Identity and access management represent a cross-cutting concern in IT-systems that is en-abling security services such as authentication, SSO, and authorization. This contribution will analyze the applicability of recent technology innovations for service-oriented architectures. An emphasis will be laid on identity federation. Based on this analysis, the presentation will investigate the security architecture of a frame-work for component-based, service-oriented real-time communication services currently be-ing built at Siemens Communications.

1. Identity and Access Management in Service-Oriented Architectures Dieter Hemkemeyer and Oliver Pfaff

3. Setting the Scene Rationale of the SOA Framework at Siemens Com Today: Application 1 Application 2 Application 3 … Applications Tomorrow: Application 1 Application 2 Application 3 SOA framework … Applications Framework Cross-cutting concerns

4. Setting the Scene Service Invocation Scenario SOA framework SOA framework Message Caller (e.g. Web-tier) Users Business service Resource beSecret Method doMagic Method doMagic Business delegate

9. Setting the Scene How to Accommodate IAM? Where to accommodate IAM? Which IAM concepts and services to support? Which IAM technologies to implement? How to architect this cross-cutting concern? … Application 1 Application 2 Application 3 SOA framework … Applications Framework

21. Security Architecture of the SOA Framework How to Architect this Cross-Cutting Concern? Caller (e.g. Web-tier) Business delegate SOA framework Business service SOA framework Policy engine (PDP) Attribute handlers (opt.) PEP Message with authentication statement Authentication verifier Authenticated subject ID and attributes Various authentication methods and domains of identity Message Authentication authority SOA framework Attribute handlers (opt.) Federation manager Identity information Caller (e.g. Web-tier) Business delegate SOA framework