Công nghệ bảo mật hiện tại, chẳng hạn như SSL, có những hạn chế. Chúng tôi sẽ giải quyết vấn đề này chủ đề cụ thể trong chương này bởi vì nó sẽ giúp bạn hiểu lý do tại sao các bộ công cụ WSE đóng một vai trò quan trọng trong sự phát triển của một dịch vụ web an toàn. Những hạn chế này trong các lĩnh vực sau đây | 166 CHAPTER 7 EXTENDED WEB SERVICES SECURITY WITH WS-SECURITY AND WS-SECURE CONVERSATION How to Implement Secure Conversation Using WSE A secure conversation is simply a session between a service and a client where the exchanged SOAP messages are encrypted and signed using tokens that are generated from an STS provider. WSE allows any Web service to act as an STS provider via simple policy configuration settings. Consider a Web service that already implements the UsernameForCertificateSecurity turnkey security profile. It can be reconfigured to issue security context tokens SCTs by setting the attribute establishSecurityContext to true as shown in Listing 7-6. Listing 7-6. Configuring a Web Service to Issue Security Context Tokens for Secure Conversation UsernameForCertificateSecurity establishSecurityContext true renewExpiredSecurityContext true RequireSignatureConfirmation false MessageProtectionOrder SignBeforeEncrypting RequireDeriveKeys true ttlInSecconds 300 The attribute renewExpiredSecurityContext causes the secure conversation to automatically renew in the event that the session times out due to the SCT token expiring . In the event of a time-out the STS provider will issue a replacement SCT that has a different identifier from the original but this fact will be transparent to the secure conversation participants. In the event of a communication interruption between the service and client the SCT token may be lost from memory at the service and the secure conversation will not renew unless the client has implemented a stateful session which is simply a method of holding the SCT token outside of memory. A stateful session is maintained from the client perspective in that the client will store the SCT token identifier in a cookie and will retrieve it if the SCT token is lost from memory at the service. This behavior can also be leveraged to implement secure conversation in a Web farm so that the client may communicate with different instances of the
