Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
It is often the case that a DataPower developer will have work to do, but does not yet have a backend Service Provider to point the DataPower service at. In general, anything beyond trivial examples will need to point at something that returns a valid response. In order to satisfy this requirement,…
Read article: SOAP Web Service Mockup tutorial on DataPowerAnother use-case that I touched on during my JBoss World 2012 presentation was using the PicketLink WS-Trust Client implementation to communicate with third-party Security Token Services. In particular, we discussed how the PicketLink SAML2STSIssuingLoginModule can communicate with the IBM Tivoli…
Read article: JBoss/PicketLink WS-Trust Client and Third-Party Security Token ServicesI’ve been at a couple of different client sites where there was a heavy IBM product presence, the use of IBM’s proprietary token format-LTPA2, and the need for a non-IBM technology such as JBoss EAP. Given the nature of the LTPA2 technology (IBM proprietary protocol), there isn’t any direct support…
Read article: JBoss and LTPAv2 supportEver since I was first started working with IBM WebSphere DataPower I was looking around for someone that was offering access to a IBM WebSphere Datapower, I was looking around for someone that was offering access to an Internet-facing appliance that I could use for experimenting and learning. I…
Read article: DataPower Access Rental—Maybe DataPower in the Cloud?It’s been a few weeks since I have posted any updates. I started a new project at the beginning of June; it always takes a few weeks to get up to speed on an extended project. Integrating the IBM Tivoli Security stack and JBoss EAP was the subject of my JBoss World 2012 presentation.
Read article: JBoss World 2012 Session–Trusted Security with JBoss Enterprise Application PlatformI was recently involved in a conversation where someone asked the question what is FGA (Fine Grained Authorization) versus Coarse Grained Authorization(CGA)? From their perspective, there was just authorization. Further distinction was not needed.
Read article: Fine Grained Authorization versus Coarse Grained AuthorizationI generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…
Read article: RBM–Administrative Access & Security for DataPowerI’ve been in a couple of shops that have used the HSM module option of DataPower for FIPS 140-2 v2 or v3 compliance. An HSM is a Hardware Security Module. My understanding is that there is a short list of IBM customers that are using this technology. I thought collecting all the information and…
Read article: DataPower Appliances & HSMsI will be presenting at JBoss World 2012 in Boston the last week of June. I’ll be presenting with Anil Saldana on JBoss Security, PicketLink, and Identity Management, JBoss Security Architect. A link to the description can be found here. The original abstract:
Read article: JBoss World 2012 Session…I was recently presented with an opportunity to be clever while promoting DataPower objects from a development environment to a testing environment. The WS-Proxy object’s policy rules had a Transform Action that ran a custom stylesheet. The stylesheet referenced a configuration file that was kept…
Read article: DataPower Exports and XML Files Referenced by StylesheetsLooking for something specific? Browse all 124 topics.
