Follow Us on Twitter

Securing your web services with SAML

by Edwin Biemond on October 29, 2009 · 1 comment

After securing you web applications with SAML is the next step to secure your web services with SAML Sender Vouches ws-security policy, this can be complex because you need to know a lot over the weblogic server configuration and its java security frameworks. For example you need to configure two Weblogic servers, the first is the Web Service server and the second server is the Secure Token Service (STS). After that you need to add some client credential providers to the generated web service proxy client.
This is how SAML Sender Vouches works and what we need to do in weblogic / java.

The short version is, the web service proxy client call the STS server to get an SAML assertion on behalf of the User to call the Web Service.

The long version, the user provides its credentials to the ws proxy client and the ws proxy client calls the STS server and provides the username / password of the user and the client key.
The STS validates the user and the ws proxy client certificate and the STS returns the STS identity assertion to the ws proxy client. The ws proxy client uses this STS assertion together with the ws client and ws server certificate to call the web service.

Click here for the whole article

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

{ 0 comments… add one now }

Leave a Comment


{ 1 trackback }

Previous post:

Next post:

About Whitehorses
Company profile

Whitehorses website

Home page

Follow us
Blog post RSS
Comment RSS