Prabath Siriwardena – Software Architect, WSO2

Patterns Standards Implementations Plan for the session

Recurring Problems

Patterns Authentication Patterns Confidentiality Patterns Authorization Patterns

1999

2004

2005 SAML2 Web SSO

2008/May

Authentication Patterns Direct Authentication Brokered Authentication

Basic Authentication Mutual Authentication 2-legged OAuth Direct Authentication for Web Services Transport Level

UsernameToken Profile with WS-Security Signing – X.509 Token Profile with WS- Security Direct Authentication for Web Services Message Level

Mutual Authentication 2-legged OAuth Brokered Authentication for Web Services Transport Level

WS-Trust / STS WS-Federation Brokered Authentication for Web Services Message Level Signing – X.509 Token Profile with WS- Security Kerberos Token Profile for WS-Security Resource STS

2006/April

2006/June

2008/2009

2007/Dec

Authorization Patterns Direct Authorization Delegated Authorization

Authorization Patterns Direct Authorization Delegated Authorization ActAs in WS-Trust 1.4

2005/Feb

Message Interceptor Gateway Pattern Trusted Sub System Pattern Security Solution Patterns Message Level

UsernameToken Profile SOAP Security Message Level

X.509 Token Profile & Key Referencing Message Level SOAP Security Key Identifiers Direct References

Symmetric Binding Vs Asymmetric Binding Message Level SOAP Security

Message Level SOAP Security WS-Security secures SOAP – focuses on message level security Focuses on a single message authentication model Each message contains everything necessary to authenticate it self Suitable for a coarse grained messaging in which a single message at a time from the same requestor is received WS – Secure Conversation

Message Level SOAP Security WS – Secure Conversation What SSL does at the transport level in point-to-point communication, WS-SecureConversation does at the SOAP layer Removes the need of individual SOAP message carrying authentication information. Establishes a mutually authenticated security context in which a series of messages are exchanged. Uses public key encryption to exchange a shared secret and then onwards uses the shared key

WS-Trust Message Level SOAP Security

Sender Vouches – Subject Confirmation Message Level SOAP Security

Message Level SOAP Security Holder-of-Key – Subject Confirmation

WS-Security Policy Message Level SOAP Security