Chapter 7. Security
Virtually every enterprise application exposed through a Web service has a need for security at some level. An enterprise's data is an important asset to every business, and a good security system is necessary to ensure its safety and integrity. Businesses need to safeguard their systems and their data resources from malicious use by unauthorized intruders, both internal and external to the business, and from inadvertent or unintended mischief. Businesses also must keep message exchanges with other entities secure.
Security for Web services is two-fold: It encompasses both the security requirements of a typical enterprise as well as the particular security needs of the Web services themselves. An enterprise's business security requirements are well known, and it is just as important to identify the security needs of a service. For example, the developer of a Web service, after assessing its business needs, might only want to let a certain set of users access particular resources.
Setting up security also involves some usability issues. In particular, because Web services have a high degree of interaction with varied clients, it is important to keep security measures from being overly intrusive and thus maintain the ease of use of a service. A service needs to promote its interoperability and make its security requirements and policy known to clients. Often, a service needs to keep a record of transactions or a log of access made to particular resources. The service must not only guarantee privacy, but it must also keep these records in case a claim is made at some later date about a transaction occurrence.
To address security needs, enterprise platforms use well-known mechanisms to provide for common protections, as follows:
Identity, which enables a business or service to know who you are
Authentication, which enables you to verify that a claimed identity is genuine
Authorization, which lets you establish who has access to specific resources
Data integrity, which lets you establish that data has not been tampered with
Confidentiality, which restricts access to certain messages only to intended parties
Nonrepudiation, which lets you prove a user performed a certain action such that the user cannot deny it
Auditing, which helps you to keep a record of security events
These are just some of the concepts important to security, and there are others such as trust, single sign-on, federation, and so forth. The chapter describes mechanisms to address and handle the threats to security, including credentials for establishing identity, encryption to safeguard the confidentiality of messages, digital signatures to help verify identity, and secure communication channels (such as HTTPS) to safeguard messages and data.
Keep in mind that the J2EE 1.4 platform does not invent new security mechanisms. Rather, the platform provides a programming model that integrates existing security mechanisms, and makes it easier to design and implement secure applications.
This chapter begins with an examination of some typical Web service security scenarios. It then covers the security features available on the J2EE 1.4 platform. Once the technologies are described, the chapter shows how to design and implement secure Web services using these J2EE technologies. The chapter also covers the emerging technologies for Web service security, in particular message-level security.