Discover the basics of single sign-on and how SAML assertions are finding their way into projects like OpenSSO, NetBeans and Glassfish to secure web services. SAML V2.0, approved by OASIS in March 2005, is an XML-based framework for communicating user authentication, entitlement, and attribute information. Beyond defining the industry-standard protocol for cross domain Web single sign-on (SSO), SAML is a keystone of higher level specifications such as Web Services Interoperability Basic Security Profile (WS-I BSP), the Liberty Alliance's Identity Web Service Framework (ID-WSF) and even Microsoft's Cardspace.
Pat Patterson is a software architect at Sun Microsystems, working on the OpenSSO project and Federated Access Management product line. Pat has been working on Internet security and identity management since 1997, joining Sun in 2000 as an engineering manager in the Trustbase secure Web services team. After a four-year stint in product management, he returned to engineering early in 2005, focusing on federation and identity-enabled Web services. Pat speaks regularly at a variety of forums, from one-to-one executive briefings to major industry events such as JavaOne. Pat's blog centers on identity-related topics.
The Threat is Out There! XML Threats and DataPower— This session will show several classes and many types of XML attacks, how they can be used to affect service availability in software-based web services hosts, and how DataPower can be used to prevent such attacks.
Security Patterns revealed— Security Patterns are a great reference for building secure software, but they are mostly very abstract and ignore technologies like AOP, frameworks and libraries. Also, there are many patterns out there and it's hard to find the right ones.
How to hack and secure your Java web application— Some real world hacks will be demonstrated to show how easy it is to break the confidentiality or integrity of your data and how easy it is to break you web application! To finish off in a positive note: it IS possible to do it the right way.
Using Spring Security 2— This session presents not only the new features of Spring Security 2, but also shows some best practices and examples to get the most out of it. Covered architectures will include web (2.0) applications, web services and client/server applications.
Liberty Alliance ID-WSF 2.0— This session gives an overview of ID-WSF 2.0's layered architecture, focusing in particular on the new-in-version-2.0 People Service and how it allows consumers and organizations to manage social and enterprise applications such as bookmarks, blogging, calendars, e-mail, photo sharing and instant messaging in a federated social network. Learn how ID-WSF's SOAP based invocation framework builds on SAML's foundation to provide identity with privacy for web services.
