Single Sign On (SSO) in SOA

A common problem that I see in the field is how to enforce the security policy in the execution context of a service (are those enough SOA concepts in one sentence for you?). The market is full of Federated Identity Management tools. Once you decide on what identity management package you will use, you have the task to actually integrate that solution with the rest of your infrastructure.

Let's supposed that you decide to go with a SAML token solution from a vendor that is big and blue for example. The way this will work, is the identity management server will either intercept or redirect the initial communication going to your services, and challenge the service consumer to provide credentials. If the identity server accepts the credentials it will consider the service consumer authenticated and place a SAML token in the header of the request to the service.

Now, suppose the service the consumer is trying to access is a web service. What the identity server will do is place a SAML token in the SOAP header of the request going to the web service. All the web service container needs to do now is verify that the request has a valid SAML token. This would take care of authentication. By accepting the token the web services acknowledges that the consumer is who it pretending to be. The SAML authentication process is actually more involved than that, but for the example this will do.

If you are using JBoss, this is what you need to do to make your web services accept the token:

a) Create a generic handler (according to the JSR 109 specifications) that gets called before it ever hits the endpoint. You insert this handler in the chain. You make the handler deny the request if the
SAML token in the SOAP header is not valid.

b) You set the principal in the SOAP envelope to the principal that you read from the token. This will allow your JAAS login module to have a Subject loaded.

c) You create a custom JAAS login module that takes the Subject and performs authorization. Just because the consumer is who it say it is, it does not mean that it has access to this particular service. A common solution is to save the user/roles information for JAAS login module in an LDAP server. Then, the login module loads what roles are assigned to the user and the application server decides whether the role can access the resource or not. You define what roles can access a resource in the application configuration files.

This architecture will work with other type of tokens, or non token based federated identity management. In this particular case the authentication was separated from the authorization because of limitations with federated system. The SAML token can easily contain the role information for the user, so the application server does not have to hit the LDAP server as well.

Let me know if you need more details or have any questions, comments, etc.

Comments

[Project Management Software]

All businesses that are web based can take advantage of the features of project management. Whether it's bake shop, bank, landscaping, or construction, the software will help all team leaders. The software is also customizable to fit any business. With the tools that are available team leaders will be able to input what they want and what they don't want.

[Computer Support Los Angeles]

By applying project management software to your company, you will instantly have a pleasurable time in dealing with any project that comes about. It is important that you are kept as organized as possible because of the possibility that you could miss something. That mistake could end up costing you and your project a successful completion.

[Article Submission Website]

you are giving the best information about (SSO) in SOA but there are not enough.

[incall agency toronto]

Nice post.I am glad to see so much response at here.

[toronto escorts]

I want to get more and more news and update from this site to increase my knowledge in this direction.

[ugg boots outlet]

Good post is like good cooking;it can be tasted,but not explained.

[cheap air jordans]

I want to bring out the secrets of nature and apply them for the happiness of man . I don't know of any better service to offer for the short time we are in the world .

[moncler jackets]

I did not discuss that particular issue!!

[nike air max]

I was once asked.*_*

[Air Jordan]

I tremble for my country when I reflect that God is just, that His justice cannot sleep forever. Do you agree?

[Nike Air Max]

i agree with your views from here.

[Coach Outlet Online]

So fun article is! I agree the idea!

[Cheap Louis Vuitton Bags]

The court of appeals granted the plaintiffs’ petition and overruled the trial court’s order. The court of appeals employed the balancing test found in Valley Bank. The court first found the objectors met the criteria to establish the requested documents were an invasion of their privacy. The plaintiffs then demonstrated that the requested information was directly relevant to their claims and essential to a fair resolution of the lawsuit. Thus, the information was discoverable. The court of appeals found that the trial court’s failure to analyze each category of requested information under the standard of Valley Bank was an abuse of discretion.

[Cheap Nike Shox]

For as long I can remember I've wanted to fly. It seems for just as long I've dreamt of owning my own aeroplane. My own little machine. For the last 5 years I've been saving hard and it was difficult because we just bought a house at the same time as I started saving. All a long the motivation had been aviation - and the promise of free money from the government. That savings plan has matured now and there a serious risk of the money incinerating my pocket.

[Buy Generic Levitra]

Nice, de visiter votre blog à nouveau, il a été pour moi mois. Eh bien cet article que j'ai été attendu pendant si longtemps. J'ai besoin de cet article pour compléter ma mission au sein du collège, et il a même sujet avec votre article. Merci, grande part.

[lacoste 2010 shoes]

All a long the motivation had been aviation - and the promise of free money from the government. That savings plan has matured now and there a serious risk of the money incinerating my pocket.

[WillieGarrett29]

That's understandable that money can make people independent. But what to do if one does not have money? The one way is to get the home loans and just sba loan.

[Dr Dre Solo]

so good

[loan]

Do you understand that it's high time to receive the home loans, which would realize your dreams.