Vikas Jain

When using HTTP token policies with OWSM 11g, you may want to review the following to understand their implementation behavior.

What types of HTTP token policies are available?
Following pre-defined OWSM policies are available out-of-the-box.
Client policies: oracle/wss_http_token_client_policy, oracle/wss_http_token_over_ssl_client_policy
Service policies: oracle/wss_http_token_service_policy, oracle/wss_http_token_over_ssl_service_policy

What does HTTP token policies do?
On the client side, it adds base64 encoded username/password per the Basic Authentication scheme to the HTTP Authorization header according to RFC822 and RFC2617
For example, Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
On the service side, OWSM agent gets hold of this HTTP header, decodes the username/password, and uses it to authenticate against the configured identity store through OPSS login module and WLS authenticator. Additionally, if oracle/wss_http_token_over_ssl_service_policy is used, it checks if SSL connection was indeed used to connect to the service.

Is the HTTP Authorization header sent with every message? If not, how can I enable it to be sent with every message?
No. Oracle web services stack follows the challenge-response authentication mechanism wherein client doesn't send an authorization header in the initial request to which service responds back with a 401 (Unauthorized) HTTP message. Client then stuffs the Authorization header into the second request which is then processed by the service.
This default behavior can be altered such that the Authorization header is always sent by setting a property on the client side.
In the request context, set the property ClientConstants.PREEMPTIVE_BASIC_AUTH to true

How can I disable SOAP security header inclusion when using HTTP token with SSL client policy?
The out-of-box oracle/wss_http_token_over_ssl_client_policy policy is configured to include a timestamp element in the SOAP security header similar to below.

<code style="color:#000000;word-wrap:normal;"> <wsse:Security xmlns:wsse="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>" env:mustUnderstand="1">  <br />      <wsu:Timestamp xmlns:wsu="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd</a>" wsu:Id="Timestamp-oq2ulH1wHpSwkqAlKMaf5Q22">  <br />           <wsu:Created>2010-06-21T15:28:02Z</wsu:Created>  <br />           <wsu:Expires>2010-06-21T15:33:02Z</wsu:Expires>  <br />      </wsu:Timestamp>  <br /> </wsse:Security  <br /></code>

This can be disabled by modifying the client policy with timestamp attribute value set to false.
Note that oracle/wss_http_token_client_policy doesn't include the SOAP header.

When SOA endpoint is protected using OWSM service policy, then message can be decrypted, but after that if the message contain PII attributes, they can end up in clear in logs and instance viewer in the console.
To provide security for prevention of such PII data leakage, there is an OWSM custom policy assertion available written by Robin Zimmermann and Rakesh Saha that allows selective attribute encryption within the application, and then decrypt it on the way out before it's re-encrypted using the OWSM client side policy.
See https://owsm-11g-custom-assertions.samplecode.oracle.com/

btw, Oracle BPEL 10g provided a feature for obfuscating attribute data. This solution is better than that approach as it uses digital encryption instead of obfuscation technique, and is policy based.

As VmWare and Force.com joined hands to create the vmForce platform for cloud applications it's interesting to note how some of the new age features are becoming part and parcel of the application infrastructure.

Few years back, an application server with servlet, EJB containers, connection pooling and other services was considered to be an application platform. Then with the SOA wave, features like orchestration (BPEL), service bus (for routing, transformation), adapters (for connecting apps), and governance tools became part of the platform leading to development of composite applications.
Now, vmForce is taking it another step ahead including features such as social apps like collaboration, google like search for any data, mobile access, BPM and reporting dashboards to be part of the platform, relieving application developers and administrators from integration pains with external tools providing these features.

Following vmForce feature list is extracted from Anshu's blogpost on this topic.

• Social Profiles: Who are the users in this application so I can work with them?
  
• Status Updates: What are these users doing? How can I help them and how can they help me?
  
• Feeds: Beyond
  user status updates, how can I find the data that I need? How can this
  data come to me via Push? How can I be alerted if an expense report is
  approved or a physician is needed in a different room?
  
• Content Sharing: How
  can I upload a presentation or a document and instantly share it in a
  secure and managed manner with the right set of co-workers?
• Search: Ability to search any and all data in your enterprise apps
  
• Reporting: Ability to create dashboards and run reports, including the ability to modify these reports
  
• Mobile: Ability to access business data from mobile devices ranging from BlackBerry phones to iPhones
  
• Integration: Ability to integrate new applications via standard web services with existing applications
  
• Business Process Management: Ability to visually define business processes and modify them as business needs evolve
  
• User and Identity Management:
  Real-world applications have users! You need the capability to add,
  remove, and manage not just the users but what data and applications
  they can have access to
  
• Application Administration: Usually an afterthought, administration is a critical piece once the application is deployed
  

Here's a blogpost on how to connect and authenticate salesforce.com from an application deployed on Google AppEngine using OAuth protocol.
http://blog.sforce.com/sforce/2010/04/connecting-google-app-engine-and-salesforcecom-with-oauth.html

See how the complexity of the OAuth protocol has been hidden by the helper APIs of OAuthAccessor and OauthHelperUtils.
Refer to this demo project written by Jeff Douglas.

