The Workplace XT server hosts the Workplace XT web application, Workplace XT Java™ applets, and Process Engine applets. The sections below discuss how each of these components deals with authentication and single sign-on (SSO) integration.
This end-user web application provides access to the document management and business process management capabilities of IBM FileNet P8. Workplace XT is used out-of-the-box, and supports only container-managed authentication.
The following topics discuss how each of the high-level authentication options discussed in Browser-based clients of J2EE application servers apply to the Workplace XT application.
In this mode, the application does not control the authentication process. The deployment descriptor for the application specifies the security constraints required to access application pages.
The deployment descriptor specifies the authentication method that should be used. The following standard methods defined by the Servlet specification (see Browser-based clients of J2EE application servers) are supported:
This option is how most SSO products integrate with a J2EE application server. Client browsers running Workplace are redirected to a proxy server that authenticates the caller, and places a token in an HTTP header for them. When the request reaches the server, the container extracts the credentials and invokes SSO provider software that performs a JAAS login using them. This is known as a perimeter authentication because the actual authentication occurs outside of the container. Clients are already authenticated before their servlet requests arrive at the server. See JAVA-based client authentication and the examples in Single sign-on integrations via JAAS for more information.
Perimeter authentication lets Workplace XT leverage standard integrations between the application server vendors and the SSO technology vendors.
NOTE Support for SSO in Workplace XT is limited to two specific combinations that IBM FileNet has qualified, as discussed in Single sign-on integrations via JAAS. If you are implementing SSO in an IBM Tivoli Access Manager WebSEAL 6.0 environment, you must configure WebSEAL for transparent junctions. For more information and configuration details, see your IBM product documentation.
The Workplace XT applications include the following Java applets:
The section Applets and reverse proxy servers in the JAVA-Based Client Authentication (JAAS) topic discusses some of the concerns that must be taken into consideration when using Java applets across a reverse proxy server. The Workplace XT applets address these concerns in the current release.
The Workplace XT applets exchange XML data with the Workplace XT server, and this XML data contains URL references that are not, by default, translated properly by reverse proxy servers. For this reason, some custom configuration work is required to get reverse proxy servers to work properly with the applets.
Workplace XT Application Integration allows vendor client applications to integrate with Workplace XT Windows-based applications, such as Microsoft Word and Microsoft Outlook, can leverage Application Integration COM components for this purpose. These COM components interact with the Application Integration servlets, sending XML requests over HTTP, and receiving XML responses.
Application Integration clients are not able to participate in single sign-on solutions (SSO); they are restricted to user name and password-based authentication. Application Integration clients can co-exist with thin client applications that participate in an SSO solution. Workplace XT can simultaneously support clients using container-managed authentication for SSO (for example, Workplace XT clients), and clients that are using application-managed authentication (such as Microsoft Office clients using the Application Integration Toolkit).
IBM FileNet P8 Platform includes the FileNet P8 Portlets product, a portal integration framework that provides commonly-required content and process functionality within vendor portal products. This framework includes portlets that provide end-user functionality such as authoring content, browsing features for accessing content, and providing a view of a user's inbox.
When portlets are used within Workplace XT in the My Workplace page, they participate in the same SSO integrations as Workplace XT itself.
To support SSO solutions within a vendor portal integration, the portlets container must first be configured for container-managed authentication. When this configuration is in place, the FileNet P8 portlets recognize that the container has taken care of authentication for them.
In cases where links from a portlet launches Workplace XT, an SSO infrastructure must also be in place to propagate the SSO provider identity tokens to the container that is hosting the application.