If Waveset Service Provider functionality is to be utilized, Oracle recommends adding a web tier between the user tier and the application tier. The web tier consists of one or more web servers that reside in a demilitarized zone (DMZ) that is separated by a firewall from the application tier.
An LDAP repository is required if Service Provider functionality is to be utilized. In addition, the standard Waveset repository is always required for Service Provider in order to maintain configuration information, forms, rules, and other objects.