BDC Security Overview

Security options available when using BDC:

• Authentication - verify a user is who he/she claims to be.
  
• Authorization - Determine if user is permitted access to data.
  
• Access Control - Manage access to business data exposed using BDC.

When BDC data is exposed on a Web page, the BDC runs within the IIS worker process (w3wp.exe) and uses the IIS application pool user account.

When BDC is crawled (search) to index content, it runs in the filter daemon process (msadmn.exe).

Authentication models:

• Trusted Subsystem - System account is used ot access services and resources on behalf of all authenticated users. Fixed identiy is the application pool ID or group ID retrieved from Single Sign-On (SSO) database.
  
• Impersonation and Delegation - Delegates authentication to the WFEs and application pool ID impersonates the user. App pool Id connects to business application servers on user's behalf using Kerberos or SSO.

Four Authentication Modes: (Defined on the LOBSystemInstance XML tag in the ADF)

1. PassThrough - Users authentication is passed to back-end server.
   
2. RevertToSelf - (Windows Authentication) App Pool ID is used to impersonate user. Reverts back to IIS aplication pool ID before requesting data from back-end LOB system. This is the default option if no authentication mode is specified.
   
3. Credentials - (Database of users) Uses database credentials from default SSO service.
   
4. WindowsCredentials - Uses Microsoft Windows credentials from default SSO Service.

Business Data Catalog Glossary: http://msdn.microsoft.com/en-us/library/ms560072.aspx