Download Web services for a Software Development Platform

 „
„
access to Web service.
An X.509 certificate (<wsse : BinarySecurityToken>) “is a claim regarding a binding
between a public key and its subject, endorsed by a trusted third party.” (Weerawarana et
al. 2005, p.275) [3]
A Kerberos ticket (<wsse : BinarySecurityToken >) is a claim that shows that the
requester own a session key contained in this ticket, which is authorized to access
particular Web service.
For example Table 2.5 shows an SOAP envelope which is a usage of WS-Security carries a
single username token asserting the requester’s security information:
<S : Envelope xmlns : S=”Sauer Danfoss”> Xmlns : wsse=http://docs.oasis‐open.org/wss/2004/01/...> <S : Header> … <wsse : Security> <wsse : UsernameToken wsu : Id=”…”> <wsse : Username>suaer</wsse : Username> </wsse : Security> … </S : Header> … <S : Body> … </S : Body> </S : Envelope> Table 2. 5 WS‐Security XML Example A security token could be a predefined username token or acquired from a trusted third party. In
the WS-Security model, this trusted third party is a Security Token Service (STS). One of
WS-Security specifications, the WS-Trust defines protocols and standard WSDL interface to let
requestor communicate with an STS. There are two interaction models of this requestor
communicate with an STS: push model and pull model.
21