UDDI Registry Security

There are a number of security considerations for UDDI, which are covered in detail in other topics within this Information Center. This is a summary of UDDI security considerations, and contains links to the relevant topics where you can find further details.

Access to the UDDI APIs, or to the UDDI User Interface (UDDI User Console) is controlled by WebSphere
security mechanisms, although the UDDI authToken API is also supported (see The UDDI V3 Security API).

The UDDI Registry supports use of XML Digital Signatures to sign UDDI entities. This is described in Use of digital signatures with the UDDI Registry. A number of the UDDI property and policy settings also determine the behavior of a UDDI Registry with respect to security. These are described in UDDI node settings and UDDI node API policy settings, and include:

• Default user name

• Authorization for Inquiry, Authorization for Publish, Authorization for Custody Transfer

• Use authinfo credential if provided, Authentication token expiry period

• Key space requests require digital signature

See the topic UDDI Publisher settings for more information.

Although not a security aspect of the UDDI Registry, you should be aware that UDDI Tiers allow a form of control over the publishing of UDDI entities. Refer to Tier Collection for more details and also the 'Use tier limits' UDDI property.