IBM WebSphere V5.0 Security - CGISecurity

6. The service fetches the certificate from the specified URL location.
7. The service verifies the certificate, its validity and its signature.
8. When the service authenticates the certificate, it processes the message and
returns a result.
Firewall processing
Firewalls remain a critical component of the Web Services security architecture
and WS-Security Specifications also address security on the firewall.
Authorized
Requester
Requester
Web
Service
Unauthorized
Requester
Figure 7-24 Firewall processing
As shown in Figure 7-25, the firewall processes the incoming SOAP messages
and only allows those from authorized clients to penetrate the firewall.
Figure 7-25 Scenario using firewall processing
In this scenario, the firewall observes the security tokens used to sign the
message. If the signature is valid, and the signing authority for the security token
is trusted to authorize messages into the firewall, then the message is allowed;
otherwise it is rejected. In some cases, a signature may specifically reference the
firewall as a SOAP actor.
154 IBM WebSphere V5.0 Security Handbook