Implementing a security aspect in a SOAP message

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT SOA governance and standards UDDI clients and UDDI implementations Creating an enterprise data dictionary Hard vs. live real time systems Service contract tools Open source UDDI tools SOA policy management Service reuse rules WSDM lagging behind WS-Management The status of JBI WSDL 1.1 vs. WSDL 2.0 WS-Security (Web services security standards) The technology of Web Service Security Web 2.0 at the old ballgame SOA complicated by ESB proliferation BPEL4People and WS-HumanTask get reference implementation Liberty offers Web 2.0 open source security The case against WS-Security SOA governance, security concerns drive XACML interop New BizTalk Services rolling out Will acquisitions stifle SOA innovation? Burton: WS-* specs good, but SOA security needs more

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Web Services Trust Language  (SearchSOA.com) WS-Security  (SearchSOA.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

The OASIS Web Services Security: SOAP Message Security v1.0 specification (more commonly known as WS-Security) defines a standard for attaching security information to a SOAP message. It supports XML encryption, XML signatures and various security tokens (Username, X.509, SAML, REL, Kerberos and custom tokens).

Most Web services platforms now provide integrated support for WS-Security, although you will need to upgrade to the latest release of your favorite platform to get it. .NET supports WS-Security via the Web Services Enhancements (WSE) framework. Apache Axis supports WS-Security via WSS4J.

Typically, a security header block is created and processed by a handler. The specific means by which you configure the handler will be dependent on the product in question. In most circumstances, though, the handler and the settings are defined using configuration files rather than code.

WS-I is developing a Basic Security Profile, which provides interoperability guidance. The profile is still in draft stage, though, and is subject to change.