Plan a Credential Vault

 

+

Search Tips   |   Advanced Search

 

The Credential Vault service stores credentials that allow portlets to log in to applications outside the realm on behalf of the user. Using Credential Vault, a portlet can retrieve a user's authentication identity and then pass the information to a backend application.

The Credential Vault features the following two levels of sign-on:

Active Credentials

Establish connections through...

  • Basic Authentication
  • LTPA token authentication
  • Form-based user ID and password challenges

The Service encapsulates the single sign-on functionality for the portlet writer in an object.

Passive Credentials

Retrieve stored secret data such as user ID and password or certificates.

This option is more flexible but requires portlet writers to manage their own connections and authentication to backend applications with the credentials (User ID and password) they retrieved from the Credential Vault.

Credential objects can also pass...

...single sign-on tokens to backend applications.

By default, the Credential Vault contains...

Administrator-managed vaults allow users to update mappings; however, users cannot add new applications to this vault.

The user-managed vault segment allows users to add application definitions, such as a POP3 mail account, under the user vault and store a mapping there. By default, the vault uses an encryption plugin that encodes the passwords in Base 64.

WebSphere Portal initially provides two vault adapter configurations that write to the database:

default-release Default vault for administrator-managed vault segments that stores credentials in the release domain.
default-customization Default vault for user-managed vault segments that stores credentials in the customization domain.

WebSphere Portal ships a Credential Vault adapter for TAM that works on...

 

Parent topic

Security and authentication considerations