Java Web Services Security Training: Java Web Services Security

Course Number: JWS-106
Duration: 5 days
view class outline

Securing Java Web Services Training Overview

Accelebrate's Java Web Services Security Training: Java Web Services Security course teaches attendees the Java^® EE and security techniques they need to successfully secure Java web services.

Location and Pricing

Most Accelebrate courses are taught on-site at our clients' locations worldwide for groups of 3 or more attendees and are customized to their specific needs. Please visit our client list to see organizations for whom we have recently delivered training. These courses can also be delivered as live, private online classes for groups that are geographically dispersed or wish to save on the instructor's or students' travel expenses. To receive a customized proposal and price quote private training at your site or online, please contact us.

In addition, some courses are available as live, online classes for individuals. To see a schedule of online courses, please visit http://www.accelebrate.com/online_training/?action=category&page=javaxmlws.

Securing Java Web Services Training Prerequisites

Experience developing Java Web services is assumed — either via SAAJ or JAX-RPC.
Students are expected to be able to read and write XML fluently, and have some familiarity with XML Schema.

Hands-on/Lecture Ratio

This class is 70% hands-on, 30% lecture, with the longest lecture segments lasting for 20 minutes.

Securing Java Web Services Training Materials

All attendees will receive comprehensive courseware.

Securing Java Web Services Training Objectives

All attendees will learn how to:

Understand the unique challenges in securing interoperable XML-based services.
Apply W3C standards to digitally sign and encrypt XML fragments and documents.
Understand the importance of the WS-Security specifications to interoperably secure messaging.
Use state-of-the-art tools to configure or implement signature, encryption, and various WS-Security header content for Java web services.
Drive such WSS implementations from WS-SecurityPolicy documents.
"Vouch for" a user across domains to achieve request authorization without sharing credentials.
Exchange security information between servers, applications, and components, using SAML assertion and protocol models.
Understand the role of XACML in policy management and decision-making.
Understand the WS-Trust and WS-Federation architectures for developing the trust relationships that enable service federations and service-oriented architectures.
Build web applications that participate in SAML federation and single sign-on.

Securing Java Web Services Training Outline

Securing the Service-Oriented Enterprise

Security for Web Services
Threats
CIA Goals
Solution Levels: W3C, OASIS, Java EE
Scenario: Secure Multi-Party Conversation
Cryptography
WS-Security and WS-SecurityPolicy
Scenario: Sharing Security Information
SAML and XACML
Scenario: Multiple User Realms
Scenario: Single Sign-On
Technology Stacks: WS-Federation and Liberty Alliance
The WS-I Basic Security Profile

Transport Security

Use Case: Secure Transport
HTTP Authentication Schemes
HTTP BASIC
HTTP DIGEST
Securing Web-Service URLs
HTTPS
JAX-WS Support
Axis Support

XML Signature

Use Case: Non-Repudiation
XML Digital Signature
Cryptography Backgrounder
Canonical XML
Enveloped, Enveloping, and Detached Signatures
SignedInfo and References
The Java Cryptography Architecture
Keystores
Why Keys Aren't Enough
X.509 Certificates and Certificate Chains
The KeyStore API
Java XML Digital Signature API
Steps to Sign and Verify XML Content
JAX-WS Message Handlers
Foiling the Man in the Middle

XML Encryption

Use Case: Confidentiality
XML Encryption
EncryptedData
Element vs. Content Encryption
Key Wrapping
The Java Cryptography Extensions
Apache XML Security
Steps to Encrypt and Decrypt XML Content
Choosing Algorithms and Key Sizes

WS-Security

Use Case: Secure Message Exchange
Use Case: User Login
The WS-Security Specifications
Security Token Types
Timestamps
Username Tokens
Signature and Encryption
Tools for WS-Security
XWSS and JAAS
Foiling Replay Attacks

WS-SecurityPolicy

Use Case: Sharing Metadata
WS-Policy
Normalized vs. Compact Form
Policy Attachment
Policy Scopes
WS-SecurityPolicy
Protection Assertions
Token Assertions
Supporting and Endorsing Tokens
Bindings
Metro and WSIT
Implementing Callbacks
Integrating Security Frameworks

Introduction to SAML

History of SAML
Assertions
Protocol
Bindings
Profiles
Using OpenSAML
SAML and Web Services

SAML Assertions

Use Case: "Vouching for" a User
The Assertions Schema
Extensibility
Assertions and Subjects
NameID Types
Conditions
Subject Confirmation
Confirmation Methods
AuthntStatement
Authentication Contexts
AttributeStatement
Attribute Profiles
AuthzDecisionStatements
Actions and Evidence
WS-Security and SAML Tokens
OpenSAML Assertions Model
Creating XML Objects
Marshalling and Unmarshalling

SAML Protocol

Use Case: Back-Channel Queries
Requests, Queries, and Responses
Status and StatusCode
AuthnQuery
AttributeQuery
AuthzDecisionQuery
Other Request and Response Types
OpenSAML Protocol Model
SAML and XML Signature
SAML and XML Encryption

XACML

Use Case: Back-Channel Authorization
Use Case: Sharing Authorization Policies
Policies, Policy Sets, and Targets
Rules
Combining Algorithms
Policy Context
Request and Response Types
The SAML Profile of XACML
Authorization Decisions via XACML

Securing Federated Services

Publish, Find, Bind ... Execute!
UDDI
WS-BPEL
The Trust Problem
WS-Trust
The Security Token Service
Messaging Model: RST and RSTR
Derived Keys
WS-SecureConversation
Secure Conversation Metrics
WS-Federation
Value Proposition

SAML Bindings

Use Case: Speaking "Through" the Browser
The SOAP Binding
SAML Over HTTP
The Browser as Messenger
The Redirect, POST, and Artifact Bindings
The PAOS Binding
The URI Binding

Federated Identity

What is Federation?
Problems for Identity Federation
SAML 2.0 Federations
Single Sign-On
Account Linking and Persistent Pseudonyms
Transient Pseudonyms
Name ID Mapping
Federation Termination
OpenSSO
Fedlets

Conclusion

VB.NET, C#, ASP, & ASP.NET Training

Java Training

SQL Server Training
SharePoint Training

Adobe Training

“Accelebrate,” “Accelerated Learning Celebrated Results,” and the Accelebrate logo are registered trademarks of Accelebrate, Inc. All other product names and trademarks are property of their respective owners. Course outline content may mirror or be derived from the book that each student receives with the course. Otherwise, all content is copyright © 2003- by Accelebrate, Inc. of Atlanta, Georgia, USA. To contact us, please use the contact form, email info@accelebrate.com us, or call 1 877 849 1850 in the US and Canada, 0808 234 2132 in the UK, 1 800 550 311 in Ireland, or +1 678 648 3113 from all other locations.