The WebSphere Commerce authentication model is based on the following concepts:
Challenge mechanisms
A challenge mechanism specifies how a server challenges and retrieves authentication data from a user. WebSphere Commerce supports the following authentication methods or challenge mechanisms:
- Form-based or custom authentication
- This authentication mechanism permits a site or store specific login through an HTML page or a JSP form.
- Certificate-based authentication (X.509 certificate)
- The certificate challenge mechanism implies that the Web server is configured to perform mutual authentication over SSL. The client is required to present a certificate in order to establish the connection. This certificate is then credential mapped to a user registry.
Authentication mechanisms
An authentication mechanism authenticates a user by verifying the user's authentication data against an associated user registry. WebSphere Commerce issues an authentication token that is associated with a user on every subsequent request after the authentication process. It is terminated when the user logs off or closes the browser.
- Certificate validation
- This is the process of verifying that the X.509 client certificate is trusted by the Web server and that it complies with the Web server's certificate policy. WebSphere Commerce also verifies the X.509 certificate against the WebSphere Commerce database. The Web server performs the coarse-grain access control on the certificate, while WebSphere Commerce performs a fine-grain access control on the certificate.
- LDAP bind
- This is process of verifying the challenge information supplied is valid, by performing an LDAP bind operation to authenticate the user.
- Database bind
- This is the process of verifying the user ID and password supplied during the authentication process is valid when compared to the authentication information stored in the WebSphere Commerce database.
User registry
The user registry is a repository that contains user information, and the user's authentication information (for example, the password). Authentication information provided by a principal (that is, the representation of a human user or system entity in a user registry) can be verified or validated against the user registry.
WebSphere Commerce supports user registries based on two user domains: LDAP user registry and the WebSphere Commerce database.
WebSphere Commerce supports the following LDAP providers: