Best approach taking soa suite 11g on internet

Question

Currently our soa suite environment 11.1.1.4 is operating within intranet only. Now we need to publish our services on the internet. I am looking for the security mechanism that I should apply in order to make the services secure. I may even like to verify that the request invoking service A is only coming from specified context.
I have come across the page http://download.oracle.com/docs/cd/E21764_01/secure.htm. And this page is giving lot of information.
Can you please give me an idea what might be the best practices in this regard ? What options I have that can be implemented while taking soa suite 11g on the internet.

Answer 1

Now we need to publish our services on the internet. I am looking for the security mechanism that I should apply in order to make the services secure. I may even like to verify that the request invoking service A is only coming from specified context.One approach we followed at a customer :
- SOA was installed within internal firewall zone
- A F5 BigIP Load Balancer was setup in DMZ. This load balancer terminated one way SSL connections coming from service consumers over internet. The load balancer forwaded the request to a pool of apache of web servers within DMZ
- The Apache web servers had a redirection rule which forwarded the request to the soa server ports within the internal firwall zone. The internal firewall was opened to allow connections between apache web servers and soa server ports.
- WS Security Username token/plain text password was used for message level security at the soa services layer.
Some alterations you can do :
1. enforce 2 way ssl and make load balancer to validate the CN of the client certificate. This can make sure only authorized clients are to make calls to the service
2. OR setup some sort of IP filtering at DMZ firewall i.e. allow traffic only from authorized clients IP addresses to the load balancers virtual address for this specific service.