SOA服务认证/授权
当我们朝着 SOA 方向发展时，出现的一个主题是如何让每个服务对服务请求进行身份验证和授权。
我不久前看到以下问题发布，想知道是否还有更多内容那。
我目前正在创建一个安全服务，该服务负责处理访问应用程序的用户的身份验证和授权。
为了解决要求验证的服务问题，我正在考虑向该服务添加一个操作，以便其他服务可以验证将在消息中提供的安全令牌。我还在考虑使用 Apache WSS4J 来帮助处理令牌。
想法 - 目前我们还没有考虑 BPEL，那么我仍然可以使用 WSS4J 吗？
As we are moving in the direction of SOA a topic that has come up is how to have each of the services authenticate and authorize a service request.
I saw the following question posted a while back and was wondering if there is any more to it then that.
I am currently in the process of creating a Security Service which has the responsibility to handle the Authentication and Authorization of a user coming to the application.
To address the issue of the services asking for verification I was thinking of going down the road of adding an operation to this service such that other services can verify a security token that will be provided in the messages. I was also looking at using Apache WSS4J to help with the token.
Thoughts - we currently do not have BPEL in our sights at this point so can I still make use of WSS4J?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的 - 您可以使用 WSS4J - 但在 SOA 中，身份验证和授权的概念超出了 wss4j。您将看到 Apache Axis2 和 CXF 具有围绕 wss4j 开发的包装器，以支持 Web 服务安全标准，例如 WS-SecurityPolicy、WS-Trust...
此外，当涉及到授权时，事实上的标准是 XACML。 XACML 为您的 SOA 部署带来了基于策略的细粒度授权模型。
WSO2 Identity Server 是一个开源产品，支持所有这些功能。
[免责声明：我我是 WSO2 的建筑师]
Yes - you can use WSS4J - but in SOA the concept of authentication and authorization goes beyond from what wss4j. You will see that Apache Axis2 and CXF have wrappers developed around wss4j to support web services security standards like, WS-SecurityPolicy, WS-Trust...
Also - when it comes to authorization the de facto standard is XACML. XACML brings a policy based, fine-grained authorization model for your SOA deployment.
WSO2 Identity Server is an open source product which has support for all these functionalities..
[Disclaimer : I am an architect at WSO2]
这实际上取决于您打算部署到哪个 Web 服务框架。
大多数 Web 服务框架已经在基本用户名令牌级别上提供了某种身份验证和授权服务，或者通过后端数据库、ldap 或 xml 配置文件定义提供 saml 支持。 Apache CXF、JBoss、Oracle SOA、WebSphere、Tomcat 等。
您应该调查默认功能是否已经为您提供了您想要实现的目标。
It really depends on what webservice framework you are intending to deploy to.
Most webservice frameworks already have an authentication and authorization service of some sort or other at the basic username token level, or providing saml support with back-end database, ldap, or xml config file definitions. Apache CXF, JBoss, Oracle SOA, WebSphere, Tomcat, etc.
You should investigate whether the default capabilities arlready give you what you are trying to achieve.