This implementation of
org.omg.PortableInterceptor.ClientRequestInterceptor inserts the security attribute
service (SAS) context into outgoing IIOP requests and handles the SAS messages received from the target security
service in the SAS context of incoming IIOP replies.
When creating the SAS context, this implementation looks for an Elytron
AuthenticationConfiguration that matches
the target URI (in the form iiop://hostname:port) and then uses the configuration to obtain the security info (like
username and password) that is inserted into the security tokens that are set in the SAS context.
The type of security tokens that are constructed depends on the target security requirements:
-
If the target supports identity propagation, the identity obtained from the Elytron configuration that matches
the target URI to build the
IdentityToken that is inserted into the SAS context. This usually means using
a configuration backed by a security domain so that the current authenticated identity in that domain is used
to build the identity token.
-
If in addition to the identity token the target requires username/password authentication, it means the target
expects this runtime (server) to identify itself using its own username and credentials. Once this runtime
has been authenticated, the identity contained in the identity token is used as a run-as identity.
In terms of configuration, it must match the target URI and it is usually a config that defines this
server's auth-name and associated credential via credential-reference.
-
If the target doesn't support identity propagation but supports username/password authentication, the identity
and credentials obtained from the Elytron configuration that matches the target URI to build
the
InitialContextToken. Again, this usually means using a configuration backed by a security domain so
that the current authenticated identity in that domain and its associated credentials are used to build the
initial context token.