Anil The Integration point for a JBoss ESB Service could be an action class or Spring Listener class. This class could be the Policy Enforcement Point (PEP) for either authentication or authorization. The PEP would then call out to some mechanism, pluggable of course, to perform the analysis. The SAML Assertion (or other identification token) can be placed in the message header for both the ESB and web Service. Meta-data for authorization could be placed there too. I am looking into some open source identity managers and service providers. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4187127#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...