IBM WebSphere V5.0 Security - CGISecurity

7.1 Web Services security
Web Services has become a hot area in relation to Web applications; it is a fairly
new technology with remarkable promise. There are areas in Web Services yet
to be explored or refined; like security, it is an essential part of Web Services, but
the recommendations have been just worked out recently and it will take time for
them to mature.
This book will not introduce the concept of Web Services, and it will not discuss
the Web Services architecture; for a good introduction and more details on this
topic read the IBM Redbook: Web Services Wizardry with WebSphere Studio
Application Developer, SG24-6292.
In this section you will find information on how to create a secured Web Service
using digital certificates in WebSphere Studio. You will find an introduction to the
WS-Security recommendation, providing the security fundamentals for Web
Services. We will also discuss how the Web Services Gateway is involved in
Web Services security.
7.1.1 Digital Certificates
Digital signatures provide integrity, signature assurance and non-repudiation
over Web data. Such features are especially important for documents that
represent commitments such as contracts, price lists, and manifests. In view of
recent Web technology developments, the proposed work will address the digital
signing of documents (any Web resource addressable by a URI) using XML
syntax. This capability is critical for a variety of electronic commerce applications,
including payment tools.
Developing secure Web Services with WebSphere Studio
Now we are going to write a secured Web Service to provide customer account
balance details.
There is one pattern of evolving Web Services from an existing Web Server
application known as “Browser to Server Pattern”. This pattern wraps an existing
application as a service using a SOAP message as the service invocation. The
Web server provides a runtime execution container that defines its own security
model with policy information derived from a deployment descriptor configured
by the deployer of the Web server application. This pattern typically includes a
mechanism for associating the identity of the invoking entity (the browser client)
with the executing application instance and allows the application to continue to
function as it did before.
126 IBM WebSphere V5.0 Security Handbook