In the article "The importance of threat protection for restful web
services", I presented a number of content-based threats for XML. When
protecting an endpoint from XML based attacks, not only are payloads scanned
for code injections, malicious entity declarations and parser attacks, XML
documents are actually validated against strict schemas that clearly describe
expected document structures. Enforcing this type of compliance at the edge,
in a SOA gateway for example, minimizes the risk of attacks of the Web
service endpoint. Structure definition languages such as XML Schema
Definition (XSD), schematron, XPath are all helpful tools in describing the
type of data and structure of XML documents that are expected at runtime.
alternative to XML and already established as the preferred content-typ... (more)
SOA & WOA Magazine on Ulitzer
Existing brokered authentication standards such as SAML Web Browser SSO or
OpenID accommodate RESTful web services for browser driven use cases.
However, what about RESTful service composition patterns where identities
need to be propagated across nested service invocations, or any RESTful Web
service client that is not browser based for that matter? How should brokered
authentication for such RESTful service calls be handled?
An interesting example of a RESTful Security Token Service (STS) was
described in March 2009 by Pablo Cibraro (aka ‘cibrax’).... (more)
The adoption of cloud by organizations looking for more efficient ways to
deploy their own IT assets or as a means to offset the burden of data
management drives the need for identity federation in the enterprise.
Compounding this is the mobile effect from which there is no turning back.
Data must be available any time, from anywhere and the identities accessing
it must be asserted on mobile devices, in cloud zones, always under the
stewardship of the enterprise.
APIs serve federation by enabling lightweight delegated authentication
schemes based on OAuth handshakes using the sa... (more)
Imagine a fresh business relationship between ACME Corporation and Partner.
As a result of this relationship, ACME wants to grant Partner limited access
to one of its core internal applications. They do this, naturally, by
exposing a Web service.
Why Identity Federation?
Boris (an employee at Partner) sends a SOAP request to the ACME Web service
along with some password or proof-of-possession type credentials. Because
Boris's identity is managed outside of ACME, those credentials cannot be
authenticated using ACME's authentication infrastructure.
To circumvent this issue, one cou... (more)
I often get asked about ‘REST to SOAP’ transformation use cases these
days. Using an SOA gateway like SecureSpan to perform this type of
transformation at runtime is trivial to setup. With SecureSpan in front of
any existing web service (in the DMZ for example), you can virtualize a REST
version of this same service. Using an example, here is a description of the
steps to perform this conversion.
Imagine the geoloc web service for recording geographical locations. It has
two methods, one for setting a location and one for getting a location. See
below what this would look like i... (more)