Welcome!

Microservices Expo Authors: Liz McMillan, Pat Romanski, Carmen Gonzalez, Elizabeth White, Jason Bloomberg

Related Topics: Microservices Expo

Microservices Expo: Article

Identity Propagation in a SOA

The shortcomings of current solutions

One of the challenges IT organizations face is how to propagate identities in complex business processes that are commonly found in Service Oriented Architectures (SOAs). Identities, which are passed from one service invocation to the next in a business process, give the process a user context. Identities can be used to determine access rights to SOA services and for audit and compliance purposes.

For example, consider a procurement business process for an application that's used by a number of purchasing agents. Each agent has a different purchasing privilege. Say a senior agent can purchase up to $50,000 in a transaction, while a junior agent can buy only $25,000. If the business process that enables the purchase is composed of a number of SOA services, each service must know the user's identity to enforce purchasing privileges.

This article shows the need for identities in an SOA, provides examples of SOAs, and reviews the status and shortcomings of current solutions.

Introduction to Identity Propagation
Before we look at identity propagation in an SOA, let's look at it in a three-tier environment, where it's easier to illustrate the basic concepts. Once again, we'll use the procurement application scenario - except this time, the application resides in a Web-based portal instead of being loosely coupled in an SOA.

The presentation and logic tiers exist in the portal application server and the data tier resides in the database. The identity of a procurement agent is established when the user starts accessing the portal application from the Web browser and the identity spans all three tiers of the portal. This identity is used for authentication and authorization purposes throughout the business processes tha span the portal. Identity propagation in this case spans from the Web browser, to the portal, to the backend database (see Figure 1).

To fully illustrate identity propagation, let's dig deeper into this scenario and see how the identity is propagated. The procurement application, which sits in the portal, requires the user to log in to gain access. When the agent initially accesses the portal, the portal presents a JSP- or HTML-based form that requires a username and password. These credentials are sent over an encrypted SSL channel to prevent anyone from sniffing the password over the wire.

Let's assume that the portal is running in a J2EE application server. The application would typically use a Java Authentication and Authorization Service (JAAS) login module to process the username and password, and then authenticate and authorize the user. The username and password credentials are checked against an LDAP directory, or perhaps an identity management infrastructure. If the login is successful, a JAAS subject is created in the current execution context of the J2EE portal. This object is used to identify the user in the J2EE container.

The subject is used to authorize any subsequent requests from the user to a secured resource in the application server. For example, the secured resource may be an Enterprise Java Bean (EJB) that accesses the portal's backend database. The subject is used to determine if the user should have access to the EJB. The user identity could also be propagated to the database using proprietary techniques such as impersonation, which could be used to determine if the user should have access to the backend data.

Figure 2 shows how an identity can be passed from the browser to the backend database. The identity is first passed from the browser to the portal application. From there, it can be propagated to EJBs or databases. At each step, the identity is bound to the resource. For example, JAAS is used to bind the identity of the portal user to an executing thread in the portal procurement application. This way, the user's identity can be used to determine access to subsequent resources.

The identity can also be used for audit and compliance purposes. The portal can set alerts for authentication or authorization failures in the banking application or database. Useful data can also be mined based on the user identities passing through the portal. For example, the bank could determine if purchasing agents are trying to exceed their purchasing limits.

Identities in an SOA
In our example, the techniques used to propagate identities are often proprietary or non-standard. This works well in closed environments, but in heterogeneous environments where services must be interoperable, proprietary techniques fall short. SOAs are typically composed of multi-vendor heterogeneous environments.

Think of an SOA as an evolution of the three-tier architecture where applications, like the portal, are loosely coupled applications built as a collection of services. The idea is to expose business logic as services in a reusable and interoperable fashion. For example, a service could:

  • Return a list of items that can be purchased
  • Return the status of a purchase order
  • Submit a purchase order.
SOA services aren't necessarily uniform. For example, they could be exposed through different types of protocols such as JMS, REST, RMI, .NET Remoting, MQSeries, or SOAP (see Figure 3).

These services can also be orchestrated business processes where services are wired together into business flows and are often orchestrated using open standards such as BPEL. For example, consider an auto loan service, where a bank customer submits an application online. The service processes the application and does a credit check on the applicant. If the applicant's credit meets a certain standard, it's forwarded to the fulfillment service. After the processing is finished, the paperwork is sent to the orchestrating process (see Figure 4).

SOA is quite flexible and powerful, but its decoupled design makes it difficult to propagate an identity across business processes. For example, a transaction may span a multitude of messaging services such as Web Services, MQSeries, and JMS.

Each service has its own way of transporting identities. JMS and MQSeries can pass SOAP-based XML messages in their payload, but these services often aren't XML-based and use different payload types. SOAP-based Web Services have a distinct advantage over other messaging protocols since they can use WS-Security headers in the SOAP envelope to propagate identities (see Figure 5).

The WS-Security header is standardized security metadata located in a SOAP header in the SOAP envelope. WS-Security provides data integrity (XML encryption) and data authenticity (XML signature). In addition, it offers a way to insert standard security tokens such as X.509 certificates, Kerberos tickets, and Security Assertion Markup Language (SAML) assertions in the WS-Security header. For example, SAML was designed to provide a standardized exchange of security information using XML documents referred to as SAML assertions. The following code shows how an identity would be bound to a SOAP message using SAML:

<wsse:Security ...>
    . . .
    <saml:assertion= ...>
      . . .
      <saml:Subject>
        <saml:NameIdentifier ...>
          CN=Joe User, OU=purchasing, O=Widget Inc
        </saml:NameIdentifier>
      </saml:Subject>
    . . .
<wsse:Security ...>

Binding the original requestor's identity to the request itself is the way to propagate identities. The request may be modified throughout the lifecycle of the transaction, but the identity of the requester must always be attached to the request. In this context, identity propagation presents many advantages. At each step, the user's identity is used to determine access to any secured resource.

