Prabath Siriwardena's presentation on authentication and authorization patterns for web services
•
2 likes•1,417 views
@ApacheCon 2011
Recommended
More Related Content
Similar to Prabath Siriwardena's presentation on authentication and authorization patterns for web services
Similar to Prabath Siriwardena's presentation on authentication and authorization patterns for web services (20)
More from Prabath Siriwardena
More from Prabath Siriwardena (20)
Recently uploaded
Recently uploaded (20)
Prabath Siriwardena's presentation on authentication and authorization patterns for web services
- 1. Prabath Siriwardena – Software Architect, WSO2
- 2. Plan for the session Patterns Standards Implementations
- 4. Patterns Authentication Confidentiality Authorization Patterns Patterns Patterns
- 5. 1995 1997
- 7. 1999
- 8. 2004
- 9. 2005 SAML2 Web SSO
- 10. 2008/May
- 11. Authentication Patterns Direct Brokered Authentication Authentication
- 12. Direct Authentication for Web Services Transport Level Basic Authentication Mutual Authentication 2-legged OAuth
- 13. Direct Authentication for Web Services Message Level UsernameToken Profile with WS-Security Signing – X.509 Token Profile with WS-Security
- 14. Brokered Authentication for Web Services Transport Level Mutual Authentication 2-legged OAuth
- 15. Brokered Authentication for Web Services Message Level WS-Trust / STS Resource STS WS-Federation Signing – X.509 Token Profile with WS-Security Kerberos Token Profile for WS-Security
- 17. 2006/April
- 18. 2006/June
- 19. 2008/2009
- 20. 2008/2009
- 21. 2008/2009
- 22. 2007/Dec
- 23. 2007/Dec
- 24. Authorization Patterns Direct Delegated Authorization Authorization
- 25. Authorization ActAs in WS-‐Trust 1.4 Patterns Direct Delegated Authorization Authorization
- 26. 2005/Feb
- 27. Message Level Security Solution Patterns Message Interceptor Gateway Pattern Trusted Sub System Pattern
- 28. Message Level SOAP Security UsernameToken Profile
- 29. SOAP Security Key Identifiers Message Level X.509 Token Profile & Key Referencing Direct References
- 30. Message Level SOAP Security Symmetric Binding Vs Asymmetric Binding
- 31. SOAP Security • WS-‐Security secures SOAP – focuses on Message Level WS – Secure Conversation message level security • Focuses on a single message authentication model • Each message contains everything necessary to authenticate it self • Suitable for a coarse grained messaging in which a single message at a time from the same requestor is received
- 32. Message Level SOAP Security • What SSL does at the transport level in point-‐to-‐point WS – Secure Conversation communication, WS-‐SecureConversation does at the SOAP layer • Removes the need of individual SOAP message carrying authentication information. • Establishes a mutually authenticated security context in which a series of messages are exchanged. • Uses public key encryption to exchange a shared secret and then onwards uses the shared key
- 33. Message Level SOAP Security WS-Trust
- 34. Message Level SOAP Security Sender Vouches – Subject Confirmation
- 35. Message Level SOAP Security Holder-of-Key – Subject Confirmation
- 36. SOAP Security WS – Security Policy http://wso2.org/library/3132 http://wso2.org/library/3786