Microservices Expo Authors: Liz McMillan, Zakia Bouachraoui, Elizabeth White, Pat Romanski, Yeshim Deniz

Related Topics: Microservices Expo

Microservices Expo: Article

Security in a SOA

Key to achieving the plug-and-play goals of SOA

As the name suggests, a Service Oriented Architecture is one where application functionality is packaged as autonomous services that adhere to industry standard interfaces (WSDL, SOAP), and the services are then deployed in an IT architecture that makes for their most effective use.

 The component services can be rapidly reused and composited, plugged and played as it were, to create new business offerings and they can be individually upgraded for increased business agility. However, to achieve the promise of a SOA it's imperative that critical non-business logic-related functionality, the foremost of which is security, should also be provided and used as a service. And for this to occur it has to be externalized, accessed, and managed independently from the business logic-related services.

This article will address application security, specifically fine-grained application access control or entitlements. The need to externalize and independently manage security is many:

1.  The security context in which a component service will be executed will be a function of the composite service in which it will be invoked. It can't be determined when the code for the component service is developed. If security that pertains to access, or who can use the service, is codified in the component service then this code will have to be modified to use the component service in different environments or in different composite services, defeating the plug-and-play benefits that are a key driver for a SOA.

2.  The owners, administrators, and specialists of an access policy are different from those developing the business logic of the component service. They are often in different organizational domains. Requiring that the access policy management be coded at the same time and in the same package as the business logic requires coordination that is unnecessary and inefficient.

3.  Access policies need to be audited and checked outside of the service for purposes of compliance. Access policy auditing is required for the component service as well as for the composite service or business process in which the component service is invoked. Auditing requirements are important for corporate governance and compliance, but perhaps more importantly because in the pre-SOA world there were only a few, very limited, very controlled ways in which the application functionality could be used. However, in a SOA world the service can be invoked in very diverse and unanticipated ways. Auditing is a key tool to anticipate problems before they occur and locate the root cause of problems when they occur.

In a well-designed SOA, access policy management is itself an important service, sometimes referred to as an infrastructure service. This is in contrast to the component services and composite services that encode the business logic, sometimes referred to as business services.

So what does externalizing access policy management from the component service really mean? The figure below depicts pre-SOA application functionality where security is managed in the business logic, moving to a SOA-compatible service version of the same business logic with access policy administration, resolution, and auditing externalized from the service and manifest as SOA-compatible infrastructure services themselves. In some cases the enforcement of the access policy will also be externalized from the service. Generally this won't be possible and the service can get the access policy decision from the external security service and enforce the decision itself. (Figure 1)

It's less critical that access policy enforcement be manifest as a separate infrastructure service because it's often tied very closely to the business logic and changes with the business logic, unlike access policy administration, auditing, or resolution which change at a different rate, at different times, and are owned by people other than the developers of the business logic.

As an example consider the following:

  • Component service: Order management.
  • Access policy: An order can be entered only by people with the role of "broker." An order can be updated only by the owner of the order or by a manager of the owner of the order. An order can be read by the owner of the order, a manager of the owner of the order, or by a subject with the role "reconcile."
In this case the developers of the order management service can focus purely on implementing the most efficient order management functionality. The access policy has to specify who can access the service and perform the function exposed by the order management service. The policy needs to be administered outside of the order management service, potentially by multiple independent people (more on that later). The access policy resolution needs to access the appropriate contextual information, for example, accessing a central LDAP in which the roles of the users may be stored, or another in which the user-manager relationship may be stored, or a local database in which the order-owner relationship may be stored. The policy resolution will determine if the given request should be permitted or denied, and the policy enforcement will enforce that decision on the request.

The benefit of separating the access policy administration, resolution, and audit from the component service is that the access policy can be changed to comply with changing security or compliance requirements without requiring any change or recoding of the component service. For example, a Patriot Act rule might require that an order from a user with a certain attribute, say if he belongs to a set of identified organizations, with a value over a certain amount shouldn't be permitted. Or a Sarbanes-Oxley rule might require that the duties between a broker and an administrator be segregated. Or a business situation such as M&A may require that the access policy be modified to permit access to users who have the role of broker in one system or account manager in another system. These changes, which are independent of the business logic of the order management service can be effected by simply configuring a new or modified access policy and without requiring a change in the order management service itself.

