Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Security Specifications

# Web Services Security Specifications

The OASIS Web Services Security: SOAP Message Security V1.0 specification adds enhancements to SOAP messaging to provide protection through integrity, message confidentiality, and single message authentication. This specification, together with Web Services Security: Username Token Profile V1.0 and Web Services Security: X.509 Token Profile V1.0 are used by the Gateway to implement the standard security tokens (UsernameToken, X509SecurityToken) and, through customisation, the session based GatewayToken security token.

The Web Services Trust Language: WS-Trust (2004/04) specification includes extensions that build on WS-Security to request and issue security tokens and to manage trust relationships. The Gateway Security Token Service (STS) used to create and exchange GatewayToken, SAML Assertion and TicketBook security tokens conform to this specification.

SAML Assertions created and exchanged through STS (via RST/RSTR messages) conform to the SAML V1.1: Assertions and Protocols specification. It defines the syntax and semantics for XML-encoding assertions about authentication, attributes and authorisation. Note that the protocol for requesting and returning SAML Assertions also defined in the specification is not used.

The specifications described, in conjunction with the XML-Signature Syntax and Processing specification, allow messages to be digitally signed. Note that XML encryption of messages is not used by the Gateway.

See other security specifications for a full list of specifications/standards in this group.

© Crown Copyright 2008. All rights reserved