Web Services Security (REST & SOAP)

Question

My first post is here! I wanted to get some help from the web services security community.

I am developing web services security. I need every solution that solves the problems of identification, access control associated with the transfer, such as data integrity, protection, disclaimer.

So, I chose some real solution to meet these needs, I found them for SOAP-based web services:

• Authentication: WS-Security Framework
• Authentication: Extensible Access Markup Language (XACML)
• Login
  • Extensible Rights Markup Language (XrML)
  • XML Key Management (XKMS)
  • Security Markup Language (SAML)
  • .NET Passport
• Confidentialité
  • WS-Security Framework
  • XML encryption
  • Secure Sockets Layer (SSL)
  • Wss

And almost all of them are implementable with spring-security

RESTful web services, on the other hand, have a reputation for being less secure. Based on the web interface SSL / TLS is a great encryption solution, but there are other security protocols, for example:

• OAuth: used by facebook, twitter, without token exchange.
• OpenID: used by Google
• Cas
• LDAP, Kerberos
• Persona, BrowerID

Another solution might be to integrate security on the corporate bus as a service (Security as a Service).

So my question is: are there any other solutions that I should be aware of? is there any other framework?

thanks a lot

Answer 1

Just adding one point is that with respect to soothing web services, developers can use tomcat servlet container security. This can be done using the realm configuration in server.xml and tomcat-users.xml. Detailed configuration information is here → http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html

And best suited for forms-based authentication. ref: http://www.onjava.com/pub/a/onjava/2001/08/06/webform.html?page=2

Answer 2

If you want more control over the security of REST web services, then you might want to consider implementing your own authentication and RBAC (role-based access control). Just take the username and password with each request in the header on top of HTTPS and implement RBAC at your REST Webservice level. You can basically add Servlet filters for authentication and authorization before the request is actually submitted to the web service.

The choice is yours, obviously, there are different security frameworks, but you need to choose the one that suits your requirements.