simon bohdanowicz [http://community.jboss.org/people/simonpl] created the discussion "Re: WS Security Basics" To view the discussion, visit: http://community.jboss.org/message/567526#567526 -------------------------------------------------------------- Security in WS is pretty broad topic(e.g. one way of securing web service is setting it on SSL) - I'm also not an expert but I've got a bit of experience with it. There is someting "WS-Security" and it is a standard established by OASIS(wiki will tell you more about it). On the other hand, you can design security on your own. Considering your question: Usually this kind of data is passed in header part of soap message - exact way in which you attach username and password depends on client technology you're using(Jbossws, Axis2 etc.) I'm not sure what kind of magic you've got in mind - if you're using WS-Security standard then WS-Policy contains info about it(WS-Policy - another standard - is a document that contains additional settings for certain web service - it can be attached to wsdl or referenced by it) It can be solved like that but I've seen situations where client was receiving token after first call and later only token was attached to soap(it was valid for one session) Hope that helps -------------------------------------------------------------- Reply to this message by going to Community [http://community.jboss.org/message/567526#567526] Start a new discussion in JBoss Web Services at Community [http://community.jboss.org/choose-container!input.jspa?contentType=1&...]

simon bohdanowicz [http://community.jboss.org/people/simonpl] created the discussion "Re: WS Security Basics" To view the discussion, visit: http://community.jboss.org/message/568479#568479 -------------------------------------------------------------- I have never used it directly(ws-security) however jboss seems to be supporting most of the oasis standards. I guess that after configuration of ws-security(authentication, authorization, token etc. - in jboss there are special files for that, both on server and client side) client is just passing user credentials in the beggining, after that security is handled by the server/client(it fills soap message with right header parts). -------------------------------------------------------------- Reply to this message by going to Community [http://community.jboss.org/message/568479#568479] Start a new discussion in JBoss Web Services at Community [http://community.jboss.org/choose-container!input.jspa?contentType=1&...]

Ian Mitchell [http://community.jboss.org/people/imitchell] created the discussion "Re: WS Security Basics" To view the discussion, visit: http://community.jboss.org/message/569481#569481 -------------------------------------------------------------- Thanks for the scoop folks! So if i had multiple web services deployed to a single JBoss AS then could a user use any of the web methods of any of those web services with a single logon.  In other words, does JBoss maintain "security sessions" accross web services.  Is this the purpose of Security Domains? Thanks again -------------------------------------------------------------- Reply to this message by going to Community [http://community.jboss.org/message/569481#569481] Start a new discussion in JBoss Web Services at Community [http://community.jboss.org/choose-container!input.jspa?contentType=1&...]