IBM WebSphere V5.0 Security - CGISecurity

Example 7-4 Secured and non-secured Web Services togetherunprotectedRPCRouterunprotectedRPCRoutercom.ibm.soap.server.http.WASRPCRouterServletFaultListenerorg.apache.soap.server.DOMFaultListenerprotectedRPCRouterApache-SOAP RPC Routerno descriptioncom.ibm.soap.server.http.WASRPCRouterServletfaultListenerorg.apache.soap.server.DOMFaultListenerThis security configuration can even be defined using Application Assembly Tool(AAT). For more information, look at Chapter 10, “Administering WebSpheresecurity” on page 2337.1.3 WS-SecurityThe Web Services Security specification (WS-Security) provides a set ofmechanisms to help developers of Web Services secure SOAP messageexchanges. Specifically,WS-Security describes enhancements to the existingSOAP messaging to provide quality of protection through the application ofmessage integrity, message confidentiality, and single message authentication toSOAP messages. Additionally, WS-Security describes how to encode binarysecurity tokens (a security token represents a collection of claims such as name,identity, key, group, privilege, capability and so on) and attach them to SOAPmessages.Security tokens assert claims which can be coupled with digital signatures toprovide mechanisms for demonstrating evidence of the sender’s knowledge ofthe keys described by the security token. In addition, the definition of a SOAPheader element provides a mechanism for "binding" or "associating" thesignature with the claims in the security token.146 IBM WebSphere V5.0 Security Handbook