Web Services Manager Control, SOA Suite, Retrieving Roles from OID

Question

I am a bit confused about mapping of groups and privileges when it comes to the LDAP (in my case oracle internet directory, OID) and groups defined by Web Services Manager Control.
I am using Web Services Manager Control->Manage Policies to define a gateway (or agent) for my web services. Through      
Policy Management > Manage Policies > Policies > Policy
I have also defined some pipeline steps which require authorization by an LDAP provider.(OID)
I need two things:
- First I have such roles and groups here in Web Services Manager:
Administration > Groups / Roles
Group Name      Role Name      
su1-grp      Super User      
da1-grp      Domain Administrator      
ca1-grp      Component Administrator      
ca2-grp      Component Administrator      
which could be set for view and modification of web services. What is the relation between these groups and user groups in Oracle Internet Directory which I authorize against?
- Second, my web services are invoked from pages which access to them involves authentication and authorization against OID. I need the username/password to be propagated to the webservice automatically. If the web service is presented as a button on such pages, for example, I don't want the user to be forced to enter username/passwords for each call to the services/
I appreciate any comments or reference to books and documents.
Thank you in advance.
Best Regards,
Farbod

Answer 1

Hi Farbod
Your problem is not new and i have posted in couple of other threads before.
Roles in OID are for you to authorize the web service message itself. In your case when the user logins to your web application and calls the web service, you have to do two things:
a) Extract Credentials
b) AUthenticate against LDAP
c) Perform authorization against LDAP
Now the trick part is, you have to have the same username and password. You have to capture and store in session( ugly ugly..from security point of view) and then when you call the web service, you then invoke with the username and password.
There are other better options available but might require additonal work or infrastructure.
If your web application is protected by Oracle Access Manager or siteminder, you can pass those cookies.
Next option is using SAML. You can generate SAML token on behalf of the user, and attach the SAML token to the web service messsage. In OWSM you then configure to validate SAML token and then you have to write custom step to extract the user name and perform any authorization.
Since anyway you have to write custom step, third option is you can send encrypted cookie ( You web application can create a login session cookie -encrypted after the user signed in ). In OWSM you can write custom step to decrypt the cookie and then perform any validation.
You have the easiest option of sending the same username and password with a security risk, or a custom development approach.
Thanks
Ram