WEB401 Security Practices for Web Services (Part 2) Keith Ballinger Program Manager XML Messaging Microsoft Corporation

Agenda Trusting clients and services Enabling a manageable B2B infrastructure Creating a security context Faster security performance Authoring security policy Removing the need for writing a lot of security code

Trust Relationships and identity How do I prove who I am? Who can vouch for me? How do you know you can trust him? These questions are answered with signed security tokens WS-Trust defines a protocol for issuing and obtaining security tokens

Trust Several models for issuing tokens Client obtains token Service obtains token for client Etc… Client Token Issuer Service ClientService Token Issuer 2 Token Issuer 1 Client Token Issuer Service

Trust Requesting a security token (RST)... Issuing a security token (RSTR)

Trust RST is usually signed with a token the token issuer trusts RSTR issues new token Proof of possession token can also returned This token includes a key that the requestor can use to prove he’s allowed to use the issued token

Issuing a custom XML-based security token demo demo

Secure conversation Token issuing can also occur between two parties Client Service And Token Issuer Typically, this is done to create higher performance security processing WS-SecureConversation is an example

Secure conversation WS-SecureConversation details how to issue a SecurityContextToken In WSE, this lightweight token takes the place of a more processing intensive token Client Service And Token Issuer Request for SCT SCT Issued to client Series of messages signed with issued SCT

Building a Secure Conversation with WSE demo demo

Policy Beyond what WSDL provides, what else is needed to describe a Web service? Security requirements Reliable messaging assurances Protocol versioning Etc… These other attributes of a service can be described with WS-Policy XML-base language Complex:,, etc…

Policy <wsp:Policy wsu:Id="message-age"> <wsse:MessageAge wsp:Usage="wsp:Required" Age="5“ />

Security policy WS-SecurityPolicy specifies the assertions for expressing requirements related to WS- Security Can be embedded inside the other two

Security Policy X509v3 wsp:Body()

Role-based security IPrincipal is the.NET interface for role- based authoriztion bool IsInRole(String str) SecurityToken.Principal Implementation of IPrincipal Automatically set for UsernameToken and KerberosSecurityToken Call method explicitly or use Policy

Role-Based Authorization using Security Policy demo demo

Suggested Reading And Resources The tools you need to put technology to work! TITLE Available Writing Secure Code, Second Edition: Today Microsoft Press books are 20% off at the TechEd Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt

Community Resources Most Valuable Professional (MVP) Newsgroups Converse online with Microsoft Newsgroups, including Worldwide User Groups Meet and learn with your peers

evaluations evaluations

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.