Mastering Web Services Security [Paperback]

Bret Hartman (Author), Donald J. Flinn (Author), Konstantin Beznosov (Author), Shirley Kawamoto (Author)

Book Description

ISBN-10: 0471267163 | ISBN-13: 978-0471267164 | Publication Date: January 20, 2003 | Edition: 1

• Uncovers the steps software architects and developers will need to take in order to plan and build a real-world, secure Web services system
• Authors are leading security experts involved in developing the standards for XML and Web services security
• Focuses on XML-based security and presents code examples based on popular EJB and .NET application servers
• Explains how to handle difficult-to-solve problems such as passing user credentials and controlling delegation of those credentials across multiple applications
• Companion Web site includes the source code from the book as well as additional examples and product information

Editorial Reviews

From the Author

Our book advocates the concept of Enterprise Application Security Integration (EASI) for solving the challenges of securing Web Services applications. EASI is a model for defining a security integration framework and is based on ideas originally developed for Enterprise Application Integration (EAI). EASI is not a proprietary approach based on any particular vendor product.

The first part of our book describes the building blocks of Web Services security, including XML Security, WS-Security, and SAML. We then describe how Microsoft and Java-based technologies address Web Services security today, as well as their limitations. We conclude with a vendor-neutral EASI architecture for security integration that we believe is crucial for securing enterprise-scale Web Services applications.

The concepts described in our book prepare architects and developers for building a Web Services security architecture that is extensible, multi-platform, and interoperable. Potential security products that inspired the principles of EASI come from Microsoft, Sun, IBM, and many other software vendors. Our book avoids promoting any specific vendor product. We instead help the reader look critically at products to determine how they may be integrated together into a real-life system containing many different operating systems, application platforms, and security services.

Mastering Web Services security is far more difficult than understanding security technologies in previous platforms like EJB or COM+ because Web Services is still a moving target. If you want to build an effective Web Services security architecture, it must be flexible and evolvable. Our book shows you how to accomplish this goal.

From the Back Cover

Quickly learn how to build a secure Web services system using available programming tools, models, and specifications

Web services promise to simplify business programming and to improve interoperability, but they won't deliver on these promises without effective security. Written by the leading security experts in the field, this innovative book clearly shows how to build a real-world, secure Web services system. Using theory, examples, and practical advice, the authors examine each of the security technologies used for providing secure Web services, emphasizing how security works with XML and SOAP. And with the help of two case studies, you'll also learn how to effectively plan and deploy a secure Web services system for both J2EE and .NET.

This book will show you how to build a secure Web services system today and anticipate the security systems of tomorrow. The authors:
* Discuss the measures that can be used to secure XML and SOAP messages
* Demonstrate ways to analyze and address Web services security needs
* Describe WS-Security and SAML, new security specifications that are directed at securing user data and credentials using XML
* Cover the different ways to create a secure .NET Web service
* Explain how to secure Web services when the target Web service is a J2EE application server

The companion Web site contains
* The complete source code from the book
* Additional examples and product information

See all Editorial Reviews

Product Details

• Paperback: 464 pages
• Publisher: Wiley; 1 edition (January 20, 2003)
• Language: English
• ISBN-10: 0471267163
• ISBN-13: 978-0471267164
• Product Dimensions: 9.4 x 7.4 x 1 inches
• Shipping Weight: 1.5 pounds (View shipping rates and policies)
• Average Customer Review: 3.4 out of 5 stars  See all reviews (5 customer reviews)
• Amazon Best Sellers Rank: #1,007,838 in Books (See Top 100 in Books)

Customer Reviews

Most Helpful Customer Reviews

6 of 6 people found the following review helpful:

3.0 out of 5 stars An EASI read, with some gaps, January 26, 2003

By A Customer

This review is from: Mastering Web Services Security (Paperback)

This was the first Web services security book which I've read. Overall my impression on this book is pretty positive. Here are my thoughts on this book:

- The writing and examples are clear. The glossary is a nice touch. The book avoids spending much time on a "101 of Web services" section, and that's probably a good thing, since plenty of books cover that already. Plus, anyone who buys this book will know the basics of Web services already.

- Much of the book focuses on applying the Quadrasis "EASI" security framework to Web services, unsurprisingly I guess since the four authors all work for Quadrasis. Some of the code examples require an instance of the EASI framework to work, which is limiting to people who are not using Quadrasis software (I don't think there is anyone else with product which implements the EASI framework). For examples of authentication and authorization in Java, i'd prefer to have seen JAAS used. I think the book would have been more accurately named "Mastering Web Services Security using the EASI Framework".

- Any book on Web services security right now is going to be a picture of a moment in time, because of the evolving standards in this area, e.g. information about timestamps and nonces in WS-Security isn't included, so probably the book was written before the WS-Security Addendum was released. Ditto WS-SecureConversation, WS-Policy, and WS-Trust - most likely published after this book was written. I'd like to have seen this information, plus concrete information about SAML assertions in SOAP messages, in the book.

- XKMS is missing from the book. This was a big surprise, since like most people, I'd see XKMS as a fundamental Web services security technology. Also, XACML only gets a half a page.

- The sections on the IIS web server are very strong.

- Netegrity SiteMinder is covered, but Netegrity TransactionMinder is not. This was a surprise.

So overall, this book is strong on the EASI framework, and is well written. If you think you're likely to use EASI for your Web services security, I'd definitely recommend it.

6 of 7 people found the following review helpful:

3.0 out of 5 stars Good Basics - Not a 'Mastering' Security book, January 29, 2003

By 

Prasad Reddy "Prasad" (Sanjose, CA) - See all my reviews

This review is from: Mastering Web Services Security (Paperback)

If you are looking to compare this book with "Mastering EJB" by Ed Roman then you are making a big mistake! This books is very focussed on Quadrasis EASI implementation ( I never heard off).
(+) Good high level book for concepts.
(+) This book covers well all emerging Web services security specs including WS-Security, SAML, .NET Security etc.
(-) Only address Proprietory technologies from Netegrity and Quadrasis (Quite upsetting).
(-) Not enough examples to cover all the security specs.

(-) No discussion on implementing Liberty and Passport technologies.

3 of 4 people found the following review helpful:

4.0 out of 5 stars good for developers of complex secure WS applications, April 20, 2003

By 

"ktoto984" (San Jose, CA) - See all my reviews

This review is from: Mastering Web Services Security (Paperback)

The book does a great job explaining how to build non-trivial WS systems that are secure from end to end. Instead of limiting the material to descriptions of SOAP-related technologies and their security (this is what the other books I've read on WS security do), the authors first explain how to secure quickly a simple homogenous (M$-based) WS application, then point out the problems with such a simple-minded approach, and then devote the rest of the book to the question of securing complex heterogeneous WS applications by putting all necessary pieces together.

The first part also has a good introduction into the building blocks for WS security solutions, including not only SOAP and XML security, but also security of the underlying middleware technologies. Here, they could do a better job on going into more details about WS-Security spec and its friends. In the second part, they show how to use those building blocks together. Again, chapters on security of Java-based WS and the security interoperability lack a good structure and some times are just confusing.

From reading the book, it became clear to me that WS security is yet another instance of the old problem of enterprise security integration, although with a SOAP twist. Therefore, many methods from middleware security can be used for securing WS applications. I would recommend reading this book only to those who build complex heterogeneous WS applications.