In-Depth
Mapping Security to Services-Oriented Architecture
What security hurdles can you overcome when using XML to develop against a services layer? A whiteboard diagram of security requirements mappings in an SOA shows you the way.
- By Mark O'Neill
- 03/01/2005
Architects developing against a services layer using XML, rather than directly against an ERP/legacy layer, face three security challenges: 1) persisting a "security context" from the end user or client to the business systems; 2) ensuring that an unauthorized user sending malicious XML is blocked from the Web service; and 3) blocking rogue XML messages that bypass the XML gateway.
To understand how security requirements are mapped to a typical services-oriented architecture, the diagram shows Web services deployed at the consumer and access layers (through Web portals where end users interface indirectly with Web services and in application-to-application communication where no end user is involved), and at the services layer (across an XML message bus or other type of orchestration engine). At the systems layer, business applications have security profiles that must be mapped to the end users or Web service, client applications.
To avoid losing the client/user security context between the access layer (where the identity of the client or user is authenticated) and the services layer (where applications authorize and tailor responses to the end user or client), security tokens (such as a SAML assertion or WS-Security UsernameToken) are inserted into XML messages.
With wireless LANs, VPNs, and distributed networks, passing XML traffic to the services layer through the XML gateway cannot always be guaranteed. Therefore, security must be "deperimeterized" by enforcing security rules at the services layer, close to the end point.
To pass security context with XML messages sent to and within a services layer, architectures should reuse existing directories with user or policy information rather than establishing a new silo just for Web services. An XML security server, containing links to existing security architecture, is used to for this purpose.
Remember that availability and administration are aspects of security, too. Existing network management tools can be reused to aggregate alerts and quality-of-service indicators generated at the services layer.
About the Author
Mark O'Neill is chief technology officer at Vordel, a provider of XML security technology. He is the author of Web Services Security (McGraw-Hill Osborne Media, 2003). Contact Mark at [email protected].