Implementing WS-Security on TPF

Size: px

Start display at page:

Download "Implementing WS-Security on TPF"

Jennifer Parsons
5 years ago
Views:

1 z/tpf EE V1.1 z/tpfdf V1.1 TPF Toolkit for WebSphere Studio V3 TPF Operations Server V1.2 IBM Software Group TPF Users Group Autumn 2006 Implementing WS-Security on TPF Name: Bill Cousins Venue: Distributed Systems AIM Enterprise Platform Software IBM z/transaction Processing Facility Enterprise Edition Any references to future plans are for planning purposes only. IBM reserves the right to change those plans at its discretion. Any reliance on such a disclosure is solely at your own risk. IBM makes no commitment to provide additional information in the future.

2 Agenda Review WS-I Basic Security Profile WSDL Role in Security Security Examples Implementing WS-Security on TPF Recap 2

3 Review What is SOA? An architectural style that supports service orientation Creates new applications by coordinating services What is a service? A repeatable business task; a distinct business function Services are implemented in components Components are linked to create composite applications What is a composite application? A set of related and integrated services that support a business process 3

4 Review, cont d SOA Enablement Patterns Wrapping An existing application has a gateway attached to manipulate input and output messages Refacing An existing application is modified to provide a new SOA interface; business logic is separated from the message logic Componentizing The existing application is deconstructed into components 4

5 WS-I Basic Security Profile WS-Security XML-Signature XML-Encryption WS-SecurityPolicy WS-SecureConversation WS-Trust WS-Federation 5

6 Concepts and Elements of Security Identification The claiming of an identity Authentication The validating of an identity Authorization Allow or disallow actions by an identity Confidentiality Establish privacy of personal data using encryption Integrity Validate state of information is not altered without authorization 6

7 WSDL Basics <definitions name= ExampleService > <types> </types> <message> </message> <porttype> </porttype> or <interface> </interface> <binding> </binding> <service> </service> </definitions> 7

8 WSDL Basics (cont d) <definitions targetnamespace=" xmlns=" xmlns:soap=" xmlns:wsse=" wss-wssecurity-secext-1.0.xsd" xmlns:sp=" policy" xmlns:wsp=" xmlns:xsd=" > <wsp:policy> </wsp:policy> </definitions> 8

9 Security Examples UsernameToken Used for identification, authentication, and authorization EncryptedData Implements confidentiality of data Signature Provides for data integrity 9

10 UsernameToken WSDL <wsp:policy> <sp:symmetricbinding> <wsp:policy> <sp:protectiontoken> <wsp:policy> <sp:usernametoken sp:includetoken=".../includetoken/once" /> </wsp:policy> </sp:protectiontoken> </wsp:policy> </sp:symmetricbinding> </wsp:policy> 10

11 UsernameToken SOAP (1) <Envelope xmlns=" "> <Header> <wsse:security xmlns:wsse= > <wsse:usernametoken> <wsse:username> xmpuser </wsse:username> <wsse:password> In7heC1ear </wsse:password> </wsse:usernametoken> </wsse:security> </Header> <Body> </Body> </Envelope> 11

12 UsernameToken SOAP (2) <wsse:security xmlns:wsse= > <wsse:usernametoken> <wsse:username>xmpuser</wsse:username> <wsse:password Type="wsse:PasswordDigest"> wiyri1sxd2wjmsdkwpklm8t8xgdd3aw== </wsse:password> <wsse:nonce> WPkianjCRSC4mQuDE18sAD== </wsse:nonce> <wsu:created> T05:38:12Z </wsu:created> </wsse:password> </wsse:usernametoken> </wsse:security> 12

13 EncryptedData WSDL <wsp:policy> <sp:encryptedelements> <sp:xpath> /Envelope/Body/Account </sp:xpath> </sp:encryptedelements> </wsp:policy> 13

