IBM WebSphere V5.0 Security - CGISecurity

Requester
Web
Service
Figure 7-18 Direct Trust using basic authentication and Transport-Level Security
The client opens a connection to the Web Service using secure transport. It
sends its request and includes a security token that contains its username and
password. The service authenticates the information, processes the request and
returns the result.
Figure 7-19 Sequence of events for Scenario using
In this scenario, the message confidentiality and integrity are handled using
existing transport security mechanisms.
Figure 7-19 shows the sequence of events for this scenario.
1. The client opens a connection to the Web Service using a secure transport
such as SSL.
2. The client constructs a SOAP message. There is a
element in the header, this element contains the client's username
and password for the service. The password can be sent as plain text
because the transport layer is secure.
3. The message is sent to the service.
4. The service extracts the element and validates the user
name and password.
5. Since the validation succeeded, the service processes the request and
returns the result.
Chapter 7. Securing Enterprise Integration components 151