Installation Guides › Implementation Guide › Architectural Considerations › Implementation Considerations › Identify Authentication Methods

Identify Authentication Methods

SOA Security Manager supports four authentication methods to meet the varying levels and types of protection your resources require:

XML Document Credential Collector

Validates XML messages using credentials gathered from the message itself by mapping fields within the document to fields within a user directory.

XML Digital Signature

Validates XML documents digitally signed with valid X.509 certificates.

WS‑Security

Validates XML messages using credentials gathered from WS‑Security headers in the SOAP envelope of an incoming message.

SOA Security Manager can produce and consume WS‑Security tokens, enabling you to use the WS‑Security authentication scheme to deploy a multiple-web service implementation across federated sites.

SAML Session Ticket

Validates XML messages using credentials obtained from SOA Security Manager synchronized-sessioning SAML assertions (which contain an encrypted combination of a CA SiteMinder session ticket and a CA SiteMinder user public key) placed in the message HTTP header, SOAP envelope, or cookie.

SOA Security Manager can generate and consume SAML Session Ticket assertions. This enables you to use the SAML Session Ticket authentication scheme to deploy a multiple-web service implementation within a single Policy Server domain.

After you identify the web services to secure, in which we recommend identifying web service operations that share the same security requirements, consider the following questions:

• Are their authentication guidelines, regulations, or laws your organization is required to meet for specific types of resources?
• How sensitive and valuable is the information?
• What types of users are accessing this information?
• What type of security do these users expect?

Answering these types of questions helps you to

• Identify the authentication methods your environment requires
• Identify the authentication schemes a SOA Security Manager Administrator must configure to protect a specific resource.

  Note: For more information about configuring authentication schemes, see the [set the co variable for your book].

More information:

Identify the Web Services to Secure