A security session is a client/server connection where the client and the server have agreed to use an external security mechanism (such as DCE) and a set of security services (such as data encryption).
In a gateway application, a direct security session is established between a gateway’s client and a remote server. The gateway acts as an intermediary while the session is established, but afterwards, the gateway is not part of the security session. Direct security sessions are useful in the following circumstances:
Full-passthrough gateways that support per-packet security services
A full-passthrough gateway establishes a direct security session to support per-packet security services such as data integrity and data confidentiality while eliminating some of the associated overhead. For example, if the gateway supports data confidentiality without a direct security session, the contents of each TDS packet that passes through the gateway must be decrypted upon receipt and re-encrypted upon sending. If the gateway does not inspect the packet contents, this overhead is unnecessary. With a direct security session, no per-packet services are performed within the gateway.
Gateways where delegated client credentials are not available
A gateway’s clients may not delegate their security credentials to a gateway (using the CS_SEC_DELEGATION connection property), or a security mechanism may not support credential delegation. In these cases, the gateway must set up a direct security session to connect to the remote server using the same user name as the gateway’s client.
A security session callback allows the gateway to set up a direct security session. When the connection to the remote server is made, the callback routine acts as an intermediary for the handshaking required between the remote server and the gateway’s client. The handshaking process is outlined below:
When the gateway calls ct_connect, the remote server issues one or more security session messages.
For each security session message sent by the remote server, Client-Library invokes the callback, passing the security session information sent by the remote server as the callback’s input parameters.
The callback forwards the information to the gateway’s client by calling the Server-Library routine srv_negotiate(CS_SET, SRV_NEG_SECSESSION).
The callback then reads the client’s response and returns it to Client-Library using the callback’s output parameters.
Client-Library forwards the response to the remote server.
If the remote server sends another security session message, the process is repeated.
