Securing Heterogeneous SystemsUsing Oracle Web Services ManagerJens Peters [One Fox]Ronald van Luttikhuizen [Vennster]22-N...
Jens Peters• Technical Architect at One Fox• Microsoft MCPD (Windows, Web, Enterprise)• Co-author of Oracle Technet articl...
Ronald van Luttikhuizen• Managing Partner at Vennster• Oracle ACE Director for Fusion Middleware and SOA• Author of differ...
Agenda1. Introduction2.   Case Study3.   Security requirements and considerations4.   Secure OSB Services using OWSM [Demo...
Introduction               Figures               ● Inhabitants: 16,7m               ● Density: 403/km2               ● Cap...
Introduction               Figures               ● Inhabitants: 1,1m (6th)               ● Surface: 3.421 km2, density: 32...
Agenda1. Introduction2. Case Study3.   Security requirements and considerations4.   Secure OSB Services using OWSM [Demons...
Case Study | rearchitecting application landscape● Flexibility: Silos to Services  •   Case Management and BPM  •   Docume...
9|x
Case StudyTechnology● Portal (.NET/SL)● Oracle SOA Suite● Oracle Service Bus● IAM/IDM and AD● Backend services  • Standard...
Agenda1. Introduction2. Case Study3. Security requirements and considerations4.   Secure OSB Services using OWSM [Demonstr...
Security Requirements & Considerations● Secure for human and automated interaction● Transport security and Message securit...
Security Requirements & Considerations                                         13 | x
Oracle Web Services Manager (OWSM)● Architecture: Agent-based● Types: Provider and consumer● Level: Transport and message●...
Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstrat...
Secure OSB Services                      16 | x
Agenda1.   Introduction2.   Case Study3.   Security requirements and considerations4.   Secure OSB Services using OWSM [De...
Introduction to .NET/Silverlight.NET● De-facto MS Runtime for managed applications● WCF for interprocess communication (si...
Agenda1.   Introduction2.   Case Study3.   Security requirements and considerations4.   Secure OSB Services using OWSM [De...
Add Security Configuration to a Silverlight Client                                                20 | x
<?xml version="1.0" encoding="utf-8"?><access-policy> <cross-domain-access>  <policy>   <allow-from http-request-headers="...
Add Security Configuration to a Silverlight Client                                                22 | x
<configuration> <system.serviceModel>  <bindings>   <customBinding>    <binding name="BasicWsSecurity">      <security aut...
Agenda1.   Introduction2.   Case Study3.   Security requirements and considerations4.   Secure OSB Services using OWSM [De...
Summary● Integration between Oracle and Microsoft Technology stacks is  possible and easy using standards; including secur...
Thank you!Jens Peters [One Fox]Jens.peters@onefox.nlRonald van Luttikhuizen [Vennster]ronald.van.luttikhuizen@vennster.nl ...
Upcoming SlideShare
Loading in …5
×

DOAG 2012 - Securing Heterogeneous Systems Using Oracle Web Services Manager

1,041 views

Published on

Remember the time when Web Services were new and exciting? They were taking off by promising to provide "true" interoperability and independence from underlying platforms and toolsets. In those days vendors introduced tooling to create and consume Web Services while several WS-* standards were not yet fully matured. No wonder that true interoperability was not achieved right away. Integrating a plain-old Web Service in which the client used the same toolset as the provider was rarely problematic. But trying to consume a Web Service generated in a completely different technology than the client could be a nightmare, especially when one or more WS-* standards, such as WS-Security, were applied.

In this presentation we will investigate a case-study in which an employee portal application built on the Microsoft .NET framework and Silverlight consumes Web Services that are exposed by the Oracle Service Bus (OSB). Needless to say, this scenario involves Web Service interactions between two completely different toolsets. The demonstration describes how to achieve first contact between these toolsets, how to use Oracle Web Services Manager (OWSM) to secure the exposed Web Services in a declarative way and how the portal application interacts with these secured services.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,041
On SlideShare
0
From Embeds
0
Number of Embeds
27
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

