IBM WebSphere V5.0 Security - CGISecurity

Policy
Requester
Security
Token
Service
Policy
Security
Token
Claims
Claims
Security
Token
Web
Service
Policy
Security
Token
Claims
Figure 7-17 Security Token Service Model
A Web Service can require that an incoming message prove a set of claims (for
example: name, key, permission, capability, and so on). If a message arrives
without having the required claims, the service may ignore or reject the message.
We refer to the set of required claims and related information as policy.
A requester can send messages with proof of the required claims by associating
security tokens with the messages. Thus, messages both demand a specific
action and prove that their sender has the claim to demand the action.
When a requester does not have the required claims, the requester or someone
on its behalf can try to obtain the necessary claims by contacting other Web
Services. These other Web Services, which we refer to as security token
services, may in turn require their own set of claims. Security token services
broker trust between different trust domains by issuing security tokens.
Scenarios
The following sections discuss some of the WS-Security scenarios. Only a few of
the possible scenarios are covered here, those that will provide you with an
introduction to the topic and an easy understanding of it.
Direct Trust using basic authentication and Transport-Level
Security
In this scenario, the requester opens a connection to the Web Service by
exchanging a public key pair to establish a secure channel over an HTTP
connection. Then the server prompts for user ID and password through an HTTP
message exchange and these user credentials are carried through the HTTP
headers.
150 IBM WebSphere V5.0 Security Handbook