Bean Extender Guide to Features


Session Authentication Dip

The Session Authentication Dip (SA Dip) adds access control to a bean instance. Access control consists of the following components:
Principal An entity that can be validated by an authenticator.
Principal Query An entity that obtains the information for a principal.
Authenticator An entity that verifies the authenticity of a principal.

The SA Dip includes a sample principal that consists of a user ID and password, a sample principal query that prompts for a user ID and password using an AWT dialog, and a sample authenticator that validates the user ID and password against the ones set when the SA Dip was first applied.

When the Session Authentication dip is applied to a bean instance, users are required to validate themselves before the bean is functional. Validation is done by entering the data for a principal. This data is checked by the SA dip using the appropriate authenticator. If a valid principal is not entered, then validation fails. When validation fails, all methods, properties, and events in the original dippable bean are vetoed by the SA Dip.

The design of the SA Dip allows assemblers to provide their own principal, principal query, and authenticator. The SA Dip supplies a sample principal, principal query, and authenticator. These samples can be used as an example for writing a principal, a principal query, and an authenticator.

The functions of the SA Dip are:

  1. The readObject() method of the dippable bean is bound by the SA Dip. The Dipping Framework invokes the SA Dip after the readObject() method of the dippable bean is completed.

  2. The SA Dip invokes the principal query to obtain the information for the principal from the user. The sample principal query prompts the user to enter a user ID and password. The entered information is used to create a principal.

  3. The SA Dip attempts to authenticate the principal.

    Even when authentication is unsuccessful, the following are not vetoed by the SA Dip:

The SA Dip cannot be applied to a dippable bean that declares any public final or static methods. Final and static methods cannot be intercepted by the Dipping Framework. Because these methods cannot be intercepted, they cannot be vetoed when authentication fails.
Note:The Session Authentication Dip and the included principal, principal query, and authenticator are sample code. This sample code is intended to illustrate how to use the Dipping Framework and is not intended to be product level code. The sample principal, principal query, and authenticator code is in the src/com/ibm/beans/samples/dips/sessauth/demo directory.

Creating a New Principal, Principal Query, and Authenticator

The SA Dip provides a sample authenticator that verifies the sample principal. The sample principle is a user ID and password. However an assembler may need platform or domain specific authentication. To provide new platform or domain specific authentication, any or all of the following must be supplied:

The assembler specifies which principal, principal query, and authenticator to use when the SA Dip is customized.

The constructor for the principal, principal query, and authenticator may not take parameters. These objects are created by the SA Dip customizer using a call to the Class.newInstance() method. For additional information, see newInstance in the JavaSoft JDK API Reference.

The following classes contain the sample principal, principal query, and authenticator source code:
SamplePrincipal.java This class provides a principal consisting of a user ID and password. It implements SAPrincipal.
SamplePrincipalQuery.java This class provides a way of querying the user for the sample principal at runtime. It extends SAPrincipalQuery. The AWT interaction is delegated to the SamplePrincipalQueryAWT class.
SamplePrincipalQueryAWT.java The modal dialog that prompts the user to enter a principal.
SampleResourceBundle.java This class contains the locale-specific strings in the sample principal, principal query, and authenticator.
SampleSimpleAuthenticator.java The sample authenticator for the sample principal. It implements SAAuthenticator. The valid values for user ID and password are entered when the SA Dip is applied and customized using SampleSimpleAuthenticatorCustomizer.
SampleSimpleAuthenticatorBeanInfo.java This class identifies the customizer for SampleSimpleAuthenticator.
SampleSimpleAuthenticatorCustomizer.java This class allows a valid user ID and password to be set for SampleSimpleAuthenticator when the SA Dip is applied and customized.

Customizing the SA Dip

When the SA Dip is applied, the assembler can customize the following:

You should customize the SA Dip when applying it. You can set the user ID and password using the customizer for the sample authenticator. The user ID and password are validated at runtime. The following information applies to this customizer:

After typing in the user ID and password, click on the OK button. To clear the values in the fields, click on the Cancel button. To dismiss the dialog, click on the Done button.

If the principal or the authenticator has a customizer, the customizer is displayed in a modal dialog when the Apply button on the SA Dip customizer is clicked. The Cancel button resets the entry fields to their current value.

The sample principal has no associated customizer, but the sample authenticator has an associated customizer.


[ Top of Page | Previous Page | Next Page | Table of Contents | Documentation Homepage ]