The document discusses various identity and security patterns for web services, including direct authentication, brokered authentication, data origin authentication, trusted subsystem, and message interceptor gateway patterns. It describes problems that each pattern addresses, such as unauthenticated access, delegating authentication to external users, message manipulation, controlling downstream access, and centralized security enforcement. Implementation examples including WS-Security, WS-Trust, and open standards are also provided.

1. Identity patterns & anti-patterns
in real world web services
~ By Prabath Siriwardena, WSO2

13. Proof of identity

14. Something you know…

15. Something you have…

16. Something you are…

17. Multifactor Authentication

20. Anyone can access my Service 

23. WSDL
WSDL
WSDL

24. WSDL
WSDL
WSDL

25. Transport Level Security
Vs
Message Level Security

26. Transport Level Security

27. Message Level Security

28. <wsse:UsernameToken wsu:Id="Example-1">
<wsse:Username> ... </wsse:Username>
<wsse:Password Type="..."> ... </wsse:Password>
<wsse:Nonce EncodingType="..."> ... </wsse:Nonce>
<wsu:Created> ... </wsu:Created>
</wsse:UsernameToken>

29. BasicAuth with
Transport Level Security

30. Direct Authentication Pattern
Problem :
How to avoid anonymous users accessing a web
service

31. Direct Authentication Pattern
Solution :
The web service acts as an authentication
service to validate credentials from the
client.

32. Direct Authentication Pattern
Implementation(s) :
UsernameToken with WSSE
BasicAuth with TLS

35. Exception Shielding Pattern
Problem :
Exception data output by a service
containing implementation details could
compromise the security of the service

36. Exception Shielding Pattern
Solution :
Potentially unsafe exception data is
"sanitized" by replacing it with exception
data that is safe by design before it is
made available to consumers

37. Users OUT SIDE Our Domain
Need ACCESS

38. Direct Authentication
needs us to maintain user
credentials internally

39. We don’t have the
credential of external
users

40. Direct Authentication
doesn’t solve our problem

41. Can’t we delegate
Authentication to the
External Domain itself

46. WS-TRUST

47. Brokered Authentication Pattern
Problem :
How to avoid anonymous users accessing a web
service and give access to users outside our
domain, where we don’t have the users’
credentials to validate

48. Brokered Authentication Pattern
Solution :
Delegate authentication to a third party who
knows to validate user credentials and the
service trusts the assertions provided by
that particular third party

49. Brokered Authentication Pattern
Implementation(s) :
WS-Trust
OpenID, Information Cards, OAuth

50. How do we know the legitimacy
of the third party
Security Token Service ?

52. Data Origin Authentication Pattern
Problem :
How do we prevent an attacker from
manipulating messages in transit between a
client and a web service.

53. Data Origin Authentication Pattern
Solution :
Validate message integrity and non-
repudiation with message signature

54. Our services access downstream
resources with the
authenticated user’s credentials

55. This could bring security risks –
and make down stream resources
vulnerable to attacks

56. How about controlling user
access to the down stream resources

57. Service acts as the client –
with service’s credentials

59. Trusted Sub System Pattern
Problem :
A consumer that accesses backend resources
of a service directly can compromise the
integrity of the resources and can further
lead to undesirable form of implementation
coupling.

60. Trusted Sub System Pattern
Solution :
The service is designed to use it’s own
credentials for authentication and
authorization with backend resources on
behalf of the consumers

61. Patterns @ Work…

64. Message Interceptor Gateway Pattern
Problem :
Different services deployed could have
different security policies and a security
vulnerability of the weakest service could
be exploited to create loop holes in entire
system.

65. Message Interceptor Gateway Pattern
Solution :
Provides a single entry point and allows
centralization of security enforcement for
incoming and outgoing messages.

66. http://blog.facileLogin.com
http://RampartFAQ.com
prabath@apache.org
prabath@wso2.com

67. Thank You…!!!