Understanding Operational Requirements
1-4 GlassFish Server Open Source Edition 3.1.2 Performance Tuning Guide
The default file based security realm is suitable for developer environments, where
new applications are developed and tested. At deployment time, the server
administrator can choose between the Lighweight Directory Access Protocol (LDAP)
or Solaris security realms. Many large enterprises use LDAP-based directory servers to
maintain employee and customer profiles. Small to medium enterprises that do not
already use a directory server may find it advantageous to leverage investment in
Solaris security infrastructure.
For more information on security realms, see "Administering Authentication Realms"
in GlassFish Server Open Source Edition Security Guide.
The type of authentication mechanism chosen may require additional hardware for the
deployment. Typically a directory server executes on a separate server, and may also
require a backup for replication and high availability. Refer to the Oracle Java System
Directory Server
(http://www.oracle.com/us/products/middleware/identity-managemen
t/oracle-directory-services/index.html) documentation for more
information on deployment, sizing, and availability guidelines.
An authenticated user's access to application functions may also need authorization
checks. If the application uses the role-based Java EE authorization checks, the
application server performs some additional checking, which incurs additional
overheads. When you perform capacity planning, you must take this additional
overhead into account.
Encryption
For security reasons, sensitive user inputs and application output must be encrypted.
Most business-oriented web applications encrypt all or some of the communication
flow between the browser and GlassFish Server. Online shopping applications encrypt
traffic when the user is completing a purchase or supplying private data. Portal
applications such as news and media typically do not employ encryption. Secure
Sockets Layer (SSL) is the most common security framework, and is supported by
many browsers and application servers.
The GlassFish Server supports SSL 2.0 and 3.0 and contains software support for
various cipher suites. It also supports integration of hardware encryption cards for
even higher performance. Security considerations, particularly when using the
integrated software encryption, will impact hardware sizing and capacity planning.
Consider the following when assessing the encryption needs for a deployment:
■ What is the nature of the applications with respect to security? Do they encrypt all
or only a part of the application inputs and output? What percentage of the
information needs to be securely transmitted?
■ Are the applications going to be deployed on an application server that is directly
connected to the Internet? Will a web server exist in a demilitarized zone (DMZ)
separate from the application server tier and backend enterprise systems?
A DMZ-style deployment is recommended for high security. It is also useful when
the application has a significant amount of static text and image content and some
business logic that executes on the GlassFish Server, behind the most secure
firewall. GlassFish Server provides secure reverse proxy plugins to enable
integration with popular web servers. The GlassFish Server can also be deployed
and used as a web server in DMZ.
■ Is encryption required between the web servers in the DMZ and application
servers in the next tier? The reverse proxy plugins supplied with GlassFish Server
support SSL encryption between the web server and application server tier. If SSL