DOAG 2012 - Securing Heterogeneous Systems Using Oracle Web Services Manager

  1. 1. Securing Heterogeneous SystemsUsing Oracle Web Services ManagerJens Peters [One Fox]Ronald van Luttikhuizen [Vennster]22-November-2012 | DOAG 2012 1|x
  2. 2. Jens Peters• Technical Architect at One Fox• Microsoft MCPD (Windows, Web, Enterprise)• Co-author of Oracle Technet articles• More than 10 years of Microsoft technology related experience• More than 2 years of Oracle Middleware related experience• Contact: jens.peters@onefox.nl• LinkedIn: www.linkedin.com/pub/jens-peters/52/2ab/3a• Web: www.onefox.nl 2|x
  3. 3. Ronald van Luttikhuizen• Managing Partner at Vennster• Oracle ACE Director for Fusion Middleware and SOA• Author of different articles, co-author Oracle SOA Book 11g book• Upcoming book SOA Made Simple• Architect, consultant, trainer for Oracle, SOA, EDA, Java• More than 10 years of software development and architecture experience• Contact: ronald.van.luttikhuizen@vennster.nl• Blog: blog.vennster.nl• Twitter: rluttikhuizen 3|x
  4. 4. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 4|x
  5. 5. Introduction Figures ● Inhabitants: 16,7m ● Density: 403/km2 ● Capital: Amsterdam ● Government: The Hague ● Income: $48.222/capita Government ● 11 state departments & > 200 nation wide agencies ● 12 provinces ● 415 municipalities 5|x
  6. 6. Introduction Figures ● Inhabitants: 1,1m (6th) ● Surface: 3.421 km2, density: 321/km2 ● Capital: Zwolle ● Workforce (province): approx. 1.000 Tasks ● Regional tasks around themes: territorial planning, water management, stimulating culture, economy, and tourism, improving environment, (financial) governance of municipalities, etc. ● Products: permits, subsidies, supervision and enforcement Drivers ● Mergers, shift in tasks, budget cuts ● Chain cooperation ● Working together for economies of scale 6|x
  7. 7. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 7|x
  8. 8. Case Study | rearchitecting application landscape● Flexibility: Silos to Services • Case Management and BPM • Document Management • CRM • IAM● Integration platform • ebMS • Legacy systems (e.g. finance)● Reuse of services by multiple consumers 8|x
  9. 9. 9|x
  10. 10. Case StudyTechnology● Portal (.NET/SL)● Oracle SOA Suite● Oracle Service Bus● IAM/IDM and AD● Backend services • Standard apps • Java and WLS • .NET 10 | x
  11. 11. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 11 | x
  12. 12. Security Requirements & Considerations● Secure for human and automated interaction● Transport security and Message security● Authentication (AuthN) and Authorization (AuthZ)● Efficient security management • Dedicated solutions, central management● Support for all types of services and consumers • Interoperability using standards (SSL/TLS and WS-*) 12 | x
  13. 13. Security Requirements & Considerations 13 | x
  14. 14. Oracle Web Services Manager (OWSM)● Architecture: Agent-based● Types: Provider and consumer● Level: Transport and message● Usage: WLS, SOA, OSB, ADF, WC● Configuration: IDEs, consoles, scripts● Policies • Out-of-the-box • Policy creation 14 | x
  15. 15. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 15 | x
  16. 16. Secure OSB Services 16 | x
  17. 17. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 17 | x
  18. 18. Introduction to .NET/Silverlight.NET● De-facto MS Runtime for managed applications● WCF for interprocess communication (since .net 3.0)Silverlight● Platform for Web based applications● .NET–light within browser, Adobe Flash like architecture● WCF-light 18 | x
  19. 19. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to Silverlight Client [Demonstration]7. Summary 19 | x
  20. 20. Add Security Configuration to a Silverlight Client 20 | x
  21. 21. <?xml version="1.0" encoding="utf-8"?><access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="*"> <domain uri="http://*" /> <domain uri="https://*" /> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access></access-policy> 21 | x
  22. 22. Add Security Configuration to a Silverlight Client 22 | x
  23. 23. <configuration> <system.serviceModel> <bindings> <customBinding> <binding name="BasicWsSecurity"> <security authenticationMode="UserNameOverTransport" includeTimestamp="false" /> <textMessageEncoding messageVersion="Soap11"/> <httpsTransport/> </binding> </customBinding> </bindings> <client> <endpoint address="https://win-romfth1i30u:8012/HelloWorldService/SSL" binding="customBinding" bindingConfiguration="BasicWsSecurity" contract="HelloWorld.HelloWorld" name="HelloWorldSOAP_BasicWsSecurity" /> </client> </system.serviceModel></configuration> 23 | x
  24. 24. Agenda1. Introduction2. Case Study3. Security requirements and considerations4. Secure OSB Services using OWSM [Demonstration]5. Introduction to .NET/Silverlight6. Add Security Config to a Silverlight Client [Demonstration]7. Summary 24 | x
  25. 25. Summary● Integration between Oracle and Microsoft Technology stacks is possible and easy using standards; including security!● SSL/TLS and WS-Security most obvious for heterogeneous platforms● Use Oracle Web Service Manager to apply and enforce security● Useful tools • soapUI • Fiddler • WCF tracing 25 | x
  26. 26. Thank you!Jens Peters [One Fox]Jens.peters@onefox.nlRonald van Luttikhuizen [Vennster]ronald.van.luttikhuizen@vennster.nl 26 | x

×