Security Policies in Web Services

2. Background On Policies In Web Services

Policies are defined as information which can be used to modify the behavior of a system. There are two reasons for using policies in Web services for developing interoperable business processes. Firstly, policies permit managing Web services at a higher level where details of composition are separated from the behavior of Web services. Secondly, policies help in creating interoperable and adaptive service systems. Policies also address issues like how to deal with Web service unreliability, and how to substitute a Web service with an equivalent one?

There are many ways to associate policies with Web services. A simple scenario for application of policy is “Consumer sends a service request to Provider. If the service request conforms to Provider’s policy for requests, then Provider accepts the request, else it returns a fault status.” This situation exists, for instance, where Provider requires Consumer to assign a unique identifier to its request, in accordance with WS-Reliability. If it receives a request with no suitable identifier, then it will return a fault status. Provider may publish its policy in one or more number of ways, UDDI, WSDL, HTTP, LDAP, DNS or in SQL or SAML request/response messages. Policies can also be included in SOAP headers.