Planning_and_Impleme.. - didier beck weblog
Planning_and_Impleme.. - didier beck weblog
Planning_and_Impleme.. - didier beck weblog
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
www.butlergroup.com<br />
<strong>Planning</strong> <strong>and</strong> <strong>Impleme</strong>nting SOA<br />
Identification<br />
Identification covers the means by which a service requester proves its origin, <strong>and</strong> this is referred to as<br />
making a claim or assertion. Such information in the Web services world is represented in the identification<br />
information stored within the service’s SOAP header. The WS-Security specification (which will be covered<br />
in more depth later) provides a st<strong>and</strong>ard header block, or token, which stores this information. There are a<br />
range of different tokens available.<br />
Authentication<br />
Authentication means that the user of an application or service is recognised <strong>and</strong> can prove that the service<br />
request message has, in fact, come from the sender that it claims to have.<br />
Authorisation<br />
Once an authenticated message has been received, the recipient service might need to establish what the<br />
requester is allowed to do, referred to as authorisation.<br />
Confidentiality<br />
Confidentiality, or privacy, covers the need for information being passed from one service to another to be<br />
inaccessible to unauthorised parties. This can apply to all or part of a message, <strong>and</strong> will be especially<br />
relevant if messages are likely to be transmitted outside the firewall, but even internally it may be important<br />
to ensure that personal information is kept private.<br />
Integrity<br />
The final aspect of security is integrity. This means ensuring that a message has not been modified in any<br />
way in transit. Security issues that can arise from a lack of integrity include SQL injection (where malicious<br />
code could access data that it is not authorised to) <strong>and</strong> buffer overflows.<br />
As soon as we move outside the organisation, issues of identity, authentication, <strong>and</strong> authorisation become<br />
significantly more complex because it will be necessary to share information between parties (whilst<br />
maintaining privacy <strong>and</strong> confidentiality) – <strong>and</strong> the element of trust comes in. The core requirement here is<br />
that trust needs to be built dynamically, with the security context being transported so that authentication<br />
<strong>and</strong> authorisation can be distributed <strong>and</strong>/or federated.<br />
Federated authorisation is a process by which multiple parties agree that a specified set of users can be<br />
authenticated by a given set of criteria. This approach sets up a Federated Identity Management System,<br />
or a pool of authenticated users. The SOA security solution can verify a user by checking with the Federated<br />
Identity Management System. A federated system is basically Single Sign-On (SSO) between different<br />
security domains, <strong>and</strong> currently is likely to require specialist third-party infrastructure, as support for this<br />
concept within application servers is currently limited.<br />
Validation of identity is usually covered by authorisation <strong>and</strong> access<br />
mechanisms, which can already be deployed across a wide range of<br />
architectural styles. At the entry point, most organisations moving to SOA will<br />
have at least two alternatives – Internet browser <strong>and</strong> portal-based for people,<br />
<strong>and</strong> Web services. The same set of identity information, such as SSO or<br />
federated identity attributes <strong>and</strong> access control mechanisms need to be<br />
applied in a consistent manner across both methods. It will be important to<br />
use Identity <strong>and</strong> Access Management technologies, including directories for<br />
Web services.<br />
Validation of identity<br />
is usually covered by<br />
authorisation <strong>and</strong><br />
access mechanisms,<br />
which can already be<br />
deployed across a<br />
wide range of<br />
architectural styles.<br />
In many architectures, the way that the presentation <strong>and</strong> user interface layers<br />
are h<strong>and</strong>led (including challenge <strong>and</strong> response protocols for authentication <strong>and</strong> SSO) is via a portal or<br />
portlet. A range of different user credential schemes have been deployed over the years including<br />
passwords, tokens, smart cards, <strong>and</strong> X.509 certificates. Within a Web services or SOA framework, it will<br />
be desirable to reduce the number of types of credentials used, <strong>and</strong> we are seeing Security Assertion Markup<br />
Language (SAML) <strong>and</strong> Kerberos tokens as the emerging leaders here. SAML has advantages in that its<br />
flexibility <strong>and</strong> extensibility allows support for secondary authentication credentials that might be needed to<br />
interact with legacy applications.<br />
December 2006 Section 1: SOA Deployment 21