IBM WebSphere V5.0 Security - CGISecurity

PolicyRequesterSecurityTokenServicePolicySecurityTokenClaimsClaimsSecurityTokenWebServicePolicySecurityTokenClaimsFigure 7-17 Security Token Service ModelA Web Service can require that an incoming message prove a set of claims (forexample: name, key, permission, capability, and so on). If a message arriveswithout having the required claims, the service may ignore or reject the message.We refer to the set of required claims and related information as policy.A requester can send messages with proof of the required claims by associatingsecurity tokens with the messages. Thus, messages both demand a specificaction and prove that their sender has the claim to demand the action.When a requester does not have the required claims, the requester or someoneon its behalf can try to obtain the necessary claims by contacting other WebServices. These other Web Services, which we refer to as security tokenservices, may in turn require their own set of claims. Security token servicesbroker trust between different trust domains by issuing security tokens.ScenariosThe following sections discuss some of the WS-Security scenarios. Only a few ofthe possible scenarios are covered here, those that will provide you with anintroduction to the topic and an easy understanding of it.Direct Trust using basic authentication and Transport-LevelSecurityIn this scenario, the requester opens a connection to the Web Service byexchanging a public key pair to establish a secure channel over an HTTPconnection. Then the server prompts for user ID and password through an HTTPmessage exchange and these user credentials are carried through the HTTPheaders.150 IBM WebSphere V5.0 Security Handbook