Defines the credential information and sends that information across the network so that a receiving server can interpret it.
When you send authentication information across the network using a token the transmission is considered message layer authentication because the data is sent with the message inside a service context.
A pure Java client uses basic authentication, Generic Security Services Username Password (GSSUP), as the authentication mechanism to establish client identity.
However, a servlet can use either basic authentication (GSSUP) or the authentication mechanism of the server, Lightweight Third Party Authentication (LTPA), to send security information in the message layer. Use LTPA by authenticating or by mapping the basic authentication credentials to the security mechanism of the server.
The security token that is contained in a token-based credential is authentication mechanism-specific. The way that the token is interpreted is only known by the authentication mechanism. Therefore, each authentication mechanism has an object ID (OID) representing it. The OID and the client token are sent to the server, so that the server knows which mechanism to use when reading and validating the token. The following list contains the OIDs for each mechanism:
BasicAuth (GSSUP): oid:2.23.130.1.1.1
LTPA: oid:1.3.18.0.2.30.2
SWAM: No OID because it is not forwardable
Situations occur where you want a prompt to display again if you entered your user ID and password incorrectly or you want a method to retry when a particular error occurs back at the client. If you can correct the error by information at the client side, the system automatically performs a retry without the client seeing the failure, if the system is configured appropriately.