End-to-end paths for web services - Security (WS-Security)
The Web Services Security specification defines core facilities
for protecting the integrity and confidentiality of a message, and
provides mechanisms for associating security-related claims with a
message.
Subtopics:
Securing web services applications at the transport level
Transport-level security is a well-known and often used
mechanism to secure HTTP Internet and intranet communications. Transport
level security can be used to secure web services messages. Transport-level
security functionality is independent from functionality that is provided
by message-level security (WS-Security) or HTTP basic authentication.
Authenticating web services clients using HTTP basic authentication
A simple way to provide authentication data for the service
client is to authenticate to the protected service endpoint by using
HTTP basic authentication. HTTP basic authentication uses a
user name and password to authenticate a service client to a secure
endpoint.
Securing web services using Security Markup Assertion Language (SAML)
The Security Assertion Markup Language (SAML) is an XML-based
OASIS standard for exchanging user identity and security attributes
information. Using SAML, a client can communicate assertions regarding
the identity, attributes, and entitlements of a SOAP message. You
can apply policy sets to JAX-WS applications to use SAML assertions
in web services messages and in web services usage scenarios. Use
SAML assertions to represent user identity and user security attributes,
and optionally, to sign and to encrypt SOAP message elements.
Last updated: April 18, 2014 05:01 AM CDT http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-iseries&topic=welc6tech_wbs_security_thr File name: welc6tech_wbs_security_thr.html