You can find resources and links to Force.com platform security for secure cloud development here.
http://blog.sforce.com/sforce/2010/04/introducing-forcecom-secure-cloud-development.html

What I like is how it's organized - complete with education material, security design principles, secure coding guidelines, security testing tools, and how to perform security review - providing end to end guidance on how to implement security for apps deployed on Force.com.

Oracle Fusion Middleware 11gR1 PS2 (Patchset 2) aka 11.1.1.3.0 is released and generally available now.

What's new in OWSM 11gR1 PS2 (11.1.1.3.0)?

• Agent for OSB 11gR1
• Enhanced integration for WLS JAX-WS web services (centralized policy mgt, policy attachment through EM, policy advertisement in WSDL, and policy monitoring)
• IBM DB2 certification of MDS backed policy store
• WS-Security + WS-AT combination support
• Enhanced Test-to-Production for policy attachments using deployment plans

Also see,

• Known Issues
  
• Product documentation - 11gR1 PS2 Library , OWSM documentation links
• What's new in OWSM 11gR1, and 11gR1 PS1 releases?
• OWSM page on OTN
  

Listing all OWSM 11gR1 related documentation at one place from the latest patchset.

GuideReleasePart NumberCommentsDocumentation Library Portal11gR1 PS1E15523_01Main site with links to all guidesInstallation Guide for Oracle SOA Suite11gR1 PS1 E13925-02Installing SOA SuiteOWSM Upgrade Guide - 10gR3 to 11gR111gR1 PS1E10127-01Migrating OWSM policies from 10g3 to 11gR1 releaseOWSM Admin Guide (Security and Administrator's Guide for Web Services)11gR1 PS1B32511-02Main OWSM guide covering concepts & management interfacesOWSM Developer's Guide (Securing WebLogic Web Services)11gR1 PS1 E13713-02Covers how to attach policies at design time through JDeveloperOWSM Java API Reference11gR1 PS1E10689-02For writing custom policy assertionsFusion Middleware Audit Framework (Security Guide)11gR1 PS1E10043-04OWSM leverages FMW audit frameworkOWSM Interoperability Guide11gR1 PS1E16098-01Covers  interoperable policies certified against OWSM 10g, .NET, Axis, OSB 10g, WLS native security, etc.OWSM HA Guide11gR1 PS1E10106-02Configuring OWSM for High AvailabilityEnterprise Deployment Guide (EDG) for SOA Suite11gR1 PS1 E12036-02Recommended deployment topologyOWSM Backup and Recovery (Disaster Recovery Guide)11gR1 PS1E15250-01Configuring for disaster recoveryOWSM Performance and Tuning Guide11gR1 PS1E10108-01Performance/TuningOWSM Licensing Information
E14860-07Licensing termsOracle Platform Security Services (OPSS) Guide
11gR1 PS1
E10043-04OPSS GuideOracle Access Manager 10g (10.1.4.3)10.1.4.3
OAM 10g Guides
OWSM leverages OPSS internally for authentication, CSF and few other services. So, some of the above guides/sections should be complemented with OPSS guides.

Per Intel's CTO Justin Rattner, Intel is working on a single chip cloud computer

• Parts of the chip will be powered down when not in use
• First iteration involves a 48 core processor that consumes 25 - 125 watts
• New term invented "physicalization" which means dedicating one or more cores to a specific application or portion of the application. This is completely opposite to "virtualization" which means running applications on whatever processor resources are available

For complete story, see this Forbes article

Where REST services demand a particular type of token for access, REST clients can potentially integrate with an STS server to acquire the requisite token, and pass it to the service.

I haven't seen customers yet widely asking for such solutions, but need can arise where companies standardize across the applications on tokens such as SAML for access control which carries not only the username information but also attributes associated with user profile.

In such scenarios, following flow would be applicable

1. REST client acquires token from the STS server preferably through REST binding of STS, but any other supported binding should also be okay.
2. Once it receives the token, it adds it to the "Authorization" HTTP header of the REST request.
3. REST service receives the request, and a security interceptor(agent) picks up the token to check for access validity. The interceptor can optionally assert the identity into the service for identity propagation needs.

I would be interested to know if you run into such scenarios, and looking for products to support it. You can leave blog comments.