System and method for bridging identities in a service oriented architectureprofiling
A system for bridging user identities between at least a first and a second security domain, including a bridge associated with the first security domain for intercepting messages for service in the second domain from users in the first domain. The bridge authenticates the user identities against a local authentication source by using an established key relationship and binds a security token with the message. A gateway is associated with the second domain for gating inbound access and outbound communication with a service in the second domain and for receiving the authenticated message and verifying the authenticity of the security token by using a certificate of the trusted authentication source and authorizing access to the service upon confirmation of the authorization, such that the authorization is independent of the identity of the user.
1. A system for securing web services on one or more server computers delivered to one or more client computers, comprising:
a. one or more policies stored on said one or more server computers that define rules that must be satisfied for a web service provided by said one or more server computers to be accessed by said one or more client computers;
b. an agent process residing on said one or more client computers;
c. a local authorization source residing on said one or more client computers; and
d. a gateway process residing on said one or more server computers, said agent process detects a refusal for said web service, said agent process requests and receives said one or more policies from said one or more server computers in response to detecting said refusal for said web service, said agent process caches said received one or more policies as a dynamically updateable policy on said one or more client computers, said agent process directly applies any policy changes received from said gateway process to said dynamically updateable policy, said agent process intercepts a service request message for said web service from said one or more client computers and determines an identity associated with said service request message, said agent process authenticates said identity using said local authorization source and acquires a security token from said local authorization source, said agent process decorates said service request message using said security token based on said dynamically updateable policy, said agent process transmits said decorated service request message to said one or more server computers, said gateway process receives said decorated service request message and verifies an authenticity of said security token, said gateway process authorizes access to said web service in response to said authenticity of said security token being verified, said gateway process authorizes access to said web service independent of said identity associated with said service request message.
2. A system as defined in claim 1 , wherein said identity associated with said service request message corresponds with a user identity of a user requesting access to said web service.
3. A system as defined in claim 1 , wherein said policies include a rule set.
4. A system as defined in claim 1 , wherein said policies include an assertion.
5. A system as defined in claim 1 , wherein said policies include message-rerouting information.
6. A system for bridging user identities between a first security domain and a second security domain, comprising:
a bridge residing within said first security domain, said bridge configured to intercept a service request message from a user in said first security domain for access to a web service in said second security domain, said user is associated with an identity, said bridge configured to authenticate said identity of said user and to bind a security token with said service request message;
a gateway network appliance residing within said second security domain, said gateway network appliance configured to receive said service request message and to verify an authenticity of said security token, said gateway network appliance configured to authorize access to said web service in response to said authenticity of said security token being verified, said gateway network appliance configured to authorize access to said web service independent of said identity of said user; and
an agent residing within said first security domain, said agent detects a refusal for said web service, said agent process requests and receives one or more logical expressions from said gateway network appliance in response to detecting said refusal for said web service, said agent configured to modify said service request message by applying said one or more logical expressions requested and received from said gateway network appliance according to a dynamically updateable policy received from said second security domain and stored at said agent, said agent configured to receive and apply directly from the gateway network appliance any policy changes.
7. The system of claim 6 , wherein said one or more logical expressions include a rule set, said rule set demands that said service request message be encrypted using AES encryption.
8. The system of claim 6 , wherein said one or more logical expressions include an assertion.
9. The system of claim 6 , wherein said one or more logical expressions include message-rerouting information.
10. The system of claim 6 , wherein said bridge authenticates said identity of said user using a local authorization source and acquires said security token from said local authorization source.
11. The system of claim 6 , wherein said gateway network appliance comprises a gateway server.