SSL Handshake—The Visual
This is an old picture that I made for a 2010 JBoss World security presentation. It came in handy not so long ago when I was explaining the SSL Handshake to someone.
SOA Security Reading Material
At nearly every client site, I’m asked to put together a recommended reading list on a variety of subjects. Web Services security is generally among them. SO, I’m putting together a list of the links that usually make it on that list.
What is an XML Gateway?
An XML Gateway is an externally-facing DMZ tier of a web services platform. Generally, this DMZ tier will be facing the Internet, but it may simply be between business units or facing a leased line connecting one entity to another. It can be implemented using a software solution (such as web…
IBM Announced the New XG45 DataPower appliance
This is the first post on thinkmiddleware.com where we discuss DataPower. Guess what I’ve been doing with my career lately🙂.
Secure Identity Propagation using WS-Trust, WS-Security, and SAML2 — IBM Impact, 2011 Session
On April 13th, 2011, Ryan Triplett and I spoke at IBM Impact in Las Vegas. The topic was “Secure Identity Propagation using WS-Trust, WS-Security, and SAML2“. The PowerPoint presentation can be found here. The original abstract:
Secure Identity Propagation using WS-Trust, WS-Security, and SAML2
I gave the following presentation at IBM Impact in April, 2011.
HTTP Client – Form-Based Authentication
This article continues the discussion started in the Servlet Authentication article. Here we discuss Form-Based authentication; another common form of authentication when Servlet technology is used.
Servlet Container Authentication
There are three required authentication mechanisms supported by a compliant Servlet Container: HTTP Basic Authentication, Form-based Authentication, and CLIENT_CERT authentication. There is a fourth authentication method, DIGEST, that isn’t used very often in my experience. This final…
JBossWorld 2010 Session — Securing JBoss Services
On June 24, 2010, I gave a presentation at JBoss World in Boston. This was my second time at JBoss World. The presentation covered Securing JBoss Services. It explored the use of JaasSecurityDomain MBeans to configure SSL in JBoss 4.3 (also relevent for newer versions of JBoss) for various…
J2EE Security Series
An Openldap Directory Server JBoss 4.3.x Setup Adding Groups To OpenLdap Using OpenLdap as a User Repository with JBoss 4.3.x
Securing The JBoss JAAS Subject Reader Application with J2EE Security
This article continues the J2EE Security Series from the past few months. Here we expand the Simple J2EE Web Application that was introduced in this article to use J2EE Security.
A Simple Web Application
In order to test J2EE Security with the Security Realm and Openldap User Repository we created in the last article in this series, we need an application to protect. The focus of this article is to create a very simple web application that can be protected by J2EE Security.