To implement basic authentication for a TIBCO BusinessWorks 6 REST service, a developer must perform three key configuration steps. First, on the HTTP Connector shared resource, the "Authentication" option must be enabled. Second, this requires the selection and configuration of an "Identity Provider" shared resource, which is responsible for validating the user's credentials (e.g., against an XML file, LDAP, or database). Finally, authentication must be enabled on the specific service component's binding configuration to enforce the security policy on incoming requests.

A. Specifying an SSL Server Configuration is for enabling confidentiality (HTTPS), not authentication. While recommended, it is not a mandatory step for configuring the basic authentication mechanism itself.

B. "Confidentiality" is the setting for enabling SSL/TLS to encrypt traffic. It is distinct from "Authentication," which is the process of verifying a user's identity.

C. An LDAP shared resource is a specific type of Identity Provider. The configuration requires a generic "Identity Provider" resource, which could be based on other sources like an XML file.

1. TIBCO BusinessWorks™ Bindings and Palettes Reference, Release 6.8, "HTTP Connector" section, "Security" tab.

Page 221 (PDF version): This section details the configuration of the HTTP Connector shared resource. It states, "Select the Authentication check box to enable basic authentication. To use Basic Authentication, you must configure an Identity Provider shared resource." This directly supports the first two parts of the correct answer.

2. TIBCO BusinessWorks™ Bindings and Palettes Reference, Release 6.8, "Identity Provider" section.

Page 227 (PDF version): This section describes the Identity Provider shared resource, explaining its role: "The Identity Provider shared resource is used to authenticate an incoming request." It lists the different types, including XML and LDAP, confirming that "Identity Provider" is the correct general term.

3. TIBCO BusinessWorks™ Container Edition Application Development, Release 2.7, "Securing a Basic REST Service" tutorial.

Page 211 (PDF version): In the steps for securing a REST service, the guide instructs the user to: "In the HTTP Connector editor, click the Security tab and select the Authentication check box. Click the Browse button next to the Identity Provider field to select an identity provider." This confirms the required linkage between enabling authentication and specifying an Identity Provider. It also shows that enabling authentication on the component is a necessary final step.