2 questions about SOA security

原创于 2008-11-22 17:41:00 发布 · 386 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#soa #security #sso #system #websphere #workflow

SOA Security 专栏收录该内容

1 篇文章

订阅专栏

本文探讨了在实施SOA环境下如何实现浏览器基础及Web服务的单点登录(SSO)解决方案。对于不同类型的Web服务器如Tomcat、JBoss等，提出了一种使用开源组件的简单设计思路。同时，针对SOA环境中多个分布系统的SSO问题，计划研究SAML 2.0标准的适用性和具体实施方案。

I am thinking about a few questions recently.

maybe those questions are common questions when implementing SOA security.

Q1: how to implement an SSO(browser based) solution for heterogeneous web servers?

WebLogic v9 and v10 support SAML, and according to v10 document, WebLogic v10 supports SSO with Mircosoft client and HTTP client. I have not tested yet. I just think if the user's server is tomcat or jboss or websphere or what ever.

There are some solutions, but they are complex.

I decide to try to design a simple solution for browser based SSO, using open source.

maybe this will cost me one or two months.

Q2: how to implement web services SSO?

For a typical SOA environment, a user will face many web services distributed in many systems. if user zhangsan login into system a, he wants to call the workflow service in system b and then he wants to call the hr service in system c. In this scenario each service checks user identity. So how system a passes user zhangsan identity to system b and c.

SAML 2.0 provides a solution for non-browser client SSO, but I haven't seen an implementation.

I will try to work out this question in few months.