14 EncryptedData SOAP (1) <Envelope xmlns=" "> <Header> </Header> <Body> <ExampleRequest> <OrderNumber> 123 </OrderNumber> <xenc:encrypteddata xmlns= Type= > <xenc:cipherdata> <xenc:ciphervalue> 3DK8WQQ49MDL </xenc:ciphervalue> </xenc:cipherdata> </xenc:encrypteddata> </ExampleRequest> </Body> </Envelope> 14

15 EncryptedData SOAP (2) <ExampleRequest> <OrderNumber> 123 </OrderNumber> <Account> <xenc:encrypteddata xmlns= Type= > <xenc:encryptionmethod Algorithm=' <ds:keyinfo xmlns:ds=" "> <ds:keyname>snuffy Smith</ds:KeyName> </ds:keyinfo> <xenc:cipherdata> <xenc:ciphervalue> 3DK87WQ299MDL </xenc:ciphervalue> </xenc:cipherdata> </xenc:encrypteddata> </Account> </ExampleRequest> 15

16 Signature WSDL <wsp:policy> <sp:signedparts> <sp:body /> <sp:header Namespace=" /> </sp:signedparts> </wsp:policy> 16

17 Signature SOAP (1) <Envelope xmlns=" "> <Header> <wsse:security xmlns:wsse=" "> <ds:signature> <ds:signedinfo> <ds:canonicalizationmethod Algorithm= " <ds:signaturemethod Algorithm= " <ds:reference URI="#msgBody"> <ds:transforms> <ds:transform Algorithm=" </ds:transforms> <ds:digestmethod Algorithm= " <ds:digestvalue>ewkqde9bbo1...</ds:digestvalue> </ds:reference> </ds:signedinfo> 17

18 Signature SOAP (1 - cont d) <ds:signaturevalue> SDFJ848394bde48UQWWwbrRR9222Pov... </ds:signaturevalue> <ds:keyinfo> <ds:x509data> <ds:x509subjectname> CN=Smokey Joe,O=XMLSec Inc.,ST=NEVADA,C=US </ds:x509subjectname> <ds:x509certificate>mixd5+ga...l7n</ds:x509certificate> </ds:x509data> </ds:keyinfo> </ds:signature> </wsse:security> </Header> <Body wsu:id="msgbody"> </Body> </Envelope> 18

19 Signature SOAP (2) <Envelope xmlns=" "> <Header> <wsse:security xmlns:wsse=" "> <ds:signature> <ds:signedinfo> <ds:canonicalizationmethod Algorithm= " <ds:signaturemethod Algorithm= " <ds:reference URI="#msgBody"> <ds:transforms> <ds:transform Algorithm= " </ds:transforms> <ds:digestmethod Algorithm= " example.com/myxmllib/mydigestalg #sha1"/> <ds:digestvalue>ewkqde9bbo1...</ds:digestvalue> 19

20 Signature SOAP (2 - cont d) </ds:reference> </ds:signedinfo> <ds:signaturevalue> SDFJ848394bde48UQWWwbrRR9222Pov... </ds:signaturevalue> <ds:keyinfo> <wsse:securitytokenreference> <wsse:reference URI= " /> </wsse:securitytokenreference> </ds:keyinfo> </ds:signature> </wsse:security> </Header> <Body wsu:id="msgbody"> </Body> </Envelope> 20

21 Basic TPF SOA Infrastructure TPF Application Translation Functions XML APIs tpf_soap_appl_handler user exit tpf_soap_build_fault C function INode Table SOAP Handler B2B XML Scanner tpf_soap_handler_exit user exit SOAP Communications Binding Network 21

22 Future z/tpf SOA Infrastructure TPF Parsed XML Parsed Parsed Parsed XML XML Parsed Parsed XML XML XML uses uses uses XML API (DOM) Application Application 3 2 Application Application 4 1 Application 3 Application 2 TPF Toolkit creates WS WS WS Wrapper Wrapper Wrapper WSDL Tool/ Wizard Plugin Publish Web service SOAP Debug Client XML/XSD Tooling Web Service Deployment Descriptor SOAP Message Handler DD TPF File System XML Scanner ZWSAT- Admin Command WS-* WS-* WS-* SOAP Message Handlers Dual Paths to APPs tpf_soap_handler tpf_soap_appl_handler changed future not changed user-written Web Service Deployment Table mod_tpf_soap HTTP(Apache) MQ SOAP Binding MQ other transport 22

