IBM WebSphere V5.0 Security - CGISecurity

Direct Trust using Security TokensThis scenario illustrates the use of a security token that is directly trusted by aWeb Service.RequesterWebServiceFigure 7-20 Direct Trust using Security TokensHere direct trust means that the requester's security token (or its signingauthority) is known and trusted by the Web Service. This scenario assumes thatthe two parties have used some mechanism to establish a trust relationship forthe use of the security token. This trust may be established manually, byconfiguring the application, or by using a secure transport to exchange keys. Bysecure transport of keys, we mean that a transport such as SSL (or anothermechanism or process) can be used as a way for a trusted party to assert thevalidity of a key or security token to a recipient party. No assumption is madeabout the organizational relationship between the parties.Figure 7-21 Sequence of events for using Direct Trust using Security TokensFigure 7-21 shows the sequence of events for this scenario. As you can see,there is no SSL handshake as happened in the previous scenario.1. The client sends a message to a service and includes a signed security tokenand provides proof-of-possession of the security token.2. The service verifies the proof and evaluates the security token.3. If the signature on the security token is valid and is directly trusted by theservice then it processes the request and returns a result.Security Token AcquisitionIn some cases, the security token used is not passed as part of the message.Instead, a security token reference is provided that can be used to locate andacquire the token.152 IBM WebSphere V5.0 Security Handbook