WS Security Header over WSM ServerAgent

Question

Hello!
I've got a OWSM ServerAgent in front of my webservice. This agent does the authentication and authorization, but the webservice behind needs the user. The WS should get the user out of the principle, but with the agent in front there is no principle to reach.
Have you any ideas, how can I get the user name out of the security header into my WS?
Thank's in advance - Claus

Answer 1

It's a preference of using transport-level security(two-way ssl) and message-level security(x.509 for identity, digital signature and xml encryption), or even the combination of both. When using https, every packet is encrypted across the wire. The encrypted key is exchanged during the initial handshakes. The process is application independent as long as the x.509 certificates are valid and trusted between the two parties. On the other hand, message-level security is a bit more complicated and application specific since you can decide which part of the message you want to sign or encrypt and what token you can want to use for particular needs and requirements. It's more flexible and powerful. So it's really up to your application and your personal preference to pick what security mechanism you want to apply.