• Table of Contents Enterprise Java Security: Building Secure J2EE Applications By Marco Pistoia, Nataraj Nagaratnam, Larry Koved, Anthony Nadalin Publisher : Addison Wesley Pub Date : February 20, 2004 ISBN : 0-321-11889-8 Pages : 608 Slots : 1.0 "For a long time, there has been a need for a J2EE(TM) security book I am very happy to see there is now a book that can answer many of the technical questions that developers, managers, and researchers have about such a critical topic I am sure that this book will contribute greatly to the success of the J2EE platform and e-business." -From the Foreword by Steven A Mills, Senior Vice President and Group Executive, Software Group, IBM Corporation Enterprise Java(TM) Security: Building Secure J2EE(TM) Applications provides application developers and programmers with the knowhow they need to utilize the latest Java security technologies in building secure enterprise infrastructures Written by the leading Java security experts at IBM, this comprehensive guide covers the current status of the Java(TM) 2 Platform, Enterprise Edition (J2EE), and Java(TM) 2 Platform, Standard Edition (J2SE(TM)), security architectures and offers practical solutions and usage patterns to address the challenges of Java security To aid developers who need to build secure J2EE applications, Enterprise Java(TM) Security covers at length the J2EE security technologies, including the security aspects of servlets, JavaServer Pages(TM) (JSP(TM)), and Enterprise JavaBeans(TM) (EJB(TM))technologies that are at the core of the J2EE architecture In addition, the book covers Web Services security Examples and sample code are provided throughout the book to give readers a solid understanding of the underlying technology The relationship between Java and cryptographic technologies is covered in great detail, including: Java Cryptography Architecture (JCA) Java Cryptography Extension (JCE) Public-Key Cryptography Standards (PKCS) Secure/Multipurpose Internet Mail Extensions (S/MIME) Java Secure Socket Extension (JSSE) • Table of Contents Enterprise Java Security: Building Secure J2EE Applications By Marco Pistoia, Nataraj Nagaratnam, Larry Koved, Anthony Nadalin Publisher : Addison Wesley Pub Date : February 20, 2004 ISBN : 0-321-11889-8 Pages : 608 Slots : 1.0 Copyright Foreword Preface About the Authors Part I: Enterprise Security and Java Chapter 1 An Overview of Java Technology and Security Section 1.1 Why Java Technology for Enterprise Applications? Section 1.2 Enterprise Java Technology Section 1.4 An Overview of Enterprise Security Integration Chapter 2 Enterprise Network Security and Java Technology Section 1.3 Java Technology as Part of Security Section 1.5 Time to Market Section 2.1 Networked Architectures Section 2.2 Network Security Section 2.4 Java and Firewalls Section 2.3 Server-Side Java Technology Section 2.5 Summary Part II: Enterprise Java Components Security Chapter 3 Enterprise Java Security Fundamentals Section 3.1 Enterprise Systems Section 3.2 J2EE Applications Section 3.4 Connectors Section 3.6 Simple E-Business Request Flow Section 3.8 J2EE Security Roles Section 3.10 Programmatic Security Section 3.12 Secure E-Business Request Flow Section 3.3 Secure Interoperability between ORBs Section 3.5 JMS Section 3.7 J2EE Platform Roles Section 3.9 Declarative Security Policies Section 3.11 Secure Communication within a WAS Environment Chapter 4 Servlet and JSP Security Section 4.1 Introduction Section 4.2 Advantages of Servlets Section 4.4 The Deployment Descriptor of a Web Module Section 4.6 Authorization Section 4.8 Programmatic Security Section 4.10 Usage Patterns Section 4.3 Servlet Life Cycle Section 4.5 Authentication Section 4.7 Principal Delegation Section 4.9 Runtime Restrictions for Web Components Section 4.11 Partitioning Web Applications Chapter 5 EJB Security Section 5.1 Introduction Section 5.2 EJB Roles and