IBM WebSphere V5.0 Security - CGISecurity

intermediaries to forward messages. Specifically, the SOAP message modeloperates on logical endpoints that abstract the physical network and applicationinfrastructure and therefore frequently incorporates a multi-hop topology withintermediate actors.Point-to-point configurationAvailable Security solutions such as Secured Socket Layer (SSL) / TransportLayer Security (TLS) and IPSec, like network layer solutions, provide featuressuch as authentication, data integrity and data confidentiality. But the mainproblem is that these solutions enable only point-to-point secure sessions.Security Context{Security Context{Requester Intermediary Web ServiceFigure 7-15 Point-to-point configurationEnd-to-end configurationWhen data is received and forwarded by an intermediary beyond the transportlayer, both the integrity of data and any security information that flows with it maybe lost. This forces any upstream message processors to rely on the securityevaluations made by previous intermediaries and to completely trust theirhandling of the content of messages. What is needed in a comprehensive WebService security architecture is a mechanism that provides end-to-end security.Successful Web Service security solutions will be able to leverage both transportand application layer security mechanisms to provide a comprehensive suite ofsecurity capabilities.Security ContextRequester Intermediary Web ServiceFigure 7-16 End-to-end configurationSecurity Token Service ModelThe following section explains the Security Token Service Model which enablesus to achieve our end-to-end security goals. Figure 7-17 shows that anyrequester may also be a service, and that the Security Token Service may alsofully be a Web Service, expressing policy and requiring security tokens.Chapter 7. Securing Enterprise Integration components 149