Chapter 1, A Threefold View of WebSphere Application Server Security, uses a novel approach to compare ways in which WebSphere security elements are perceived, usually according to the role of the individual working with the technology. These ways or views help you understand the foundations of WebSphere security, providing multiple angles from where to analyze this set of technologies and communicate in their language with different functional teams within your organization.

Chapter 2, Securing the Administrative Interface, walks you through the necessary steps to secure access to the WebSphere graphical interface, known as the ISC (Integrated Solutions Console). As a prerequisite to securing the ISC, you must first enable the WebSphere Application Server platform security, known as global security. During these processes, the chapter succinctly describes relevant security topics (for example, user registries) and highlights what parameters are required in order to perform each step.

Chapter 3, Configuring User Authentication and Access, provides concise technical background on the security topics related to setting up user authentication (validation of presented user credentials) and user access determining if an authenticated user has rights to access to the requests made. The chapter describes some important concepts such as WebSphere Security Domains (a new feature in version 7 of WAS), user registries (reviewed in more depth), as well as a review of popular user registries available to be used in a WebSphere environment. The chapter ends by binding all these concepts using a mini project that walks you through protecting application servers.

Chapter 4, Front-End Communication Security, describes and compares popular infrastructure architectures used to design front-end of a WebSphere environment. The chapter goes on explaining a major security used to secure communication channels, SSL, and describes several related aspects such as SSL certificates and CA (certificate authority). At the end, the chapter walks you through the process, in the way of a mini project, used to secure the front-end of a WebSphere environment from the HTTP server (IHS) to the actual Application Server.

Chapter 5, Securing Web Applications, briefly introduces concepts related to securing Java Web Applications (or more succinctly Web Applications). The chapter then uses an in-depth mini project where you will be walked through in the various stages to design, code, package, deploy, and configure a simple Web Application that offers access to employees of a fictional corporation. Each type of employee will have access only to sections of the Web Application. Therefore, you will configure WebSphere in order to implement this secure functionality.

Chapter 6, Securing Enterprise Java Beans Applications, introduces concepts related to Enterprise Java Beans (EJB) technologies such as declarative and programmatic security. The chapter then uses the mini-project approach to walk you through the stages needed to design, code, package, deploy, and configure a simple EJB application. The mini-project in this chapter reuses modules from the previous chapter to implement a very simple portal application that will offer a better user experience to the employees of our fictional corporation.

Chapter 7, Securing Back-end Communication, focuses on two major concepts: authentication and data encryption. Authentication is reviewed from the point of view of trust between two infrastructure components, for example, WebSphere and a back-end database. The chapter expands on the major topics by providing in detail two examples of their use. It explores how encryption is used in the communication between WebSphere and a popular type of user registry, LDAP. The chapter also examines the use of authentication during the exchanges between WebSphere and databases using the JDBC protocol.

Chapter 8, Secure Enterprise Infrastructure Architectures, describes areas that will enable an enterprise application hosted in a WebSphere environment interact with possibly other applications, resources, and services available in a corporation infrastructure. It covers central concepts such as LTPA and SSO. The chapter ends by showing you how to fine-tune authorization at the HTTP Server level as well as at the WebSphere level.

Chapter 9, WebSphere Default Installation Hardening, deals with engineering the default WebSphere installation by changing its default parameters in order to harden the product's security side and customizing the files that hold the WebSphere environment security certificates and signers. The chapter focuses on two major aspects. While it points out what characteristics in the OS to review and modify, on the other hand, it discusses securing files related to certificates key and trust stores and files that hold passwords.

Chapter 10, Platform Hardening, looks at aspects of the platform where WebSphere is hosted that can be modified to increase the environment security. The chapter breaks down the OS into areas relevant to the WebSphere platform: generic operating system characteristics (for example, user accounts), file system features (for example, file permissions), and network system configuration.

Chapter 11, Security Tuning and Troubleshooting, overviews three major areas that can be improved by tuning key parameters as well as a couple of troubleshooting areas. The tuning section overviews general security, CSIv2 connectivity, and user directories and user permissions. Finally, the troubleshooting section reviews general security configuration exceptions and run time security exceptions.

The following is a list of software that you will need to download for this book:

If you are a system administrator or an IT professional who wants to learn about the security side of the IBM WebSphere Application Server v7.0, this book will walk you through the key aspects of security and show you how to implement them. You do not need any previous experience in WebSphere Application Server, but some understanding of Java EE technologies will be helpful. In addition, Java EE application developers and architects who want to understand how the security of a WebSphere environment affects Java EE enterprise applications will find this book useful.

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.

Code words in text are shown as follows: "Start the wsadmin interface."

A block of code is set as follows:

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
Listen [Server_IP]:8444
<VirtualHost [Server_IP]:8444>
SSLEnable
SSLServerCert ihs1.wasmaster
SSLProtocolDisable SSLv2
</VirtualHost>
KeyFile /opt/IBM/HTTPServer/ihsserverkey.kdb
SSLDisable

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

getParamAndForward(request, response);

Any command-line input or output is written as follows:

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "From the list of links located at the bottom, on the right-hand side of the window, click the Open WebSphere Bindings link"

Feedback from our readers is always welcome. Let us know what you think about this book what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.

To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title via the subject of your message.

If there is a book that you need and would like to see us publish, please send us a note in the SUGGEST A TITLE form on www.packtpub.com or e-mail< [email protected]>.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.