Chapter 6. Federated single sign-on 259
6.3 Security design objectives
According to our requirements and security assessment, the following design
objectives should be covered by the new architecture:
The Access Manager WebSEAL reverse proxy is the central authentication
instance, even for participating wholesalers.
The wholesaler must be authenticated by using an X.509 certificate, which is
issued by a trusted CA. This requires that all Web Services requests from the
wholesalers uses SSL Version 3.
The communication between the wholesaler and the reverse proxy must be
encrypted.
The security implementation is purely on the HTTP level. Furthermore, no
security is implemented on the SOAP level.
To ensure that any wholesaler gets only ...