Conclusions

At this point you should have a fairly comprehensive understanding of the WebSphere security model. WebSphere draws from a combination of the J2EE security model, extensions introduced by WebSphere to fill holes in the J2EE model, and optional third-party security providers, including Tivoli's security services products, to deliver an end-to-end layered defense against intrusion and disruption to your information system. The same plug-points that enable integration with third-party security providers can be leveraged by you to integrate with your own legacy security facilities.

While we have discouraged you from writing security logic into your applications, and have enabled you to avoid this for the most part with built-in and implicit facilities controlled through externally declared policies and administration facilities, we've also enabled a number of programming interfaces that enable you to accomplish some amount of programming where you might need it.