Securing JBoss ESB services

[macross27]

Hi there,

I've been working with JBoss ESB for some time now. I've written several services used to provide business functionalities. Now I'm thinking about a security mechanism for these services. However, this seems to be a complex topic.

Most important I need means for authentification. For example only trusted users should be able to access a service and provide input data for it. Are there any best practices for JBoss ESB?

One of the features I really like about JBoss ESB is the separation of business logic (in the action queue) and the transports. For webservices there exists a security framework with WS-Security, WS-Trust, XML Signature and so on. In my understanding however, these are bound to the transport "webservice". How can I achieve a separation of security issues from the transport? Is there a standard ESB-way to do it?

Any comments, links to literature concerning SOA security and so on are welcome! Thanks in advance.

-Sebastian

[beve]

Hi Sebastian,

we have been working on security and per service authentication which will be available in the upcoming release.

Any comments, links to literature concerning SOA security and so on are welcome!

If you'd like to take a look at the security features take a look at this branch:
http://anonsvn.jboss.org/repos/labs/labs/jbossesb/branches/JBESB_4_4_GA_CP/

For documentation about this look at the "Security in JBossESB" section, on page 74 in:
http://anonsvn.jboss.org/repos/labs/labs/jbossesb/branches/JBESB_4_4_GA_CP/product/docs/ServicesGuide.pdf.

The publish_as_webservice quickstart demonstrates the security feature and might be interesting as well:
http://anonsvn.jboss.org/repos/labs/labs/jbossesb/branches/JBESB_4_4_GA_CP/product/samples/quickstarts/publish_as_webservice/

Regards,

/Daniel

[macross27]

Thanks for the links! I'll take a look at it.

-Sebastian