Overview

This advanced seminar will introduce Java developers to key technology for developing and deploying secure Web services. This course uses interactive discussions and hands-on exercise to illustrate XML signature and encryption standards, the WS-Security specification and token profiles, and the Security Assertions Markup Language (SAML). Using various case studies, each student will practice signing and encrypting XML message content, and configuring J2EE tools to support signature and encryption of SOAP messages under the Java API for XML-Based RPC (JAX-RPC).

The course emphasizes practical hands-on exercise, and approximately 50% of their classroom time solving specific security problems. The initial exercise will focus on XML signature and encryption work using local files, However, the bulk of the work is with running JAX-RPC web services: adding WS-Security headers, signing and encrypting message content, and passing SAML assertions among various parties to a messaging scenario.

Prerequisites

You should be familiar with the basics of the Java language and experience in developing Java Web services is assumed via either JAX-RPC or SAAJ. Additionally, experience with XML is encouraged

Class Format

Lecture and Lab

Audience

This course is designed for Java programmers who need to build secure applications. It has also proved helpful for system administrators and security officers who need a clear understanding of how security works within Java.

Learning Objectives

After completing this course, the student should be able to:

• Learn the role of security with Web services
• Illustrate HTTP protocols
• Demonstrate basic HTTP security concepts and authentication schemes
• Understand JAX-RPC support with HTTP security
• Comparison of HTTP and HTTPS
• Depict the role of encryption and hashing
• Define the usage of XML signatures
• Illustrate the JCA architecture
• Demonstrate the architecture of X.509 Certificates
• Depict the usage of Keystores and the KeyStore API
• Understand basics of XML encryption
• Define WS-Security specification and integration into JAX-RPC services
• Demonstrate ability to prevent hacker attacks
• Illustrate the role of SAML
• Depict the SAML assertion schema and use of SAML tokens