WS-Security
Web Services Security (WS-Security, WSS) is an extension to SOAP to apply security to Web services. It is a member of the Web service specifications and was published by OASIS.
The protocol specifies how integrity and confidentiality can be enforced on messages and allows the communication of various security token formats, such as Security Assertion Markup Language (SAML), Kerberos, and X.509. Its main focus is the use of XML Signature and XML Encryption to provide end-to-end security.
Features
WS-Security describes three main mechanisms:
How to sign SOAP messages to assure integrity. Signed messages also provide non-repudiation.
How to encrypt SOAP messages to assure confidentiality.
How to attach security tokens to ascertain the sender's identity.
The specification allows a variety of signature formats, encryption algorithms and multiple trust domains, and is open to various security token models, such as:
X.509 certificates,
Kerberos tickets,
User ID/Password credentials,
SAML Assertions, and
