Secure services exposed by HTTP bindings

We can use an HTTP binding with a wire format of JSON-RPC securely in a Service Component Architecture (SCA) application. Use intents to secure services that are exposed by the HTTP binding to remote web browser clients.

JSON-RPC is a remote procedure call (RPC) protocol encoded in the JavaScript Object Notation (JSON) format.

For information about using HTTP bindings in this product, refer to Use HTTP bindings in SCA applications.

Enable administrative and application security, if not done so already. To enforce intents to secure services that are exposed by an HTTP binding, administrative and application security must be enabled.

transition: In Version 8.0, the default value for the web authentication property webAuthReq is persisting, which enables credential persistence that allows login information to be available to unprotected web clients and enables additional access to user information. Set the webAuthReq property to lazy to prevent unprotected web clients additional access to user information through persisting credentials. For more information, see Security hardening features enablement and migration. We can set webAuthReq to lazy on the console Web security - General settings page:

1. Click Security > Global security > Authentication > web and SIP security > General settings.

2. Select Authenticate only when the URI is protected, which enables lazy authentication.

3. Click Apply.

For more information, see Web authentication settings.

Use the HTTP binding to secure services. To secure services, configure the requires attributes on the binding.http element.

1. Configure security for the HTTP binding service in an SCA composite definition.

   We can secure services that are exposed over an HTTP binding using intents. The following three intents are valid options for the requires attribute on the binding.http element:

   authentication.transport

   Requires any client invoking the service to provide valid authentication information.

   confidentiality.transport

   Requires any client invoking the service to do so over a secure transport that provides confidentiality of the transport.

   integrity.transport

   Requires any client invoking the service to do so over a secure transport that provides integrity of the transport.

   Edit a composite definition that exposes a Java service over the HTTP binding so that the exposed service requires a client to authenticate and communicate over a secure transport; for example:

   <composite>
     <service name="EchoService" promote="EchoComponent">
       <interface.java interface="echo.Echo"/>
       <tuscany:binding.http uri="/EchoService" requires="authentication.transport confidentiality.transport"/>
       <tuscany:wireFormat.jsonrpc/>
       </tuscany:binding.http>
     </service>
      <component name="EchoComponent">
       <implementation.java class="echo.EchoComponentImpl"/>
     </component>
   </composite>

   For information about authorization policy, refer to topics on SCA authorization and security identity policies.

2. Invoke a secure service that is exposed over an HTTP binding from a web browser.

   We can access the service directly from a JSP file or HTML page using the Dojo toolkit APIs from a web browser.

   If the service requires confidentiality or integrity, use the HTTPS protocol. If the service requires authentication, configure the client application to prompt the user for valid user name and password. If the default product settings enable single sign-on (SSO) and the user has authenticated previously, these credentials are automatically propagated in the request to the service.

What to do next

Test the service security.

Related concepts

Enablement and migration considerations of Security hardening features

Related tasks

Use HTTP bindings in SCA applications

Use SCA authorization and security identity policies

Implement single sign-on to minimize web user authentications

Manage Java 2 Connector Architecture authentication data entries for JAAS

Configure new Java 2 Connector authentication data entries using wsadmin

Specify bindings in an SCA environment

Web authentication settings

Java 2 Connector authentication data entry settings