password supplied by the user are valid by performing an LDAP bind operation.
- Third-party authentication
- This is the process of verifying the logon ID and password supplied by the user against a third-party user registry. To use third-party authentication, you need to provide an implementation of the ExternalSystemAuthenticationCmd interface.
User registry
The user registry is a repository that contains user information, and the user's authentication information (for example, the password). Authentication information provided by a principal (that is, the representation of a human user or system entity in a user registry) can be verified or validated against the user registry.
WebSphere Commerce supports user registries based on two user domains: LDAP user registry and the WebSphere Commerce database.
An LDAP server is typically used when multiple software applications need to interact with a common set of users and organizations. For example, for the implementation of a WebSphere Commerce Single Sign-On solution.
- Credentials
The Transaction Server supports authentication mechanisms based on validating credentials, such as certificates, tokens, or user ID and password pairs. Credentials are verified against a user registry that supports such a scheme.- Single sign-on
HTTP single sign-on preserves user authentication on different web applications. By using HTTP single sign-on (SSO), the user is not prompted multiple times for security credentials within a trust domain.- Authentication policies
An authentication policy is a set of rules that are applied to the authentication process and to the verification of authentication data by WebSphere Commerce. WebSphere Commerce supports account policies and other authentication-related policies, as described in the following subsections.
Related concepts
Authentication policies
Related tasks
Enable WebSphere Application Server security
Related reference
Default account policies