I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data integrity, protection, non repudiation..

So I fetched some real world solution to fill those needs, I found those for SOAP based web services:

Identification: WS-Security Framework

Authentication: Extensible Access Control Markup Language (XACML)


  • Extensible Rights Markup Language (XrML)
  • XML Key Management (XKMS)
  • Security Assertion Markup Language (SAML)
  • .NET Passport
  • Confidentialité
  • WS-Security Framework
  • XML-Encryption
  • Secure Sockets Layer (SSL)
  • WSS

And almost all of them are implementable using spring-security

On the other hand RESTful web services having the reputation to be less secure. Being based on the web SSL/TLS is a great solution for encryption, but other security protocols do exist like:

  • OAuth: used by facebook, twitter, without tokens exchange
  • OpenID: used by google
  • CAS
  • LDAP
  • Kerberos
  • Persona
  • BrowerID

Another solution may be to integrate the security in the enterprise bus as a service (Security as a Service)..

So my question is : Are there any other solutions I should know about?

closed as not a real question by rook, Rory Alsop May 10 '13 at 16:53

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Just a quick correction - .Net Passport doesn't exist any more. It was supplanted by Live ID (Now Microsoft Accounts) for Microsoft sites, and Live Connect which is an OAuth 2.0 provider for non-Microsoft sites. – Xander May 10 '13 at 14:16
  • Hi @Ozama - welcome to Security Stack Exchange. If you take a look at the faq you will see that questions like this, which ask for opinions are not really suitable here. – Rory Alsop May 10 '13 at 16:54

The list provided is just covering authentication and authorization of web services, which is one, very small component of security. Most of the OWASP top 10 applies to web services.

Not the answer you're looking for? Browse other questions tagged or ask your own question.