1. Web Services Security Patterns Alex Mackman CM Group Ltd alexm@cm-consulting.com

2. patterns & practices Guidance http://go.microsoft.com/fwlink/?LinkId=55348

3. Agenda Background Authentication patterns Message protection patterns Applying patterns to common scenarios

4. Web Service Threats Client Service Message Tampering Eavesdropping Configuration Information Disclosure Message Replay Unauthorized Access Elevation of Privileges

5. Countermeasures Authentication User names and passwords X.509 certificates Kerberos tokens, SAML STS tokens Authorization Role based, resource based Encryption Symmetric, asymmetric, transport level, message level Digital signatures Many others!

6. Why Patterns? Good starting point for investigating specific areas To learn the alternatives within a specific problem domain Navigating the patterns & practices Web service security patterns can be achieved by using Security decision trees Common scenarios Problem / solution matrices

7. The Technologies Today Web Services Enhancements (WSE) 3.0 Tomorrow Windows Communication Foundation (WCF) The technologies are getting easier to use Standard policy assertions to help meet key customer scenarios with minimal coding Higher levels of abstraction Declarative programming models

8. Agenda Background Authentication patterns Message protection patterns Applying patterns to common scenarios

9. Direct Authentication ClientService Identity Store 1. Request 2. Validate credentials 3. Response

10. Brokered Authentication Service Identity Store 1. Auth Request 2. Validate credentials 6. Service Response Authentication Broker 3. Auth Response 4. Service Request 5. Validate Token

11. Brokered Authentication Patterns Transport Layer with Windows Integrated Message Layer with Kerberos and WSE Transport Layer with SSL Message Layer with X.509 and WSE Message Layer with SAML Tokens X.509 Kerberos Brokered Authentication Architecture Design Implementation SAML STS

12. Direct Authentication Patterns Username Token Directory Service Username Token Data Store HTTP Basic Username Token Windows Auth Direct Authentication Architecture Design Implementation

13. Direct Authentication: User name token over transport with WSE 3.0

14. Agenda Background Authentication patterns Message protection patterns Applying patterns to common scenarios

15. Message Protection Patterns Architecture Design Data Origin Authentication Message Validator Message Layer X.509 Certs in WSE Transport Layer Confidentiality with HTTPS DataConfidentiality Implementation

16. Message layer security with X.509 certificates in WSE 3.0

17. Agenda Background Authentication patterns Message protection patterns Applying patterns to common scenarios

18. Public Web Service Scenario Merchant Web Application Example Merchant Web Application Distributor Service Catalog Data

19. Public Web Service Scenario Security Decisions FactorConsiderationDecision Authentication Merchant accounts are stored in a custom database or directory service UsernameToken can be used with custom auth, Windows auth or any other directory service Authentication Merchants accessing the Web service must be authenticated UsernameToken provides the ability to authenticate merchants Message Protection Message data is sensitive and must be protected HTTPS protects the message data while in transit between merchant and distributor

20. Public Web Service Scenario Recommended Patterns Direct authentication pattern Direct authentication: Username token over HTTPS pattern Data confidentiality pattern Trusted subsystem pattern

21. Public Web Service Scenario Security Solution Merchant Web Application Distributor Web Service Catalog Data Identity Store Trusted Subsystem Username token with HTTPS

22. Intranet Web Service Scenario Banking Application Example Banking Application Withdrawal Web Service Customer Account Database

23. Intranet Web Service Scenario Security Decisions FactorConsiderationDecision Authentication Customer service reps are located in AD on a computer running Windows Server 2003 Active Directory supports Kerberos protocol Authentication Application must support SSO capabilities Kerberos supports SSO capabilities Authentication Mutual authentication is required KerberosToken contains both requestor and service information Auditing Account activities carried out by customer service reps must be audited Kerberos supports impersonation/delegation which enables downstream auditing Message protection Message data is sensitive. Must be protected against unauthorized access and tampering KerberosToken can be used to encrypt a message and sign a message

24. Intranet Web Service Scenario Recommended Patterns Brokered authentication pattern Brokered authentication: Kerberos pattern Data confidentiality pattern Data origin authentication pattern Composite implementation pattern Message layer security with Kerberos in WSE 3.0 pattern Authenticates, signs and encrypts

25. Intranet Web Service Scenario Security Solution Banking Application Withdrawal Web Service Customer Account Database Active Directory / KDC Kerberos Token Impersonation / Delegation

26. Internet B2B Scenario Manufacturing Company Example Supply Chain Application Procurement Web Service Ordering Web Service Internet Supplier Manufacturing Company

27. Internet B2B Scenario Security Decisions FactorConsiderationDecision Authentication Supply chain application users are in AD on Windows Server 203 Kerberos is support by AD on intranet Authentication Application must support SSO capabilities Kerberos supports SSO capabilities Authentication External Web service is hosted in an unknown environment Interaction between internal and external Web service does not require credentials. X.509 certs can be used Authentication External Web service is hosted in an unknown environment X.509 certs represent a well known protocol that supports interop with other platforms Message protection Message data is sensitive. Must be protected against unauthorized access and tampering X.509 certs can be used to encrypt a message and sign a message

28. Intranet B2B Scenario Recommended Patterns Brokered authentication pattern Brokered authentication: X.509 certificates pattern Brokered authentication: Kerberos pattern Data confidentiality pattern Data origin authentication pattern Composite implementation pattern Message layer security with Kerberos in WSE 3.0 pattern Authenticates, signs and encrypts

29. Internet B2B Scenario Security Solution Supply Chain Application Procurement Web Service Ordering Web Service Internet Active Directory / KDC X.509 Cert Service Perimeter Router Manufacturing Company Supplier

30. More Information Web Service Security: Scenarios, Patterns and Implementation Guidance for Web Services Enhancements (WSE) 3.0 http://go.microsoft.com/fwlink/?LinkId=55348 Encrypting part of a message nugget http://www.microsoft.com/uk/msdn/events/nu ggets.aspx http://www.microsoft.com/uk/msdn/events/nu ggets.aspx WSE 3.0 Download http://msdn.microsoft.com/webservices/webser vices/building/wse/default.aspx http://msdn.microsoft.com/webservices/webser vices/building/wse/default.aspx Mail me with questions alexm@cm-consulting.com

31. © 2004 Microsoft Limited. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.