WS-Security and Integration Server
Integration Server supports the WS-Security standard for use with web services. In contrast to transport-based authentication frameworks such as HTTPS and FTPS, which secure the endpoints of a connection against threats, WS-Security secures the message transmission environment between endpoints. Authentication information, which is included in the SOAP message header, can be saved in X.509 certificates, user name tokens or SAML tokens, and may include the actual certificates or references.
The focus of this chapter is on the use of transport-based security with
Integration Server. However, when configuring an
Integration Server web service for WS-Security, you specify its SSL, signing, and decryption keys with
Integration Server Administrator the same as you would for setting up transport-based security (see
Specifying Integration Server SSL Certificates and Keys). If you intend to use WS-Security with your
Integration Server-based web services, see
Web Services Developer’s Guide and the Oasis Standards documentation for WS-Security.