WS-Security provides the semantics for binding user information to SOAP messages. In the listing above, the identity of the user is Joe User, who is in the purchasing organization at Widget, Inc. This identity is bound to the SOAP message using SAML as defined by the open WS-Security.

The SAML token goes beyond just identifying the user. It can also package additional information about the user in the form of attributes, which are used for authorization decisions. Attribute statements provide specific details about the subject; for example, the user holds Gold status. Authorization decision statements identify what the subject is entitled to do. For example, SAML assertion attributes can be mapped to roles defined in an access control infrastructure. A relying party that processes a SAML token could use these statements for fine-grained access control.

SOA Identity Propagation
Let's return to the orchestrated business process example that accessed the credit rating and loan processing services. The fulfillment service could be exposed as a Web Service, but the credit rating service might use MQSeries to access a legacy database. These two services can use different means to propagate identities. If you need to tie these services together, how do you propagate the identity from SOAP into a native MQSeries? This can be the start of many headaches. If a business process spans multiple services, how do you relay the identity of the original requestor throughout the transaction?

To simplify this problem, identity propagation should ideally be carried out with a single security token - for instance, a SAML assertion as described above. Secure identity propagation lets you make sure that only appropriate requests are processed. It also provides an audit trail throughout a transaction. Identity propagation requires that the identity of the original requester be bound to each step of the business process or transaction.

Business processes found in SOAs often span a multitude of protocols. The security token should have a standard way to bind to these protocols. A SAML token, as a standard XML representation for describing user identity and attributes, is uniquely suited for this purpose. Figure 6 shows a simple example of a SAML token spanning the services and protocols in the credit check service.

Currently, a SAML token is attached only to SOAP protocols. It would be useful to extend it to other native protocols such as JMS, SQL*net/ODBC, or even Inter-ORB. Ideally, all SOA-protected resources should be able to leverage SAML tokens. These protected resources should also be able to use an identity management Single Sign-On (SSO) server to determine access rights based on the tokens. When a policy is changed in the SSO server, it would affect all of the components that use it for security decisions.


More Stories By Marc Chanliau

Marc Chanliau has been in the software industry for more than 20 years and is currently a director of product management at Oracle where he is responsible for Identity Management solutions and innovations. He is heavily involved in security and XML standards groups including serving as the first chair person of the OASIS Security Services Technical Committee (SSTC), which culminated in the adoption of SAML as an official OASIS standard, participating on the WS-Security Technical Committee, helping to define the Liberty Alliance 2.0 specifications, and participating in the Java Specification Request (JSR) committee.

More Stories By William Bathurst

William Bathurst is a senior product manager at Oracle with 18 years of industry experience. He is currently the product manager for J2EE security and web services management.

More Stories By Ramana Turlapati

Ramana Turlapati is a consulting member of the technical staff at Oracle with 12 years of industry experience. In his current role as the security architect for Oracle Web Services Manager, he contributes to Oracle's overall Web Services security strategies and solutions.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Microservices Articles
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
"NetApp's vision is how we help organizations manage data - delivering the right data in the right place, in the right time, to the people who need it, and doing it agnostic to what the platform is," explained Josh Atwell, Developer Advocate for NetApp, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, compared the Jevons Paradox to modern-day enterprise IT, examin...
In his session at 20th Cloud Expo, Mike Johnston, an infrastructure engineer at Supergiant.io, discussed how to use Kubernetes to set up a SaaS infrastructure for your business. Mike Johnston is an infrastructure engineer at Supergiant.io with over 12 years of experience designing, deploying, and maintaining server and workstation infrastructure at all scales. He has experience with brick and mortar data centers as well as cloud providers like Digital Ocean, Amazon Web Services, and Rackspace. H...
Skeuomorphism usually means retaining existing design cues in something new that doesn’t actually need them. However, the concept of skeuomorphism can be thought of as relating more broadly to applying existing patterns to new technologies that, in fact, cry out for new approaches. In his session at DevOps Summit, Gordon Haff, Senior Cloud Strategy Marketing and Evangelism Manager at Red Hat, will discuss why containers should be paired with new architectural practices such as microservices ra...
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
The Software Defined Data Center (SDDC), which enables organizations to seamlessly run in a hybrid cloud model (public + private cloud), is here to stay. IDC estimates that the software-defined networking market will be valued at $3.7 billion by 2016. Security is a key component and benefit of the SDDC, and offers an opportunity to build security 'from the ground up' and weave it into the environment from day one. In his session at 16th Cloud Expo, Reuven Harrison, CTO and Co-Founder of Tufin, ...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In their Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, and Mark Lav...
Many organizations are now looking to DevOps maturity models to gauge their DevOps adoption and compare their maturity to their peers. However, as enterprise organizations rush to adopt DevOps, moving past experimentation to embrace it at scale, they are in danger of falling into the trap that they have fallen into time and time again. Unfortunately, we've seen this movie before, and we know how it ends: badly.
TCP (Transmission Control Protocol) is a common and reliable transmission protocol on the Internet. TCP was introduced in the 70s by Stanford University for US Defense to establish connectivity between distributed systems to maintain a backup of defense information. At the time, TCP was introduced to communicate amongst a selected set of devices for a smaller dataset over shorter distances. As the Internet evolved, however, the number of applications and users, and the types of data accessed and...