1. Prabath Siriwardena – Software Architect, WSO2

2. Patterns Standards Implementations Plan for the session

3. Recurring Problems

4. Patterns Authentication Patterns Confidentiality Patterns Authorization Patterns

5. 1995 1997

7. 1999

8. 2004

9. 2005 SAML2 Web SSO

10. 2008/May

11. Authentication Patterns Direct Authentication Brokered Authentication

12. Basic Authentication Mutual Authentication 2-legged OAuth Direct Authentication for Web Services Transport Level

13. UsernameToken Profile with WS-Security Signing – X.509 Token Profile with WS- Security Direct Authentication for Web Services Message Level

14. Mutual Authentication 2-legged OAuth Brokered Authentication for Web Services Transport Level

15. WS-Trust / STS WS-Federation Brokered Authentication for Web Services Message Level Signing – X.509 Token Profile with WS- Security Kerberos Token Profile for WS-Security Resource STS

17. 2006/April

18. 2006/June

19. 2008/2009

22. 2007/Dec

24. Authorization Patterns Direct Authorization Delegated Authorization

25. Authorization Patterns Direct Authorization Delegated Authorization ActAs in WS-Trust 1.4

26. 2005/Feb

27. Message Interceptor Gateway Pattern Trusted Sub System Pattern Security Solution Patterns Message Level

28. UsernameToken Profile SOAP Security Message Level

29. X.509 Token Profile & Key Referencing Message Level SOAP Security Key Identifiers Direct References

30. Symmetric Binding Vs Asymmetric Binding Message Level SOAP Security

31. Message Level SOAP Security WS-Security secures SOAP – focuses on message level security Focuses on a single message authentication model Each message contains everything necessary to authenticate it self Suitable for a coarse grained messaging in which a single message at a time from the same requestor is received WS – Secure Conversation

32. Message Level SOAP Security WS – Secure Conversation What SSL does at the transport level in point-to-point communication, WS-SecureConversation does at the SOAP layer Removes the need of individual SOAP message carrying authentication information. Establishes a mutually authenticated security context in which a series of messages are exchanged. Uses public key encryption to exchange a shared secret and then onwards uses the shared key

33. WS-Trust Message Level SOAP Security

34. Sender Vouches – Subject Confirmation Message Level SOAP Security

35. Message Level SOAP Security Holder-of-Key – Subject Confirmation

36. WS-Security Policy Message Level SOAP Security