IBM WebSphere V5.0 Security - CGISecurity

This scenario would operate as follows:1. The client constructs a SOAP message and sends it to a Web Service.2. The message passes through a firewall prior to arriving to the Web Service.3. The firewall examines the security token(s) and signatures in the header.4. The firewall makes an assessment of the validity of the message and possiblyusing external data, makes a determination as to whether or not to authorizethe message passing through the firewall.When the SOAP message is without any encryption, the firewall can examine themessage headers for authorization, but what if it is encrypted? For end-to-endsecurity, SOAP message is encrypted. However, a message can still be validatedas follows:1. After signing and encrypting the message, the client adds an additional header with the firewall listed as the SOAP actor. Into this headerblock the client places a element containing a signature overthe encrypted data. Also, using , the signature isprepended.2. From the header, the firewall reads and validates the securitytoken and signature.3. The firewall then makes a determination, possibly using external data, as towhether or not to authorize the message to pass through the firewall.7.1.4 Security with the Web Services GatewayWebSphere Web Services GateWay is bundled with WebSphere ApplicationServer V5 Network Deployment package. After installing Network Deployment,we need to install the wsgw.ear and wsgwsoap1.ear on the application server.Gateway Security ImplementationWeb Services GateWay provides HTTP Basic Authentication and anauthorization mechanism based upon the security features provided byWebSphere Application Server.Important: Gateway-level authentication must be enabled for enablingoperational-level authentication. You must do the same even before installingchannels. When we enable gateway-level authentication, filters will haveaccess to the request’s authentication information.Chapter 7. Securing Enterprise Integration components 155