Web Service Security

Prabath Siriwardena – Software Architect, WSO2

Plan for the sessionPatterns Standards Implementations

Recurring Problems

PatternsAuthentication Confidentiality Authorization Patterns Patterns Patterns

1995 1997

2005 SAML2 Web SSO

2008/May

Authentication Patterns Direct BrokeredAuthentication Authentication

Direct Authentication for Web ServicesTransport Level Basic Authentication Mutual Authentication 2-legged OAuth

Direct Authentication for Web ServicesMessage Level UsernameToken Profile with WS-Security Signing – X.509 Token Profile with WS-Security

Brokered Authentication for Web ServicesTransport Level Mutual Authentication 2-legged OAuth

Brokered Authentication for Web ServicesMessage Level WS-Trust / STS Resource STS WS-Federation Signing – X.509 Token Profile with WS-Security Kerberos Token Profile for WS-Security

2006/April

2006/June

2008/2009

2007/Dec

Authorization Patterns Direct DelegatedAuthorization Authorization

Authorization ActAs in WS-‐Trust 1.4 Patterns Direct DelegatedAuthorization Authorization

2005/Feb

Message Level Security Solution Patterns Message Interceptor Gateway Pattern Trusted Sub System Pattern

Message Level SOAP Security UsernameToken Profile

SOAP Security Key Identiﬁers Message Level X.509 Token Profile & Key Referencing Direct References

Message Level SOAP Security Symmetric Binding Vs Asymmetric Binding

SOAP Security •  WS-‐Security secures SOAP – focuses on Message Level WS – Secure Conversation message level security •  Focuses on a single message authentication model •  Each message contains everything necessary to authenticate it self •  Suitable for a coarse grained messaging in which a single message at a time from the same requestor is received

Message Level SOAP Security •  What SSL does at the transport level in point-‐to-‐point WS – Secure Conversation communication, WS-‐SecureConversation does at the SOAP layer •  Removes the need of individual SOAP message carrying authentication information. •  Establishes a mutually authenticated security context in which a series of messages are exchanged. •  Uses public key encryption to exchange a shared secret and then onwards uses the shared key

Message Level SOAP Security WS-Trust

Message Level SOAP Security Sender Vouches – Subject Confirmation

Message Level SOAP Security Holder-of-Key – Subject Confirmation

SOAP Security WS – Security Policyhttp://wso2.org/library/3132http://wso2.org/library/3786

Web Service Security

by Prabath Siriwardena on Nov 08, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 17

Statistics

Web Service Security — Presentation Transcript