Chapter 1. Overview of General Security Concepts

Authentication refers to identifying a subject and verifying the authenticity of the identification. The most common authentication mechanism is a username and password combination, but other mechanisms, such as shared keys, smart cards, or fingerprints are also used for Authentication. When in the context of Java Enterprise Edition declarative security, the result of a successful authentication is called a principal.

Authorization refers to a way of specifying access rights or defining access policies. A system can then implement a mechanism to utilize those policies to permit or deny access to resources for the requestor. In many cases, this is implemented by matching a principal with a set of actions or places they are or are not allowed to access, sometimes referred to as a role.

Though Authentication and Authorization are distinct concepts, they are very often linked. Many modules written to handle authentication also handle authorization and vice-versa.

Suzy is both authenticated and authorized. Adam has not authenticated, but he is authorized (with the Listen role) to view messages. Bob is authenticated, but has no authorization (no roles).

Encryption refers to encoding sensitive information by applying mathematical algorithms to it. Data is secured by converting (or encrypting) it to an encoded format. In order to read the data again, the encoded format must be converted back (or decrypted) to the original format. Encryption can be applied to simple string data in files or databases, or even on data sent across communications streams.

Examples of encryption include:

Secure Sockets Layer (SSL)/Transport Layer Security(TLS) encrypts network traffic between two systems. This occurs by using a symmetric key which is exchanged between and only known by those two systems. To ensure a secure exchange of the symmetric key, SSL/TLS makes use of Public Key Infrastructure (PKI), a method of encryption that utilizes a key pair. A key pair consists of two separate but matching cryptographic keys - a public key and a private key. The public key is shared with any party and is used to encrypt data, and the private key is kept secret and is used to decrypt data that has been encrypted using the public key.

When a client requests a secure connection to exchange symmetric keys, a handshake phase takes place before secure communication can begin. During the SSL/TLS handshake, the server passes its public key to the client in the form of a certificate. The certificate contains the identity of the server (its URL), the public key of the server, and a digital signature that validates the certificate. The client then validates the certificate and makes a decision about whether the certificate is trusted or not. If the certificate is trusted, the client generates the symmetric key for the SSL/TLS connection, encrypts it using the public key of the server, and sends it back to the server. The server decrypts the symmetric key, using its private key, and further communication between the two machines over this connection is encrypted using the symmetric key.

There are two basic kinds of certificates: Self-Signed Certificates and Authority-Signed Certificates. A self-signed certificate uses its own private key to sign itself, and that signature is unverified (not connected to any chain of trust). An authority-signed certificate is a certificate that is issued to a party by a certificate authority and is signed by that certificate authority (e.g. Verisign, CAcert, RSA and many others). The certificate authority is essentially verifying the authenticity of the holder of the certificate.

Self-Signed certificates can be faster and easier to generate and require less infrastructure to manage, but they can be difficult for clients to verify their authenticity since no third party has confirmed their authenticity. This inherently makes the less secure. Authority-signed certificates can take more effort to setup initially, but are far easier for clients to verify their authenticity (i.e. a chain of trust has been created since a third party has confirmed the authenticity of the holder of the certificate).

Single Sign On (SSO) allows principals authenticated to one resource to implicitly authorize access to other resources. If a set of distinct resources are secured by SSO, a user is only required to authenticate the first time they access any of the secured resources. Upon successful authentication, the roles associated with the user are stored and used for authorization of all other associated resources. This allows the user to access any additional authorized resources without re-authenticating.

If the user logs out of a resource, or a resource invalidates the session programmatically, all persisted authorization data is removed, and the process starts over. In the case of a resource session timeout, the SSO session is not invalidated if there are other valid resource sessions associated with that user. SSO may be used for authentication and authorization on both web applications as well as on desktop applications. In some cases, an single SSO implementation can integrate with both.

Within SSO, there are a few common terms used to describe different concepts and parts of the system:

Lightweight Directory Access Protocol (LDAP) is a protocol for storing and distributing directory information across a network. This directory information includes information about users, hardware devices, access roles and restrictions, and other information.

In Lightweight Directory Access Protocol (LDAP), the Distinguished Name (DN) uniquely identifies an object in a directory. Each distinguished name must have a unique name and location from all other objects, which is achieved using a number of attribute-value pairs (AVPs). The AVPs define information such as common names, organization unit, among others. The combination of these values results in a unique string required by the LDAP.

Some common implementations of LDAP include Red Hat Directory Server, OpenLDAP, Microsoft Active Directory, IBM Tivoli Directory Server, Oracle Internet Directory, 389 Directory Server, and others.