A way to move towards a service-oriented architecture, is for the application managed approach to re-focus on security as an API/SPI interface with SPI providers adhering to standardized interfaces (e.g., JAAS, JACC, web services based authorization). Within a service-oriented architecture, the applications can then move to an infrastructure managed approach to security as a first step. Migrating security is not something that is achieved overnight (if ever). It is important to move towards this approach in a logical manner. The first step is to move as much of the application managed security functionality towards implementation of standardized interfaces for security providers. This starts the process of common security functionality, as shown in Figure 6, below.
Brokering Security through a Reverse Proxy
Another step along the path to a service-oriented architecture is to introduce a specialized component, in this case a reverse proxy server to the architecture, as shown in Figure 7. This component is typically already a part of many Enterprise architectures, where it is used to provide perimeter-based security services for the Enterprise. A reverse proxy moves authentication functionality to the edge (or perimeter) of the network, so that only authenticated users are allowed into the Trusted Network. This front-end component may also provide coarse-grained access control decisions, eliminating unauthorized requests to the back-end resources. These access control decisions may be coarse-grained (the user is authenticated and therefore access can be granted) or fine-grained (the user is not a member of the group/does not have the role required to access the requested resource) if the information required to make the fine-grained decision is available to the edge-based decision point.
Figure 4: Moving Towards Infrastructure Managed Security: Reverse Proxy Pattern
This additional step consolidates security functionality to a single logical point (the reverse proxy server) thus identifying a common security point. This common security point in turn provides an opportunity to define a common security service, a core component of SOA. A common security service can also help with systems management issues eliminating the need for detailed knowledge of authorization decisions in the back-end application as part of the fulfillment of that application.
4
Print this article
Email this article
Talk Back!
Write to Editor
