9-2 Concepts and Technologies Guide for Oracle Application Integration Architecture
enforcement of web services security is in silo mode. Integration architects and developers can focus on integration logic, and the security architects and
administrators can focus on security and management. Having security policies enforced through a centralized tool enables the administrators to ensure that the
corporate rules are applied as well as to apply the policy changes centrally instead of applying them in each of the web services. With tools such as OWSM, an
administrator creates security and management policies using a browser-based tool as and when needed during deployment. Security should be avoided unless it is
absolutely needed as it degrades performance. A typical web service security can have multiple policies attached that can:
■
Decrypt the incoming XML message
■
Extract the users credentials
■
Perform an authentication for this user
■
Perform an authorization check for this user and this web service
■
Write a log record of the preceding information
■
Pass the message to the intended web service, if all steps are successful
■
Return an error and write an exception record, if all of the steps are not successful To apply the security policy, OWSM intercepts every incoming request to a web
service and applies any one of the policy items listed previously. As the policy is executed, OWSM collects statistics about its operations and sends them to a
monitoring server. The monitor displays errors, service availability data, and so on. As a result, each web service in an enterprise network can automatically gain security and
management control, without the service developer coding extra logic.
9.1.1 Point-to-Point or End-to-End Security
Because a typical interaction in the Oracle AIA framework is part of multiple discrete interactions involving a service requester, client-specific Application Business
Connector Service ABCS, Enterprise Business Service EBS, server-specific ABCS and the service provider, choosing a security model plays a critical role.
Oracle AIA provides support for point-to-point and end-to-end security models. The architecture enables you to choose one over the other at the implementation time for
each of the transactions.
To choose a specific security model and implementation technique, the following issues should be discussed:
■
Can an entire transaction be considered as secured as long as the individual discrete transactions are secured?
■
Can the trusted model expressed previously be agreed to in principle, or must it be enforced using certificates provided by a certificate authority for the discrete
interactions?
■
Can the communication-level security methods such as SSL encryption be used to secure the individual discrete transactions within a trusted model?
Adoption of the industry-standard WS-Security security model is possible, provided that all participating applications in the transactions provide inherent support.
Understanding Security 9-3
9.1.2 Transport-Level Security
Existing technologies such as SSL can be used to secure the transport channel. SSL enables two applications to securely connect over a network and authenticate each
other. It also enables you to encrypt the data exchanged between the applications. In Oracles Web Services Security model, this transport security mechanism can be used
to provide point-to-point security, data integrity, and data confidentiality.
9.1.3 Message-Level Security
Oracle AIA places strong emphasis on message-level security. For a web service, XML encryption provides security for applications that require a secure exchange of data.
While SSL was considered the standard way to secure data exchanges, it has limitations. For example, assume that a document visits several web services before
hitting its eventual endpoint. By using XML encryption, the document can be encrypted while at rest or in transport. Encrypting only portions of a document
instead of the whole document is also possible.
9.2 Oracle AIA Methodology
