Securing Web Services with WS-Security: Demystifying WS-Security, WS-Policy, SAML, XML Signature, and XML Encryption


You know how to build Web service applications using XML, SOAP, and WSDL, but can you ensure that those applications are secure? Standards development groups such as OASIS and W3C have released several specifications designed to provide security -- but how do you combine them in working applications?

Securing Web Services with WS-Security will help you take your Web services securely to production, with insight into the latest security ...

See more details below
Other sellers (Paperback)
  • All (9) from $2.84   
  • New (6) from $30.23   
  • Used (3) from $2.84   
Sending request ...


You know how to build Web service applications using XML, SOAP, and WSDL, but can you ensure that those applications are secure? Standards development groups such as OASIS and W3C have released several specifications designed to provide security -- but how do you combine them in working applications?

Securing Web Services with WS-Security will help you take your Web services securely to production, with insight into the latest security standards.

Jothy Rosenberg and David Remy, both business, technology, and security visionaries, demystify these standards with practical examples including a fully developed case study application showing these tools at work. A pragmatic approach is taken showing which Web Services Security standards are needed when faced with a variety of security challenges. The authors understand that security remains one of the largest remaining impediments to deploying major Web services in business-critical situations. The goal of this book is to remove those impediments by providing a detailed understanding of all the available security technologies and how and when to employ them.

Read More Show Less

Product Details

  • ISBN-13: 9780672326516
  • Publisher: Sams
  • Publication date: 3/26/2004
  • Pages: 378
  • Product dimensions: 6.90 (w) x 8.90 (h) x 1.00 (d)

Meet the Author

About the Authors

Jonathan "Jothy" Rosenberg, Ph.D., Founder, CTO, and CEO, Service Integrity

Dr. Jothy Rosenberg is a serial entrepreneur. He is a founder, Director, CTO, and CEO of Service Integrity, a company providing XML Web services monitoring and analysis products for end-to-end real-time enterprise visibility including security and compliance visibility or "early warning." Prior to Service Integrity, Jothy co-founded GeoTrust, the world's second largest certificate authority and a major innovator in enterprise-managed security solutions. As the company's COO and CTO, Jothy led the company's product development initiatives, developing patents on a series of ground-breaking security products and deploying a secure Web service integrating GeoTrust's reseller partners into the SSL provisioning process. Previous to GeoTrust, Jothy served as CEO and CTO of Factpoint, Inc., a pioneer in the area of content certification and content management. With his Service Integrity co-founders, he also co-founded Webspective, which was later sold to Inktomi.

Before these multiple ventures, Jothy held various executive positions at Borland International where he was General Manager of the Enterprise Tools Division and overall Development VP for Languages, including Delphi, C++, and JBuilder products. Jothy holds a B.A. in Mathematics from Kalamazoo College and a Ph.D. in Computer Science on VLSI Design algorithms from Duke University. He is also the author of How Debuggers Work. Jothy holds patents on debugger watchpoint mechanisms, content certification and site identity assurance, as well as a pending security compliance monitoring patent.

David L. Remy, CISSP, Director of Product Engineering for Security, Web Services and XML on WebLogic Workshop, BEA

David Remy works at BEA Systems, Inc., where he is a Director of Product Engineering responsible for security, Web services, and XML for BEA's WebLogic Workshop product line. Prior to working with BEA, David was founder and Chief Architect for GeoTrust, Inc., a security company and now the second largest certificate authority in the world. David has worked in the software industry for more than 16 years, holding such positions as Chief Technology Officer at Netstock, Director of Technology at Corbis, Director of Architecture at PEMCO Financial, Advisory Systems Engineer at IBM, and several other contracting and software development roles.

Read More Show Less

Table of Contents



Who This Book Is For. About This Book. How This Book Is Organized.

1. Basic Concepts of Web Services Security.

Web Services Basics: XML, SOAP, and WSDL. Application Integration. Security Basics. Web Services Security Basics. Summary.

2. The Foundations of Web Services.

The Gestalt of Web Services. XML: Meta-Language for Data-Oriented Interchange. SOAP: XML Messaging and Remote Application Access. WSDL: Schema for XML/SOAP Objects and Interfaces. UDDI: Publishing and Discovering Web Services. ebXML and RosettaNet: Alternative Technologies for Web Services. The Web Services Security Specifications. Summary.

3. The Foundations of Distributed Message-Level Security.

The Challenges of Information Security for Web Services. Shared Key Technologies. Public Key Technologies. Summary.

4. Safeguarding the Identity and Integrity of XML Messages.

Introduction To and Motivation for XML Signature. XML Signature Fundamentals. XML Signature Structure. XML Signature Processing. The XML Signature Elements. Security Strategies for XML Signature. Summary.

5. Ensuring Confidentiality of XML Messages.

Introduction to and Motivation for XML Encryption. XML Encryption Fundamentals. XML Encryption Structure. XML Encryption Processing. Using XML Encryption and XML Signature Together. Summary.

6. Portable Identity, Authentication, and Authorization.

Introduction to and Motivation for SAML. How SAML Works. Using SAML with WS-Security. Applying SAML: Project Liberty. Summary.

7. Building Security into SOAP.

Introduction to and Motivation for WS-Security. Extending SOAP with Security. Security Tokens in WS-Security. Providing Confidentiality: XML Encryption in WS-Security. Providing Integrity: XML Signature in WS-Security. Message Time Stamps. Summary.

8. Communicating Security Policy.

WS-Policy. The WS-Policy Framework. WS-SecurityPolicy. Summary.

9. Trust, Access Control, and Rights for Web Services.

The WS-* Family of Security Specifications. XML Key Management Specification (XKMS). eXtensible Access Control Markup Language (XACML) Specification. eXtensible Rights Markup Language (XrML) Management Specification. Summary.

10. Building a Secure Web Service Using BEA's WebLogic Workshop.

Security Layer Walkthrough. WebLogic Workshop Web Service Walkthrough. Summary.

Appendix A. Security, Cryptography, and Protocol Background Material.

The SSL Protocol. Testing for Primality. RSA Cryptography. DSA Digital Signature Algorithms. Block Cipher Processing. DES Encryption Algorithm. AES Encryption Algorithm. Hashing Details and Requirements. SHA1. Silvio Micali's Fast Validation/Revocation. Canonicalization of Messages for Digital Signature Manifests. Base-64 Encoding. PGP.



Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)