Layer 7: Fine Grained Authorization for Web Services

Fine grained authorization for Web ServicesJonathan GershaterSolution Architecthttp://www.layer7tech.comWhat you wil learn in this session?1. The difference between fine grained and coarse grained authorization 2. The challenge with implementing fine grained authorization in service based architectures3. How to leverage existing identity infrastructure for entitlements management4. How to use policy enforcement intermediaries to enforce entitlement preferencesMarch 2008TrT aditional enterpriseIndependent applications with their own access control, mechanisms and authorization policies.March 2008TrT aditional enterprise securityProtected by "A gate-keeper firewall primarily offering network level TCP/IP protection.•URL only protection using agent based SSO solutions.March 2008The New Enterprise:SaaS, Web2.0, LegacyThe challenge:•Mixed application and integration environment•Diverse credential requirements•Existing SSP and user directories•No centralized policy control and audit.• Services requiring fine grained authorization.March 2008SaaS, Web2.0, Integrated enterpriseMarch 2008SaaS, Web2.0, Integrated enterpriseMarch 2008WebServices authentication:The Many-To-Many ProblemTokensRequest Transport (HTTP hdr, x509, etc…) Message (UTP, x509,…)Web Services Authentication LDAP Directory Proprietary IAM… Certificate Servers (OCSP, CRLs, etc) etc…Complexity grows!Multi-platform, multi-development environment–.NET, J2EE Frameworks, other•Support Mobile users / disconnected applications•Support conditional expressions for authorization*Use existing authentication sourcesMarch 2008Quick review of AAA•Authentication – who are you?•Authorization – what can you do?•Auditing – who did what? March 2008