Web Service Security

* WS-Security (Web Services Security) is a communication protocol providing a means for applying security to Web Services.

* On April 19 2004 the WS-Security 1.0 standard was released by Oasis-Open

* Originally developed by big tycoon companies like IBM, Microsoft, and VeriSign, the protocol is now officially called WSS and developed via committee in Oasis-Open.

* The protocol contains specifications on how integrity and confidentiality can be enforced on Web Services messaging.

* The WSS protocol includes details on the use of SAML (Security Assertion Markup Language) an XML standard for exchanging authentication and authorization data between security domains, that is, between an identity provider and a service provider and Kerberos, and certificate formats such as X.509.

* The goal is to explain and demonstrate the use of emerging XML-based security standards from W3C and OASIS.

* Application Integration: Modern corporate enterprises rely heavily on IT infrastructure to facilitate business processes, reduce the process lifecycle, and manage resources.

* Organizations with large volume deploy customized applications to manage their internal sales, purchase, payroll, finance, and HR departments.

* Such applications running within the enterprise need to be integrated with each other for consolidated decision making, accurate system information, and better performance and monitoring.

* Cross-Enterprise Integration: Integration within the enterprise is not enough. Perhaps the greatest advantage of the development of IT infrastructure is that it enables integration of applications across enterprise boundaries, providing fast and seamless collaboration with partners, customers, and suppliers.

* Security in Integrated