IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009 - 38

Administrator Getting the most from your systems Securing Web-Service Messages BY ROBERT K. LARSEN AND RYAN WATKINS erhaps you’ve examined the Web-services technolog y on I BM i and now you’re con sider i ng whet her to u se t he I BM integrated Web-ser vices ser ver for i to deploy some RPG business logic as a service. One hurdle stands in your way: security. The incoming and outgoing Web-services messages exchanged with the Web-services server will contain an account number and, therefore, must be secured. You ask yourself, what available technologies suppor t securing Web-service message exchanges? The most common techniques are SSL protocol over HTTP, WS-Security, and the use of a network appliance that front ends your Web-services server and provides the necessary features for securing Web services. Let’s examine each option: s 4HE 33, PROTOCOL PROVIDES TRANSPORT LAYER SECURITY with authenticity, integrity and confidentiality for a secure connection between a client and server. The protocol runs above TCP/IP and below application protocols such as HTTP, and provides trust and privacy for the transport data. With SSL, the entire message is encrypted before data is sent to or received from the server. s 73 3ECURITY IS A STANDARD THAT DESCRIBES HOW SOAP messages can be secured through XML Digital Signature and XML encryption. With WS-Security, you can select which parts of the Web-service message should be encrypted. s 4HE NETWORK APPLIANCE IS SPECIALIZED HARDWARE FOR Web-services security and XML threat protection. An example of a network appliance is the IBM WebSphere* DataPower XML Security Gateway, which provides a slew of features, including hardware-accelerated SSL and HTTPS, WS-Security, XML denial of service attacks, firewall, etc. The network appliance would be P placed in front of the Web-services server so clients would be communicating directly with the appliance instead of the server. Each option is a legitimate way to secure Web services. Generally speaking, from a performance point of view, SSL is your best choice. However, the only way to really know what’s best for you is to enable the various capabilities (i.e., XML Digital Signature and XML encryption versus SSL) within your application environment using real business data and business logic, then measure the differences. Additionally, a high-performing network appliance that implements SSL and WS-Security may make the comparisons moot. We should note that the integrated Web-services server doesn’t currently support the WS-Security standard, so if your business requirements are leading you down a path that requires WS-Security support, you should examine WebSphere Application Server for i or a network appliance that supports WS-Security, such as the WebSphere DataPower XML Security Gateway. The technique of using SSL over HTTP has been in use for 15 years, is readily accepted as a best practice and is considered an industry standard for HTTP. The remainder of this article will focus on configuring an IBM integrated Web-services server for i using SSL over the HTTP protocol. Setting Up Your Environment By default the IBM integrated Web-services server for i listens on a nonsecure port. Take these steps to enable the port for SSL: 1. Set up/configure the *SYSTEM certificate store in Digital Certificate Manager (DCM). 38 JANUARY 2009 ibmsystemsmag.com

http://www.ibmsystemsmag.com

IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009

Table of Contents for the Digital Edition of IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009