SOA Security: Were Halfway

1

• SOA Security Were Halfway

K. Scott Morrison Director, Layer 7 Technologies
2
SOA Fundamentals
SOA Producer (Server)
Message
SOA is still ultimately about basic application
communication
SOA Consumer (Client)
3
The SOA Security Gateway
SOA Producer (Server)
Gateway acting as Policy Enforcement Point (PEP)
Last mile
Identity Mgmt
Access Mgmt
LDAP
Policy Decision Points (PDPs)
SOA Consumer (Client)
4
WSDL
The Problem with Gateways
SOA Producer (Server)
WSDL Security Changes
Which API do you program to?
First mile
Shift of burden to client
Administrative changes to policy change API
Security implemented in code is difficult to
change
SOA Consumer (Client)
Very programmer intensive
5
We Need Policy Application Points
SOA Producer (Server)
Gateway acting as Policy Enforcement Point (PEP)
Policy Application Point
WS-Policy from enforcement point
WS-MetadataExch.
WS-Policy from trusted repository
Local WS-Policy
Policy Repository