1. WEB401 Security Practices for Web Services (Part 2) Keith Ballinger Program Manager XML Messaging Microsoft Corporation

2. Agenda Trusting clients and services Enabling a manageable B2B infrastructure Creating a security context Faster security performance Authoring security policy Removing the need for writing a lot of security code

3. Trust Relationships and identity How do I prove who I am? Who can vouch for me? How do you know you can trust him? These questions are answered with signed security tokens WS-Trust defines a protocol for issuing and obtaining security tokens

4. Trust Several models for issuing tokens Client obtains token Service obtains token for client Etc… Client Token Issuer Service ClientService Token Issuer 2 Token Issuer 1 Client Token Issuer Service

5. Trust Requesting a security token (RST)... Issuing a security token (RSTR)

6. Trust RST is usually signed with a token the token issuer trusts RSTR issues new token Proof of possession token can also returned This token includes a key that the requestor can use to prove he’s allowed to use the issued token

7. Issuing a custom XML-based security token demo demo

8. Secure conversation Token issuing can also occur between two parties Client Service And Token Issuer Typically, this is done to create higher performance security processing WS-SecureConversation is an example

9. Secure conversation WS-SecureConversation details how to issue a SecurityContextToken In WSE, this lightweight token takes the place of a more processing intensive token Client Service And Token Issuer Request for SCT SCT Issued to client Series of messages signed with issued SCT

10. Building a Secure Conversation with WSE demo demo

11. Policy Beyond what WSDL provides, what else is needed to describe a Web service? Security requirements Reliable messaging assurances Protocol versioning Etc… These other attributes of a service can be described with WS-Policy XML-base language Complex:,, etc…

12. Policy <wsp:Policy wsu:Id="message-age"> <wsse:MessageAge wsp:Usage="wsp:Required" Age="5“ />

13. Security policy WS-SecurityPolicy specifies the assertions for expressing requirements related to WS- Security Can be embedded inside the other two

14. Security Policy X509v3 wsp:Body()

15. Role-based security IPrincipal is the.NET interface for role- based authoriztion bool IsInRole(String str) SecurityToken.Principal Implementation of IPrincipal Automatically set for UsernameToken and KerberosSecurityToken Call method explicitly or use Policy

16. Role-Based Authorization using Security Policy demo demo

17. Suggested Reading And Resources The tools you need to put technology to work! TITLE Available Writing Secure Code, Second Edition:0-7356-1722-8 Today Microsoft Press books are 20% off at the TechEd Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt

18. Community Resources http://www.microsoft.com/communities/default.mspx Most Valuable Professional (MVP) http://www.mvp.support.microsoft.com/ Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http://www.microsoft.com/communities/newsgroups/default.mspx User Groups Meet and learn with your peers http://www.microsoft.com/communities/usergroups/default.mspx

19. evaluations evaluations

20. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.