Security Context : Overview

Overview
Background
Some security policies attach a security context object to each message exchange. Security context objects can contain user role and attribute information. For example, an authentication policy might obtain user roles from an identity management system (IMS). The provider service might access and use this information. Alternatively, another policy at another policy agent might need this same information, and rather than retrieving it from the IMS a second time, it would be more efficient to re-use the information.
Capabilities
This chapter presents a Java API that allows WebSphere services to access the security context information, and to forward the security context information to another provider for re-use.
Three methods implement this functionality for JAX-RPC services, and three separate methods do the same for JAX-WS services.
Forwarding is always the result of an explicit method call; it is never automatic.
Implementation
These methods arrange to forward security context information in a message header named com.tibco.security.userinformation.