1 Overview of Web Services Security
This chapter includes the following sections:
For definitions of unfamiliar terms found in this and other books, see the Glossary.
What Type of Security Should You Configure?
Message-level security uses WS-Security policies to apply authentication tokens, integrity protection (digital signatures), confidentiality (encryption), or a combination of these protections to specified SOAP message parts. The selected protections remain with those message parts and can therefore span multiple SOAP hops. They do not automatically provide every protection of HTTPS/TLS. The effective protection depends on the policy and the parts it covers, and content outside the protected SOAP parts is not protected by that policy.
Transport-level security uses HTTPS/TLS to protect application data for one connection between TLS endpoints. If a proxy, gateway, or message broker terminates TLS, that endpoint can read the SOAP message before forwarding it; a network router that only forwards encrypted traffic does not terminate TLS. A later receiver cannot rely on an earlier TLS connection to authenticate the original SOAP sender. Use message-level protection when security must remain with selected SOAP message parts across intermediary hops, and use HTTPS/TLS when the connection and all application data carried on it require transport protection.
Transport-level security secures the connection between the client application and WebLogic Server with Secure Sockets Layer (SSL). SSL provides secure connections by allowing two applications connecting over a network to authenticate the other's identity and by encrypting the data exchanged between the applications. Authentication allows a server, and optionally a client, to verify the identity of the application on the other end of a network connection. A client certificate (two-way SSL) can be used to authenticate the user.
Encryption makes data transmitted over the network intelligible only to the intended recipient.
WebLogic Server provides transport-level policies that combine HTTPS/TLS with HTTP Basic authentication. HTTP Basic authentication provides credentials but does not encrypt them. Use it only over HTTPS/TLS. For example, the predefined Wssp1.2-2007-Https-BasicAuth.xml policy requires both HTTPS and HTTP Basic authentication.
Access control security answers the question "who can do what?" First you specify the security roles that are allowed to access a web service; a security role is a privilege granted to users or groups based on specific conditions. Then, when a client application attempts to invoke a web service operation, the client authenticates itself to WebLogic Server, and if the client has the authorization, it is allowed to continue with the invocation. Access control security secures only WebLogic Server resources. That is, if you configure only access control security, the connection between the client application and WebLogic Server is not secure and the SOAP message is in plain text.
Thread Safety
Jakarta XML Web Services (JAX-WS) client proxy instances are not guaranteed to be thread-safe. For portable code, do not share a proxy between concurrent threads unless access is synchronized; otherwise, use a separate proxy instance per thread or a managed pool. See Proxies in Jakarta XML Web Services Specification.