Embed Size (px)
Citation preview
Web Services Security
Patterns, Practices
&
Threats
Prabath Siriwardena – Software Architect, WSO2
Patterns
Standards
Implementations
Plan for the session
Recurring Problems
Patterns
Authentication Patterns
Confidentiality Patterns
Authorization Patterns
19951997
1999
2004
2005
SAML2 Web SSO
2008/May
AuthenticationPatterns
Direct Authentication
Brokered Authentication
Basic Authentication
Mutual Authentication
2-legged OAuth
Direct Authentication for Web Services
Transp
ort
Level
UsernameToken Profile with WS-Security
Signing – X.509 Token Profile with WS-Security
Direct Authentication for Web Services
Mess
age L
evel
Mutual Authentication
2-legged OAuth
Brokered Authentication for Web Services
Transp
ort
Level
WS-Trust / STS
WS-Federation
Brokered Authentication for Web Services
Mess
age L
evel
Signing – X.509 Token Profile with WS-Security
Kerberos Token Profile for WS-Security
Resource STS
2006/April
2006/June
2008/2009
2008/2009
2008/2009
2007/Dec
2007/Dec
AuthorizationPatterns
Direct Authorization
Delegated Authorization
AuthorizationPatterns
Direct Authorization
Delegated Authorization
ActAs in WS-Trust 1.4
2005/Feb
Message Interceptor Gateway Pattern
Trusted Sub System Pattern
Security Solution PatternsM
ess
age L
evel
UsernameToken Profile
SOAP SecurityM
ess
age L
evel
X.509 Token Profile & Key Referencing
Mess
age L
evel
SOAP Security
Key Identifiers
Direct References
Symmetric Binding Vs Asymmetric Binding
Mess
age L
evel
SOAP Security
Mess
age L
evel
SOAP Security
• WS-Security secures SOAP – focuses on message level security
• Focuses on a single message authentication model
• Each message contains everything necessary to authenticate it self
• Suitable for a coarse grained messaging in which a single message at a time from the same requestor is receivedW
S –
Secu
re C
onvers
ati
on
Mess
age L
evel
SOAP SecurityW
S –
Secu
re C
onvers
ati
on
• What SSL does at the transport level in point-to-point communication, WS-SecureConversation does at the SOAP layer
• Removes the need of individual SOAP message carrying authentication information.
• Establishes a mutually authenticated security context in which a series of messages are exchanged.
• Uses public key encryption to exchange a shared secret and then onwards uses the shared key
WS-Trust
Mess
age L
evel
SOAP Security
Sender Vouches – Subject ConfirmationMess
age L
evel
SOAP Security
Mess
age L
evel
SOAP Security
Holder-of-Key – Subject Confirmation
WS-Security Policy
Mess
age L
evel
SOAP Security
