Đang chuẩn bị liên kết để tải về tài liệu:
Mastering Web Services Security phần 10

Thông thường, dữ liệu này được tổ chức tại các cơ sở dữ liệu quan hệ trở lại. Trong nhiều trường hợp, dữ liệu này của công ty, chẳng hạn như kế toán, dữ liệu thông tin khách hàng, hoặc các thông tin của nhân viên, đã tồn tại trong hệ thống trước khi bất kỳ của các công nghệ mới, | Planning and Building a Secure Web Services Architecture 389 Figure 12.6 ePortal customer LDAP schema. On the security side the type of schema used for our customers matches the format of the customer names in their X.509 SSL certificates making this a seamless match as we move toward client certificates. In addition to the node names in the LDAP structure each node can hold a set of attributes which are key value pairs. This is another example of an overloaded name. An LDAP attribute is not a security policy attribute although a security policy attribute could be placed in an LDAP attribute value field. LDAP attributes are where the telephone numbers and office numbers are stored. Your security service could define a password attribute in the Common Name CN LDAP node and use that attribute to store the user s password preferably in encrypted form. In order to store the password the LDAP schema has to be expanded. The schema is controlled by an object class which lists the required and allowed attributes for example the schema that we used for our customers is the Person Object Class. This object class requires the CN and the surname SN . So in addition to CN Mary Smith the security service has to have SN Smith. But back to the password. The security provider could define a derived object class from the Person class and define an allowed attribute Password or it could use a standard derived class that contains the password attribute. The reason that it may define its own object class is so it can define additional attributes for example a unique customer ID. In our case we wanted our own schema in order to have the flexibility to add other marketing attributes. If your security provider uses LDAP there are a few things that you should look for in their LDAP implementation. We have seen some instances in which the provider uses one of the standard fields for its own use for example putting the password in an attribute field that it guessed its customers would not .