Conversely, a new more efficient order management service won't require a recertification of the existing access policies. As the SOA deployment in an organization matures, the component services will be invoked in composite services that will determine part of the security context in which the invocation of the component service will have to be checked. In the figure below the order management component service may be invoked in a "reconcile all day orders" composite service or in a new "compute commission" composite service.

The access policy can take into account the context of the composite service from which the component service is being invoked, who is initiating the composite service, etc. The order management component service can now be used in ways unanticipated at the time the service was developed, and the appropriate access policy can be administered, resolved, and audited without losing security or compliance and without requiring any reworking of the component service. (Figure 2)

More Stories By Rajiv Gupta

Rajiv Gupta is widely known as the father of Web Services and SOA. He is the founder and CEO of Securent, and has more than 17 years of successful enterprise software and security experience. Prior to Securent, he was the Founder and CEO of Confluent Software, where he led efforts for the successful development and growth of its policy-based web-services management product, before Confluent was acquired by Oblix in 2004. Before founding Confluent, Gupta spent 11 years at Hewlett-Packard, most recently as the General Manager of the E-speak Division, a division he started in 1998 to bring to market the E-speak technology that he and his team developed at HP Labs. E-speak is the precursor to the Web Service offerings from many major IT companies, and has been inducted into the Smithsonian National Museum. Gupta is the inventor or co-inventor of some of the seminal concepts that underpin Web Services, and has more than 45 patents to his name. He earned his Master's degree and PhD in Computer Science from the California Institute of Technology, and his Bachelor's degree in Computer Science from the Indian Institute of Technology, Kharagpur.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

Microservices Articles
The now mainstream platform changes stemming from the first Internet boom brought many changes but didn’t really change the basic relationship between servers and the applications running on them. In fact, that was sort of the point. In his session at 18th Cloud Expo, Gordon Haff, senior cloud strategy marketing and evangelism manager at Red Hat, will discuss how today’s workloads require a new model and a new platform for development and execution. The platform must handle a wide range of rec...
When building large, cloud-based applications that operate at a high scale, it’s important to maintain a high availability and resilience to failures. In order to do that, you must be tolerant of failures, even in light of failures in other areas of your application. “Fly two mistakes high” is an old adage in the radio control airplane hobby. It means, fly high enough so that if you make a mistake, you can continue flying with room to still make mistakes. In his session at 18th Cloud Expo, Lee A...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
Lori MacVittie is a subject matter expert on emerging technology responsible for outbound evangelism across F5's entire product suite. MacVittie has extensive development and technical architecture experience in both high-tech and enterprise organizations, in addition to network and systems administration expertise. Prior to joining F5, MacVittie was an award-winning technology editor at Network Computing Magazine where she evaluated and tested application-focused technologies including app secu...
Containers and Kubernetes allow for code portability across on-premise VMs, bare metal, or multiple cloud provider environments. Yet, despite this portability promise, developers may include configuration and application definitions that constrain or even eliminate application portability. In this session we'll describe best practices for "configuration as code" in a Kubernetes environment. We will demonstrate how a properly constructed containerized app can be deployed to both Amazon and Azure ...
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
Using new techniques of information modeling, indexing, and processing, new cloud-based systems can support cloud-based workloads previously not possible for high-throughput insurance, banking, and case-based applications. In his session at 18th Cloud Expo, John Newton, CTO, Founder and Chairman of Alfresco, described how to scale cloud-based content management repositories to store, manage, and retrieve billions of documents and related information with fast and linear scalability. He addresse...
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY. DatacenterDynamics is a brand of DCD Group, a global B2B media and publishing company that develops products to help senior professionals in the world's most ICT dependent organizations make risk-based infrastructure and capacity decisions.
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true ...
In his keynote at 19th Cloud Expo, Sheng Liang, co-founder and CEO of Rancher Labs, discussed the technological advances and new business opportunities created by the rapid adoption of containers. With the success of Amazon Web Services (AWS) and various open source technologies used to build private clouds, cloud computing has become an essential component of IT strategy. However, users continue to face challenges in implementing clouds, as older technologies evolve and newer ones like Docker c...