Use this page to specify the features that a server supports when acting as a client to another downstream server. To view this administrative console page, complete the following steps:
Configuration tab
Whether a client certificate from the configured keystore is used to authenticate to the server when the SSL connection is made between this server and a downstream server, provided that the downstream server supports client certificate authentication.
Typically, client certificate authentication has a higher performance than message layer authentication, but requires some additional setup. These additional steps include verifying that this server has a personal certificate and that the downstream server has the signer certificate of this server. If you select client certificate authentication, the following options are available:
Whether to assert identities from one server to another during a downstream enterprise bean invocation.
The identity asserted is the invocation credential that is determined by the RunAs mode for the enterprise bean. If the RunAs mode is Client, the identity is the client identity. If the RunAs mode is System, the identity is the server identity. If the RunAs mode is Specified, the identity is the identity specified. The receiving server receives the identity in an identity token and also receives the sending server identity in a client authentication token. The receiving server validates the identity of the sending server to ensure a trusted identity.
When specifying identity assertion on the CSIv2 authentication outbound panel, also select basic authentication as supported or required on the CSIv2 authentication inbound panel. The server identity can then be submitted with the identity token, so that the receiving server can trust the sending server. Without specifying basic authentication as supported or required, trust is not established and the identity assertion fails.
Whether to reuse security information during authentication. This option is usually used to increase performance.
The first contact between a client and server must fully authenticate. However, all subsequent contacts with valid sessions reuse the security information. The client passes a context ID to the server, and that ID is used to look up the session. The context ID is scoped to the connection, which guarantees uniqueness. When the security session is not valid and if authentication retry is enabled, which is the default, the client-side security interceptor invalidates the client-side session and resubmits the request transparently. For example, if the session does not exist on the server; the server fails and resumes operation.
When this value is disabled, every method invocation must authenticate again.
The type of system login configuration that is used for outbound authentication. You can add custom login modules before or after this login module by completing the following steps:
Enables the use of custom Remote Method Invocation (RMI) outbound login modules.
The custom login module maps or performs other functions before the predefined RMI outbound call. To declare a custom outbound mapping, complete the following steps:
Enables the application server to propagate the Subject and the security content token to other application servers using the Remote Method Invocation (RMI) protocol. Verify that you are using Lightweight Third Party Authentication (LTPA) as your authentication mechanism. LTPA is the only authentication mechanism that is supported when you enable the security attribute propagation feature. To configure LTPA, complete the following steps:
By default, the Security attribute propagation option is enabled and outbound login configuration is invoked. If you clear this option, the application server does not propagate any additional login information to downstream servers.
Specifies a list of trusted target realms, separated by a pipe character (|), that differ from the current realm.
Prior to WebSphere Application Server, Version 5.1.1, if the current realm does not match the target realm, the authentication request is not sent outbound to other application servers.