Security in Software Engineering

Web Services

Part 12 : UDDI and Advanced Web Services

Alexandre Dulaunoy

adulau@foo.be

Agenda

• an introduction to UDDI,

• UDDI Security,

• Message Routing,

• Advanced topics in WS,

• Conclusion.

UDDI

• Universal Description, Discovery and Integration (UDDI) ,

• An industry specification (inside OASIS) for lookup, publishing and localization of WS,

• UDDI defines also an API to access UDDI information,

• UBR (UDDI Business Registry) - cataloging Web Services from companies,

• http://www.uddi.org/ - current (version 3)

UDDI Services

• Provider (anything that can offer XML Web Services), • Contact (contact point inside the provider),

• Service (a global representation of services available via the Web Services, for example a lookup for an ISBN),

• Binding (the access point : a specific url) · Instance info (interface description or WSDL)

• tModels - Technical models (to represent unique concepts or constructs)

UDDI and Security

• Security authentication and authorization mechanisms and policies are represented via the tModels,

• Security Policy API Set to provide access control,

• XML-sig/enc could be used,

• UDDI only defines access/discovery (your SOAP interface doesn’t move),

• UDDI relies on existing protocols (HTTP,SSL)

WS : Message Routing

• Web Services describes a processing model but not a message path,

• Custom routing can be created via (SOAP 1.2) actor and mustUnderstand attributes,

• You can create custom routing specific receiver (in SOAP,

• Security and routing is quite difficult,

• WS-Routing specification is a simple stateless SOAP-based routing protocol,

• WS-Referral is a simple stateless for inserting and querying routing entries in SOAP.

Advanced WS

• WS-Policy, WS-Trust, WS-Privacy, WS-Federation, ...

• WS-Inspection =/= UDDI (a simple way to know operation of a web services),

• Reliable Messaging (e.g. HTTPR),

• ...

Q&R

• adulau@foo.be

• http://www.foo.be/cours/securite-webservices/

• 3B12 DCC2 82FA 2931 2F5B 709A 09E2 CD49 44E6 CBCD