Identity patterns and anit-patterns in real world web services
•
3 j'aime•1,786 vues
The document discusses various identity and security patterns for web services, including direct authentication, brokered authentication, data origin authentication, trusted subsystem, and message interceptor gateway patterns. It describes problems that each pattern addresses, such as unauthenticated access, delegating authentication to external users, message manipulation, controlling downstream access, and centralized security enforcement. Implementation examples including WS-Security, WS-Trust, and open standards are also provided.
Recommandé
Recommandé
Contenu connexe
Similaire à Identity patterns and anit-patterns in real world web services
Similaire à Identity patterns and anit-patterns in real world web services (20)
Plus de Prabath Siriwardena
Plus de Prabath Siriwardena (20)
Dernier
Dernier (20)
Identity patterns and anit-patterns in real world web services
- 1. Identity patterns & anti-patterns in real world web services ~ By Prabath Siriwardena, WSO2
- 20. Anyone can access my Service
- 23. WSDL WSDL WSDL
- 24. WSDL WSDL WSDL
- 25. Transport Level Security Vs Message Level Security
- 28. <wsse:UsernameToken wsu:Id="Example-1"> <wsse:Username> ... </wsse:Username> <wsse:Password Type="..."> ... </wsse:Password> <wsse:Nonce EncodingType="..."> ... </wsse:Nonce> <wsu:Created> ... </wsu:Created> </wsse:UsernameToken>
- 29. BasicAuth with Transport Level Security
- 30. Direct Authentication Pattern Problem : How to avoid anonymous users accessing a web service
- 31. Direct Authentication Pattern Solution : The web service acts as an authentication service to validate credentials from the client.
- 32. Direct Authentication Pattern Implementation(s) : UsernameToken with WSSE BasicAuth with TLS
- 35. Exception Shielding Pattern Problem : Exception data output by a service containing implementation details could compromise the security of the service
- 36. Exception Shielding Pattern Solution : Potentially unsafe exception data is "sanitized" by replacing it with exception data that is safe by design before it is made available to consumers
- 37. Users OUT SIDE Our Domain Need ACCESS
- 38. Direct Authentication needs us to maintain user credentials internally
- 39. We don’t have the credential of external users
- 40. Direct Authentication doesn’t solve our problem
- 41. Can’t we delegate Authentication to the External Domain itself
- 46. WS-TRUST
- 47. Brokered Authentication Pattern Problem : How to avoid anonymous users accessing a web service and give access to users outside our domain, where we don’t have the users’ credentials to validate
- 48. Brokered Authentication Pattern Solution : Delegate authentication to a third party who knows to validate user credentials and the service trusts the assertions provided by that particular third party
- 49. Brokered Authentication Pattern Implementation(s) : WS-Trust OpenID, Information Cards, OAuth
- 50. How do we know the legitimacy of the third party Security Token Service ?
- 52. Data Origin Authentication Pattern Problem : How do we prevent an attacker from manipulating messages in transit between a client and a web service.
- 53. Data Origin Authentication Pattern Solution : Validate message integrity and non- repudiation with message signature
- 54. Our services access downstream resources with the authenticated user’s credentials
- 55. This could bring security risks – and make down stream resources vulnerable to attacks
- 56. How about controlling user access to the down stream resources
- 57. Service acts as the client – with service’s credentials
- 59. Trusted Sub System Pattern Problem : A consumer that accesses backend resources of a service directly can compromise the integrity of the resources and can further lead to undesirable form of implementation coupling.
- 60. Trusted Sub System Pattern Solution : The service is designed to use it’s own credentials for authentication and authorization with backend resources on behalf of the consumers
- 61. Patterns @ Work…
- 64. Message Interceptor Gateway Pattern Problem : Different services deployed could have different security policies and a security vulnerability of the weakest service could be exploited to create loop holes in entire system.
- 65. Message Interceptor Gateway Pattern Solution : Provides a single entry point and allows centralization of security enforcement for incoming and outgoing messages.
- 67. Thank You…!!!