Securing Web Service Endpoints

<< 8. Securing Web Services | Advantages of Message Security >>

232

ECURING

Web services can be deployed as EJB endpoints or as web (servlet) endpoints.
Securing web service endpoints is discussed in the following chapters:

· For information on securing web service endpoints of an enterprise bean,

read Securing Enterprise Beans (page 1024).

· For information on securing web service endpoints of web components,

read Chapter 9, "Securing Web Applications".

Overview of Message Security

Java EE security is easy to implement and configure, and can offer fine-grained
access control to application functions and data. However, as is inherent to secu-
rity applied at the application layer, security properties are not transferable to
applications running in other environments and only protect data while it is
residing in the application environment. In the context of a traditional applica-
tion, this is not necessarily a problem, but when applied to a web services appli-
cation, Java EE security mechanisms provide only a partial solution.

The characteristics of a web service that make its security needs different than
those of other Java EE applications include the following:

· Loose coupling between the service provider and service consumer

· Standards-based

(read

Organizations, page 236 for a discussion of web services security initia-
tives and organizations)

· Uses XML-formatted messages and metadata

· Highly-focused on providing interoperability

· Platform and programming language neutral

· Can use a variety of transport protocols, although HTTP is used most often

· Supports interactions with multiple hops between the service consumer

and the service provider