It has been fascinating to witness how the use for SOA gateways evolved over
time. In 2010, we saw an explosion of market demand for our gateway appliance
product. Here are my thoughts for what I expect to see this year and beyond.
Recent use cases for these types of devices largely focused on B2B
interactions and internal enterprise integration. Many enterprise architects
realized the benefits of using the lightweight ESB-in-a-box deployment model
and gateway-based integration. I don’t think we’ve hit the peak of this
type of use case. I expect the demand for quickly deployed integration, and a
preference for “configure, not code” to continue to accelerate in 2011.
The cost and complexity involved in deploying full-blown software-based ESB
stacks is becoming well known and the alternative provided by best of breed
SOA gateways with their out of box support for exist... (more)
The adoption of cloud by organizations looking for more efficient ways to
deploy their own IT assets or as a means to offset the burden of data
management drives the need for identity federation in the enterprise.
Compounding this is the mobile effect from which there is no turning back.
Data must be available any time, from anywhere and the identities accessing
it must be asserted on mobile devices, in cloud zones, always under the
stewardship of the enterprise.
APIs serve federation by enabling lightweight delegated authentication
schemes based on OAuth handshakes using the sa... (more)
The WS Secure Conversation specification describes a mechanism letting
multiple parties establish a context (using the WS Trust Request Security
Token standard) and secure subsequent SOAP exchanges. Each WS Secure
Conversation session has an associated shared secret. Instead of using this
shared secret directly to sign and encrypt the conversation's messages,
symmetric keys are derived from the secret itself. Deriving new keys for each
message and different keys for signature and encryption limits the amount of
data that an attacker can analyze in attempting to compromise the con... (more)
In the article "The importance of threat protection for restful web
services", I presented a number of content-based threats for XML. When
protecting an endpoint from XML based attacks, not only are payloads scanned
for code injections, malicious entity declarations and parser attacks, XML
documents are actually validated against strict schemas that clearly describe
expected document structures. Enforcing this type of compliance at the edge,
in a SOA gateway for example, minimizes the risk of attacks of the Web
service endpoint. Structure definition languages such as XML Schema ... (more)
Imagine a fresh business relationship between ACME Corporation and Partner.
As a result of this relationship, ACME wants to grant Partner limited access
to one of its core internal applications. They do this, naturally, by
exposing a Web service.
Why Identity Federation?
Boris (an employee at Partner) sends a SOAP request to the ACME Web service
along with some password or proof-of-possession type credentials. Because
Boris's identity is managed outside of ACME, those credentials cannot be
authenticated using ACME's authentication infrastructure.
To circumvent this issue, one cou... (more)