23 WS-* Handler Structure Message Handlers TPF Applications tpf_soap_appl_handler user exit Web Services Tables SOAP Handler 23

24 Web Services Tables Service Table Message Header Table Table pointer ExampleService WSS1 logging security logging WSH2 security WSH1 24

25 WS-* Handler Structure Detail Message Handlers typedef int (*hdrfn)(int, soapreqh*, soapresh*); The 1 st parameter indicates if the message is a request, response, or a fault message typedef int (*hdrfn)(int, soapreqh*, soapresh*); typedef int (*svcfn)(soapreqh*, soapresh*); Create tpfsoapmsg handle for request and response messages TPF_CALL_BY_NAME_STUB(cbn_stub); for (find service name) for (find message handler(s)) int hrc = TPF_CALL_BY_NAME (pgm, cbn_stub, hdrfn) (flag, soapreqh, soapresh); int src = TPF_CALL_BY_NAME(pgm, cbn_stub, svcfn) (soapreqh, soapresh); for (find message handler(s)) int hrc = TPF_CALL_BY_NAME (pgm, cbn_stub, hdrfn) (flag, soapreqh, soapresh); The 2 nd and 3 rd parameters point to the XMLAPI handle for the request and response msgs The Message Header Handler programs must return an integer indicating success or failure tpf_soap_appl_handler user exit 25

26 WS-* Handler Structure Message Handlers TPF Applications tpf_soap_appl_handler user exit Web Services Tables SOAP Handler 26

27 Future z/tpf SOA Infrastructure TPF Parsed XML Parsed Parsed Parsed XML XML Parsed Parsed XML XML XML uses uses uses XML API (DOM) Application Application 3 2 Application Application 4 1 Application 3 Application 2 TPF Toolkit creates WS WS WS Wrapper Wrapper Wrapper WSDL Tool/ Wizard Plugin Publish Web service SOAP Debug Client XML/XSD Tooling Web Service Deployment Descriptor SOAP Message Handler DD TPF File System XML Scanner ZWSAT- Admin Command WS-* WS-* WS-* SOAP Message Handlers Dual Paths to APPs tpf_soap_handler tpf_soap_appl_handler changed future not changed user-written Web Service Deployment Table mod_tpf_soap HTTP(Apache) MQ SOAP Binding MQ other transport 27

28 Encryption Support TPF 4.1 DES TDES (3DES) z/tpf DES TDES (3DES) AES SHA-1 Note: There will be a discussion on encryption support in the Communications Subcommittee. 28

29 References WS-Security WS-SecurityPolicy ws-securitypolicy.pdf XML-Signature XML-Encryption 29

30 Recap SOA can be implemented incrementally Use it to open TPF business logic and data Wider adoption of SOA yields greater benefits Enable TPF applications to participate in enterprisewide business processes With good design and coding practices, you can easily migrate your WS-* 4.1 code to z/tpf For further information, see your IBM customer rep 30

31 Trademarks IBM and Websphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. Notes All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without notice. Consult your local IBM business contact for information on the product or services available in your area. All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Information about non-ibm products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, compatibility, or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. This presentation and the claims outlined in it were reviewed for compliance with US law. Adaptations of these claims for use in other geographies must be reviewed by the local country counsel for compliance with local laws. 31

AIM Enterprise Platform Software IBM z/transaction Processing Facility Enterprise Edition 1.1.0

AIM Enterprise Platform Software IBM z/transaction Processing Facility Enterprise Edition 1.1.0 z/tpf EE V1.1 z/tpfdf V1.1 TPF Toolkit for WebSphere Studio V3 TPF Operations Server V1.2 IBM Software Group TPF Users Group Spring 2007 TPF Users Group Spring 2007 z/tpf Web Services Update Name: Barry