I've been working with web services for many years and security is the top application level concern voiced by many developers. RBD developers using WebSphere Application Server to implement security now have some new options. In RBD 8.0.1.2, we introduced support for WS-Security and WS-Addressing for RBD JAX-WS services and service invocations. Many of you are involved with revitalizing legacy applications and subscribe to the mantra don't rewrite, reuse. This is the approach we took to WS-Addressing and WS-Security. We didn't write any code; we reused the policy support provided by WebSphere Application Server. So this blog is more about the product developed by our colleagues in WebSphere than it is about RBD.  The WebSphere Application Server documentation has lots of information related to security. I'll mention a few links that caught my attention. If you find other useful information that you'd like to share, post it as a comment to this blog.

WS-Security:

If you pick up any book on WS-Security or read through the links provided, you will quickly learn it is a complex topic and there are varying degrees of securing a service. Because of the complexity of application security (and because my primary job at IBM is not as a security professional), I can't try to summarize everything from all the various books and articles about security in this blog post. I think the most important are the various layers.  The 5 most commonly mentioned are (in alphabetic order): authentication, authorization, confidentiality, identification, and integrity. If you want to talk security, you should familiarize yourself with the meaning of each layer. The Web services security provides message integrity, confidentiality, and authentication article provides a summary of some of the layers. The Securing web services section is another place to look at different layers of security and has 2 sub sections Securing HTTP transport and authentication for Web services  and Securing Web services at the message level. You can also read the Web services sections under the Developing and Deploying applications section and the Securing applications and their environment section.  The 'High-level architecture for Web services security' article provides a good explanation of how policy sets are used and applied to SOAP messages. You can also read blogs from security professionals for help with the type of security to use and how to use it. Once you decide what you need to be secure, you need to spend some time configuring WebSphere Application Server and creating policy sets. Once you create policy sets, you can reuse them on many projects.