IBM WebSphere V5.0 Security - CGISecurity

Example 7-4 Secured and non-secured Web Services together
unprotectedRPCRouter
unprotectedRPCRouter
com.ibm.soap.server.http.WASRPCRouterServlet
FaultListener
org.apache.soap.server.DOMFaultListener
protectedRPCRouter
Apache-SOAP RPC Router
no description
com.ibm.soap.server.http.WASRPCRouterServlet
faultListener
org.apache.soap.server.DOMFaultListener
This security configuration can even be defined using Application Assembly Tool
(AAT). For more information, look at Chapter 10, “Administering WebSphere
security” on page 233
7.1.3 WS-Security
The Web Services Security specification (WS-Security) provides a set of
mechanisms to help developers of Web Services secure SOAP message
exchanges. Specifically,WS-Security describes enhancements to the existing
SOAP messaging to provide quality of protection through the application of
message integrity, message confidentiality, and single message authentication to
SOAP messages. Additionally, WS-Security describes how to encode binary
security tokens (a security token represents a collection of claims such as name,
identity, key, group, privilege, capability and so on) and attach them to SOAP
messages.
Security tokens assert claims which can be coupled with digital signatures to
provide mechanisms for demonstrating evidence of the sender’s knowledge of
the keys described by the security token. In addition, the definition of a SOAP
header element provides a mechanism for "binding" or "associating" the
signature with the claims in the security token.
146 IBM WebSphere V5.0 Security Handbook