An Access Control Metamodel for Web Service-Oriented Architecture

With the mutual consent to use WSDL (Web Service Description Language) to describe web service interfaces and SOAP as the basic communication protocol, the cornerstone for web service-oriented architecture (WSOA) has been established. Considering the momentum observable by the growing number of specifications in the web service domain for the indispensable cross-cutting concern of identity management (IdM) it is still an open issue how a WSOA-aware IdM architecture is built and how it is linked with WSOA's main elements, the web services providing functional core concerns. In this paper we present an access control model for WSOA and a blueprint of a WSOA- aware authorization verification service which is part of the IdM architecture. We show the integration of this service with WSOA consisting of both basic and composite web services. Our solution has been tested and evaluated in an implementation case study.

I. Introduction

Currently most enterprises try to align their business processes with the supporting IT by migrating towards web service-oriented architecture (WSOA). Web service technologies are commonly recognized as a promising way for the implementation of SOA. However, WSOA is not meant to be built from scratch but rather the functionality of existing systems and their components have to be leveraged to web services. Bottom-up approaches start with the existing software systems and ease traditional application integration: web services feature standardized interfaces described using WSDL (Web Service Definition Language) as well as a standardized communication protocol, namely SOAP, which both are commonly accepted. The integration process can then be applied by the composition of web services of heterogeneous underlying software systems using process execution languages like BPEL (Business Process Execution Language) [1]. Top-down approaches start with business processes and focus at their model-driven mapping down to basic and composite web services. They enable business analysts to perform so-called programming-in-the-large, the system-independent orchestration of business-related (web) services along business processes [2].