Tivoli Access Manager integrates with Objectgrid to authenticate and authorize distributed clients

Introduction

The ObjectGrid component of the ibm®websphere®extended deployment V6.1 is a grid-enabled memory data store for Java™ objects, designed specifically for scalability, resiliency, and high performance. ObjectGrid can be used like an in-memory database, or it can be used to distribute data across the network.

ObjectGrid provides immediate and available security support for Java Authentication and authorization services (Java authentication and Authorization Service,jaas). However, because JAAS is based on Codesource and works with file implementations in plain text format, it may not be sufficient to effectively protect enterprise applications. For this reason, ObjectGrid also has the ability to integrate with other enterprise security software.

IBM tivoli®access Manager for E-commerce uses a wide range of enterprise security solutions that provide a complete authentication and authorization solution for the enterprise environment, as well as a full support for JAAS. ObjectGrid can be integrated with Tivoli Access Manager to achieve a secure distributed cache solution.

This article describes how to use the Tivoli Access Manager Authorization Java API to authenticate and authorize distributed ObjectGrid clients, including code examples that explain how to complete this integration. This article requires you to understand the basics of Java programming features, ObjectGrid, and Tivoli Access Manager and familiarize yourself with the concepts of authorization and authentication.

ObjectGrid Security Overview

Distributed ObjectGrid can host data on ObjectGrid servers, while ObjectGrid clients can read or update data by connecting to the server. ObjectGrid uses an open security architecture to authenticate and authorize clients. The Open security architecture allows ObjectGrid to integrate with external security products.

As in any secure distributed environment, authentication and authorization are two of the most important security features in a secure distributed ObjectGrid system. The ObjectGrid client must provide credentials to authenticate through the ObjectGrid server, and the client must be authorized to invoke the ObjectGrid operation. ObjectGrid does not provide any out-of-the-box security implementations, but provides security plug-ins to implement the security mechanisms you choose.

Figure 1 shows how the ObjectGrid server authenticates and authorizes the client. Steps 1 through 6 show the authentication process, and steps 7 through 9 show the authorization process. The three green rings represent the ObjectGrid plug-in, while the two yellow cylinders represent external security services.

Figure 1. ObjectGrid Authentication and Authorization architecture