Creating a Secure Web Service In Informatica Data Services

Transcription

1 Creating a Secure Web Service In Informatica Data Services 2013 Informatica Corporation. No part of this document may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording or otherwise) without prior consent of Informatica Corporation. All other company and product names may be trade names or trademarks of their respective owners and/or copyrighted materials of such owners.

2 Abstract This article describes how you can create a web service with end-to-end security. Supported Versions Data Services Table of Contents Overview... 2 Data Integration Service Architecture... 3 Security Management of Web Services... 3 Configuring HTTP Client Filter Properties... 3 Configuring WS-Security or Message Layer Security... 4 Configuring WS-Security... 4 Adding WS-Security Header to the SOAP Request... 4 Assigning Permissions to the Web Service on the Web Service Application... 5 Configuring Transport Layer Security... 5 Enabling TLS for Web Service... 5 Enabling TLS for Data Integration Service... 5 Configuring Pass-Through Security... 5 Overview Informatica Data Services provides data integration functionality through a web service. A web service is a collection of web service operations that you can access over an intranet or the Internet. Web service operations are programs that return data. When you access a web service, you request that the web service perform an operation and return data. You can create a web service in the Developer tool. You can use business logic to create a web service operation and expose it to end users with Informatica Data Services. Web service operations include requests for information, requests to update data, or requests to perform tasks. When the web service operation sends or receives data over a network, the data is subject to security risks. This article address ways to access secure data with a web service using the Data Integration Service. 2

3 Data Integration Service Architecture The following diagram shows how the Data Integration Service handles web service requests: After the web service application deploys and starts on the Data Integration Service, the Data Integration Service receives requests from external clients. You can share the web service URL to include additional clients that can access the web service. The HTTP client filter controls the requests from the client machines based on the host name or IP address. The Web Service module handles web service requests. The web service module receives SOAP requests from clients. It starts the DTM process to perform the requested web service operation and sends the SOAP response back to the user. Security Management of Web Services To ensure a secure data transfer and authorized data access for a web service, you can use the following security options: HTTP Client Filter Message Layer Security Transport Layer Security Pass-through Security Configuring HTTP Client Filter Properties By default, any client from any machine can send a web service request. To restrict or accept a request to the Data Integration Service based on a machine hosting the web service client, you need to configure the HTTP client filter in the Administrator tool. If you deny a host, that host will not be able to access the WSDL and will receive the HTTP 403 forbidden error message. The host will also get the same error message if it sends the request from another client, such as SoapUI. To verify that host has access, check the server.xml file. 2. Select the Data Integration Service, and then click the Properties tab. 3

4 3. Configure the HTTP client filter properties to allow or deny requests based on the host name and IP address. You can use JAVA regular expressions for the IP address or the constants. For example, enter the value as follows: 10\.65\.4\ Restart the Data Integration Service for the changes to take effect. 5. Verify the server.xml file located at the following location has the correct list of hosts accepted and denied: <INFA_HOME>/tomcat/temp/<disname>/conf/ For example, the server.xml contains the following lines: <Valve classname="org.apache.catalina.valves.remotehostvalve" deny="inw "/><valve classname="org.apache.catalina.valves.remoteaddrvalve" deny="10\.65\.4\.182"/> Configuring WS-Security or Message Layer Security If you want the Data Integration Service to authenticate user credentials in SOAP requests, use the Administrator tool to enable WS-Security. If you send the user and password as part of the SOAP request, the Data Integration Service authenticates the user and allows the user to access or deny the web service request based on the assigned user permissions. Configuring WS-Security 2. Select the Data Integration Service, and then click the Applications tab. 3. Select the web service. 4. In the Web Service properties, set the value as True for Enable WS-Security. Adding WS-Security Header to the SOAP Request When you enable WS-Security, the web service requires the SOAP request to include the security header with the user token information. If you do not pass the security header in the SOAP request, the client returns a system defined fault response, with the following message: <faultstring>the web service is enabled for web service security. Add the WS- Security header to the SOAP message.</faultstring> Use the following format to add the standard SOAP header to the SOAP request: Note: You can only use plain passwords. You cannot use hash or digest passwords. 4

5 Assigning Permissions to the Web Service on the Web Service Application You can assign permissions to the web service on the web service application. 2. Select the Data Integration Service, and then click the Applications tab. 3. Select the web service. 4. In User Permissions tab, you can grant or deny access to the users. Configuring Transport Layer Security Use transport layer security (TLS) to secure the web service messages. The web service client and the web service communicate using an HTTPS URL after you enable TLS for a web service in the Administrator tool. The data transmits over a secure layer of SSL protocol. TLS functionality is independent of the message-level security (WS-Security) functionality. You can use either message-level security (WS-Security), transport-level security, or a combination of both. If you want to enable HTTPS for a web service, ensure that the Data Integration Service uses TLS. If you start web service application with TLS enabled and if the Data Integration Service is not enabled for TLS, the application fails and returns with the following error: WSPROC_10002 Web service [Web_Service_add0] failed to start because of the following error: [Internal error: [[WSCMN_10026] Web Service [Web_Service_add0] is configured to enable WS security, but HTTPS is not enabled in the Data Integration Service Enabling TLS for Web Service 2. Select the Data Integration Service, and then click the Applications tab. 3. Click the Actions menu and select Stop Web Service. 4. Select the web service. 5. In the Web Service properties, set the value as True for Enable Transport Layer Security (TLS). 6. Click the Actions menu and select Start Web Service. The WSDL URL changes from HTTP to HTTPS. Enabling TLS for Data Integration Service 2. Select the Data Integration Service, and then click the Processes tab. 3. Edit the Data Integration Service Security Properties, and select the checkbox against Enable Transport Layer Security (TLS). 4. Click OK. 5. Restart the Data Integration Service. Configuring Pass-Through Security Pass-through security is a technique used to pass the user name and password information to the web service through SOAP request and override the credentials in the web service connection in the mapping. You can apply pass-through security to any web service connection used in a mapping. For example, you use a Web Service Consumer transformation in the mapping with a web service connection that connects to the web service. You can select the pass-through security enabled option while editing the connection properties for the consumer transformation. 5

6 The Data Integration Service then overwrites the administrator user and associated password with the credentials received through the SOAP request and passes it to the web service. Ensure that the web service is enabled with WS-security to use the pass-through security. Author Sangeetha Ramappa Senior Technical Support Engineer 6