Download as PDF, PPTX
Uploaded byPrabath Siriwardena
Web Service Security
This document discusses various patterns for authentication and authorization at the message level for web services. It covers authentication patterns like direct authentication using basic authentication or mutual authentication with OAuth. It also discusses brokered authentication using WS-Trust/STS. For authorization, it discusses direct and delegated authorization patterns. The document then summarizes security solutions like WS-Security, WS-SecureConversation, WS-Trust and security policy standards.
More Related Content
Web Service Security
- 1. Prabath Siriwardena – Software Architect, WSO2
- 2. Plan for thesession Patterns Standards Implementations
- 3.
- 4. Patterns Authentication Confidentiality Authorization Patterns Patterns Patterns
- 5. 1995 1997
- 7.
- 8.
- 9. 2005 SAML2 Web SSO
- 10.
- 11. Authentication Patterns Direct Brokered Authentication Authentication
- 12. Direct Authentication for Web Services Transport Level Basic Authentication Mutual Authentication 2-legged OAuth
- 13. Direct Authentication for Web Services Message Level UsernameToken Profile with WS-Security Signing – X.509 Token Profile with WS-Security
- 14. Brokered Authentication for Web Services Transport Level Mutual Authentication 2-legged OAuth
- 15. Brokered Authentication for Web Services Message Level WS-Trust / STS Resource STS WS-Federation Signing – X.509 Token Profile with WS-Security Kerberos Token Profile for WS-Security
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24. Authorization Patterns Direct Delegated Authorization Authorization
- 25. Authorization ActAs in WS-‐Trust 1.4 Patterns Direct Delegated Authorization Authorization
- 26.
- 27. Message Level Security Solution Patterns Message Interceptor Gateway Pattern Trusted Sub System Pattern
- 28. Message Level SOAP Security UsernameToken Profile
- 29. SOAP Security Key Identifiers Message Level X.509 Token Profile & Key Referencing Direct References
- 30. Message Level SOAP Security Symmetric Binding Vs Asymmetric Binding
- 31. SOAP Security • WS-‐Security secures SOAP – focuses on Message Level WS – Secure Conversation message level security • Focuses on a single message authentication model • Each message contains everything necessary to authenticate it self • Suitable for a coarse grained messaging in which a single message at a time from the same requestor is received
- 32. Message Level SOAP Security • What SSL does at the transport level in point-‐to-‐point WS – Secure Conversation communication, WS-‐SecureConversation does at the SOAP layer • Removes the need of individual SOAP message carrying authentication information. • Establishes a mutually authenticated security context in which a series of messages are exchanged. • Uses public key encryption to exchange a shared secret and then onwards uses the shared key
- 33. Message Level SOAP Security WS-Trust
- 34. Message Level SOAP Security Sender Vouches – Subject Confirmation
- 35. Message Level SOAP Security Holder-of-Key – Subject Confirmation
- 36. SOAP Security WS – Security Policy http://wso2.org/library/3132 http://wso2.org/library/3786