Web Service Security issue. need advice!!!

Question

I intend to create a webservice which provides a service for updating a clients data at a remote location. In other words, this service will update values stored in the database. Other than making sure that a user may not access others' data, are there any security concerns i should be wary of by allowing a web service to interact with a database?(although it will have to use the systems database handler class to do so)
I intend to secure the connection and also implement a verification method of the user.
-Thomas

Answer 1

Dimitar,
thanks a lot for response, this is something new for me.
When I edit Data Control Policies, JDeveloper throws following error:
Mar 13, 2012 5:43:23 PM oracle.j2ee.util.AnnotatedLogger logWithThrowable
SEVERE: The policy manager repository path "C:\Dokumente%20und%20Einstellungen\fasda\Anwendungsdaten\JDeveloper\system11.1.1.6.38.61.92\DefaultDomain\oracle\store\gmds" does not contain any valid directories.
java.lang.IllegalArgumentException: WSM-04694 : An invalid directory was provided to connect to a file-base MDS repository.
When I ignore this error, "Edit Data Control Policies" window is displayed. There are no selected policies in the Security Tab.
====
Edited by: DanielF on 13.03.2012 09:51
Web service expects header in following format:
<soapenv:Header>
<wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-1" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>username</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
How shall I set up the Control Policies?
Thanks a lof for support,
Daniel