Copyright © TIBCO Software Inc. All Rights Reserved

> Overview of Extensible Security
> The extensible security feature allows you to use your own authentication and permissions systems, in addition to the default LDAP server included in EMS, to authenticate users and authorize them to perform actions such as publish and subscribe operations. Developing custom applications to grant authentication and permissions gives you more flexibility in architecting your system.
> How Extensible Security Works
> Extensible security works by allowing you to write your own authentication and permissions modules, which run in a Java virtual machine (JVM) in the EMS server. The modules connect to the server using the Java Authentication and Authorization Service (JAAS) for authentication modules, and the Java Access Control Interface (JACI) for permissions modules.
> If the extensible security features are enabled when the EMS server starts, the server checks each user as it connects for authentication, and checks user permissions when they attempt to perform actions that require authorization.
> Permission results are cached in the server for specified timeouts, and the permissions module is re-invoked when a cached permission expires. The server then replaces the old permission data with new data.
> Extensible authentication and extensible permissions are enabled in the tibemsd.conf configuration file. Extensible security modules can connect to external security services, such as single sign on (SSO) servers or LDAP directories, which operate outside of the TIBCO Enterprise Message Service framework. Extensible security modules can work in tandem with other authorization and permissions methods, such as LDAP or the EMS acl.conf configuration file. Figure 16 shows the different security methods available in the server.
> Figure 16 Methods for authenticating users and checking permissions

Copyright © TIBCO Software Inc. All Rights Reserved