Web services security test framework and method

1. A computer-implemented system for managing security using a soap message; comprising:

a handler stored on a computer readable storage medium and executable by a processor, the handler comprising a set of customizable classes containing selectable parameters that specify one of a web services security version and a web services security draft related to at least one security component, the handler is distributed to an external entity to promote communication with a web services security architecture; and

a plurality of custom handlers, each of the plurality of custom handlers created by selection of a different group of at least some of the selectable parameters of the set of customizable classes of the handler, each of the plurality of custom handlers stored on a computer readable storage medium and executable by a processor to insert the at least one security component into a security portion of a corresponding SOAP message based on the specified one of the web services security version and the web services security draft related to the at least one security component, wherein each of the plurality of custom handlers is created to determine whether the web services security architecture can properly process the at least one security component in the corresponding SOAP message, and wherein a first one of the plurality of custom handlers is executable to insert the at least one security component into a first security portion of a first SOAP message such that the web services security architecture properly processes the at least one security component in the first SOAP message.

2. The computer-implemented system of claim 1 , wherein the at least one security component is selected from a group of security components consisting of a username/password token, an X.509 certificate, a Kerberos ticket, an SAML assertion, an XrML document, and an XCBF document.

3. The computer-implemented system of claim 1 , wherein the at least one security component includes each of a username/password token, an X.509 certificate, a Kerberos ticket, an SAML assertion, an XrML document, and an XCBF document.

4. The computer-implemented system of claim 1 , wherein the at least one security component includes a plurality of security components selected from a group of security components consisting of a username/password token, an X.509 certificate, a Kerberos ticket, an SAML assertion, an XrML document, and an XCBF document.

5. A computer-implemented system for managing aspects of SOAP message security, comprising:

a generic handler with selectable parameters stored on a computer readable storage medium and executable by a processor, wherein the generic handler is distributed to an external entity to promote communication with a web services security architecture, and wherein the selectable parameters include a first set of selectable parameters that specify at least one web services security specification and a second set of selectable parameters that specify at least one security profile;

a custom handler created by selection of the selectable parameters of the generic handler, the custom handler stored on a computer readable storage medium and executable by a processor to insert the at least one security profile into a security header of a SOAP message based on the at least one web services security specification; and

a second custom handler created by selection of at least one additional security profile of the generic handler upon a determination that the web services security architecture properly processes the at least one security profile in the SOAP message, the second custom handler stored on a computer readable storage medium and executable by a processor to insert the at least one security profile and the at least one additional security profile into a second security header of a second SOAP message based on the at least one web services security version.

6. The computer-implemented system of claim 5 , wherein the security header comprises a designation of a security profile based on one of a designation of a web services security specification version and a designation of a vendor implementation of the web services security specification.

7. The computer-implemented system of claim 5 , wherein the at least one security profile is selected from a group of security profiles comprising:

a username/password token;

an X.509 certificate;

a Kerberos ticket;

an SAML assertion;

an XrML document; and

an XCBF document.

8. The computer-implemented system of claim 7 , wherein encryption is performed on the SOAP message.

9. The computer-implemented system of claim 7 , wherein a digital signature is added to the SOAP message.

10. The computer-implemented system of claim 5 , wherein the generic handler carries out performance testing.

11. A computer-implemented method for managing aspects of SOAP message security comprising:

distributing a framework stored on a computer readable storage medium and executable by a processor to an external entity to promote communication with a web services security architecture, the framework including a generic handler with selectable parameters, the selectable parameters including a first set of selectable parameters that specify at least one web services security specification and a second set of selectable parameters that specify at least one security profile; and

receiving selection of at least one of the first set of selectable parameters and at least one of the second set of selectable parameters of the generic handler;

creating a custom handler responsive to the selection that inserts the at least one of the second set of selectable parameters into a security header of a SOAP message as specified by the at least one of the first set of selectable parameters;

sending, by the framework, the SOAP message to the web services security architecture;

determining, by the framework, whether the web services security architecture properly processes the at least one of the second set of selectable parameters inserted in the security header of the SOAP message as specified by the at least one of the first set of selectable parameters;

receiving selection of an additional one of the second set of selectable parameters of the generic handler responsive to the framework determining that the web services security architecture properly processes the at least one of the second set of selectable parameters inserted in the security header of the SOAP message as specified by the at least one of the first set of selectable parameters;

creating a second custom handler responsive to receiving selection of the additional one of the second set of selectable parameters that inserts the additional one of the second set of selectable parameters and the at least one of the second set of selectable parameters into a second security header of a second SOAP message as specified by the at least one of the first set of selectable parameters.

12. The computer-implemented method of claim 11 , wherein the security header comprises a designation of a security profile based on one of a designation of a web services security specification version and a designation of a vendor implementation of the web services security specification.

13. The computer-implemented system of claim 11 , wherein the at least one security profile includes each of a username/password token component, an X.509 certificate component, a Kerberos ticket component, an SAML assertion component, an XrML document component, and an XCBF document component.

14. The computer-implemented system of claim 11 , wherein the at least one security profile is further defined as including a plurality of security profiles, the plurality of security profiles selected from a group of security profiles consisting of a username/password token, an X.509 certificate, a Kerberos ticket, an SAML assertion, an XrML document, and an XCBF document.

15. The computer-implemented method of claim 11 , further comprising encrypting and digitally signing the SOAP message.

16. The computer-implemented method of claim 11 , further comprising configuring the generic handler to carry out performance testing.

17. The computer-implemented method of claim 11 , wherein the at least one security profile is selected from a group of security profiles consisting of a ticket, a token, an assertion, a document.

18. The computer-implemented system of claim 1 , further comprising:

a second one of the plurality of custom handlers created by selection of at least one additional security component of the handler upon a determination that the web services security architecture properly processes the at least one security component in the security portion of the first SOAP message from the first one of the plurality of custom handlers, the second one of the plurality of custom handlers stored on a computer readable storage medium and executable by a processor to insert the at least one security component and the at least one additional security component into a second security portion of a second SOAP message based on the specified one of the web services security version and the web services security draft related to the at least one security component.