1. Copyright © 2006, Oracle. All rights reserved. 9 - 1 Oracle Web Services Manager

2. Copyright © 2006, Oracle. All rights reserved. 9 - 2 Need for Web Service Security To verify the integrity of a message received To maintain the confidentiality of a message To determine the identity of the sender To determine whether the sender is authorized to perform the operation requested by the message

3. Copyright © 2006, Oracle. All rights reserved. 9 - 3 Oracle Web Services Manager Oracle Web Services Manager (Oracle WSM) provides a stand-alone and centralized platform for: Securing access to the Web Services Executing security policies in real time Wrapping security policies around Web Services Implementing key security standards (SAML, XML Encryption, WS-Security) Monitoring security contracts, service-level agreements (SLA), and quality of service (QoS)

4. Copyright © 2006, Oracle. All rights reserved. 9 - 4 Oracle WSM Component Architecture Clients Web services Database Policy Enforcement Points (PEP) Oracle WSM Administrative components Gateway Agent Policy Manager Monitor Management Console

5. Copyright © 2006, Oracle. All rights reserved. 9 - 5 Oracle WSM Server Components The following are the Oracle WSM server components: Policy manager: –Defines policies declaratively –Centrally manages policy configuration, policy life cycle, and registration of gateways, agents, and Web services –Stores policies for Web services in a policy repository Monitor: –Manages the collection, aggregation, and persistence of data for monitoring Web services traffic Console: –Is a Web-based application that provides a central location to administer the entire Oracle WSM environment

6. Copyright © 2006, Oracle. All rights reserved. 9 - 6 Oracle WSM Components and Architecture Clients Web Services Database Policy enforcement points Oracle WSM Server components Gateway Management control Policy managerMonitor

7. Copyright © 2006, Oracle. All rights reserved. 9 - 7 Oracle WSM Components and Architecture Clients Web Services Database Agent Management control Policy managerMonitor Policy enforcement points Oracle WSM Server components

8. Copyright © 2006, Oracle. All rights reserved. 9 - 8 Oracle WSM Components and Architecture Clients Web Services Database Agent Management control Policy managerMonitor Policy enforcement points Oracle WSM Server components Gateway

9. Copyright © 2006, Oracle. All rights reserved. 9 - 9

10. Copyright © 2006, Oracle. All rights reserved. 9 - 10 Policy Management in Oracle WSM Oracle WSM policies: Perform a set of operational tasks at a specified policy enforcement point Execute during the processing of a Web service request or response Segregate into: –Pre-Request Pipeline –Request Pipeline –Response Pipeline –Post-Response Pipeline

11. Copyright © 2006, Oracle. All rights reserved. 9 - 11 Pipeline Templates A pipeline template: Is a reusable policy pipeline that can be associated with any pipeline type Enables you to apply consistent policy enforcement for Web services deployed across an enterprise

12. Copyright © 2006, Oracle. All rights reserved. 9 - 12 Securing a BPEL Process in Oracle WSM Request Response BPEL client BPEL server Client agent Gateway/ server agent Policies RequestResponse RequestResponse

13. Copyright © 2006, Oracle. All rights reserved. 9 - 13 Securing the Endpoints of an SOA Application BPEL process ? External Web Service Agent Oracle WSM Gateway Application host Agent Client 1 3 4 5 2 4 ESB

14. Copyright © 2006, Oracle. All rights reserved. 9 - 14 Oracle WSM Monitoring and Auditing Provides real-time visibility into Web services interactions Measures various metrics to be monitored Is a single-point reference for all Web services monitoring metrics Allows alarm generation for disaster recovery Audits security violations for a Web service, a Web service operation, and a Web service client

15. Copyright © 2006, Oracle. All rights reserved. 9 - 15 Monitoring System Performance You can perform the following monitoring tasks: Monitor the overall system statistics –Service-level agreement compliance –Service execution details –Oracle WSM message logs –Flow execution details Monitor the security statistics –Access control violations Monitor the service statistics –Traffic analysis details

16. Copyright © 2006, Oracle. All rights reserved. 9 - 16 Metric Measurement Graphs: Snapshot Provides an overall view of the Oracle WSM–managed Web services Provides a visual dashboard to display overall security and service statistics

17. Copyright © 2006, Oracle. All rights reserved. 9 - 17 Metric Measurement Graphs: Service-Level Agreement Compliance Provides the comparison of actual performance metrics against configurable SLA conformance limits 1 2

18. Copyright © 2006, Oracle. All rights reserved. 9 - 18 Metric Measurement Graphs: Execution Details Provides information about the Web service execution attempts, success or failure, latency, failover, and so on

19. Copyright © 2006, Oracle. All rights reserved. 9 - 19 Metric Measurement Graphs: Access Control Provides information about the distribution of access failures over all service execution attempts Provides information about the distribution of all granted requests and failures of authorization and authentication

20. Copyright © 2006, Oracle. All rights reserved. 9 - 20 Metric Measurement Graphs: Latency Variance Provides information about the maximum and minimum latency metrics, by individual or all services registered with a particular PEP

21. Copyright © 2006, Oracle. All rights reserved. 9 - 21 Metric Measurement Graphs: Traffic Analysis Provides information about the number of bytes and messages per service by individual service or all services

22. Copyright © 2006, Oracle. All rights reserved. 9 - 22 Viewing the Message Logs Lists message log entries for service requests and responses 1 2

23. Copyright © 2006, Oracle. All rights reserved. 9 - 23 Conclusions Stand-alone and centralized Web Services management tool Wraps security policies around Web Services Defines policies declaratively, with cero programming Powerful Monitoring and Auditing tools