Security Section 5.4 Authorization Section 5.6 Security Considerations Section 5.3 Authentication Section 5.5 Delegation Chapter 6 Enterprise Java Security Deployment Scenarios Section 6.1 Planning a Secure-Component System Section 6.2 Deployment Topologies Section 6.3 Secure Communication Channel Section 6.4 Security Considerations Part III: The Foundations of Java 2 Security Chapter 7 J2SE Security Fundamentals Section 7.1 Access to Classes, Interfaces, Fields, and Methods Section 7.2 Class Loaders Section 7.4 The Security Manager Section 7.6 Summary Section 7.3 The Class File Verifier Section 7.5 Interdependence of the Three Java Security Legs Chapter 8 The Java 2 Permission Model Section 8.1 Overview of the Java 2 Access-Control Model Section 8.2 Java Permissions Section 8.4 The Concept of CodeSource Section 8.6 The Basic Java 2 Access-Control Model Section 8.8 ProtectionDomain Inheritance Section 8.10 Summary Section 8.3 Java Security Policy Section 8.5 ProtectionDomain s Section 8.7 Privileged Java 2 Code Section 8.9 Performance Issues in the Java 2 Access-Control Model Chapter 9 Authentication and Authorization with JAAS Section 9.1 Overview of JAAS and JAAS Terminology Section 9.2 Authentication Section 9.4 JAAS and J2EE Section 9.3 Authorization Overview Section 9.5 Additional Support for Pluggable Authentication Part IV: Enterprise Java and Cryptography Chapter 10 The Theory of Cryptography Section 10.1 The Purpose of Cryptography Section 10.2 Secret-Key Cryptography Section 10.3 Public-Key Cryptography Chapter 11 The Java 2 Platform and Cryptography Section 11.1 The JCA and JCE Frameworks Section 11.2 The JCA API Section 11.4 JCE in Practice Section 11.3 The JCE API Section 11.5 Security Considerations Chapter 12 PKCS and S/MIME in J2EE Section 12.1 PKCS Overview Section 12.2 S/ MIME Overview Section 12.3 Signing and Verifying Transactions with PKCS and S/ MIME Section 12.4 Encrypting Transactions with PKCS and S/ MIME Section 12.5 Security Considerations Section 12.6 Future Directions Chapter 13 The SSL and TLS Protocols in a J2EE Environment Section 13.1 The SSL and TLS Protocols Section 13.2 HTTPS Section 13.4 Using SSL from within J2EE Programs Section 13.6 Summary Section 13.3 Using the SSL Support Built into J2EE Products Section 13.5 Examples Part V: Advanced Topics Chapter 14 Enterprise Security for Web Services Section 14.1 XML Section 14.2 SOAP Section 14.4 Security for Web Services: Motivations Section 14.6 Web Services Security Model Principles Section 14.8 Use Scenario Section 14.10 Security Considerations Section 14.3 WSDL Section 14.5 Security Technologies Section 14.7 Application Patterns Section 14.9 Web Services Provider Security Section 14.11 Futures Chapter 15 Security Considerations for Container Providers Section 15.1 Understanding the Environment Section 15.2 Authentication Section 15.4 Secure Communication Section 15.6 Access to System Resources Section 15.3 Authorization Section 15.5 Secure Association Section 15.7 Mapping Identities at Connector Boundaries Chapter 16 Epilogue Part VI: Appendixes Appendix A Security of Distributed Object Architectures Section A.1 RMI Section A.2 Stubs and Skeletons Section A.3 RMI Registry Section A.4 The Security of RMI Appendix B X.509 Digital Certificates Appendix C Technical Acronyms Used in This Book Section B.1 X.509 Certificate Versions A B D F H J L N P R T V X C E G I K M O Q S U W Appendix D Sources Used in This Book Copyright Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks Where those designations appear in this book, and Addison-Wesley was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals The authors and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein The publisher offers discounts on this book when ordered in quantity for bulk purchases and special sales For more information, please contact: U.S Corporate and Government Sales (800) 382-3419 corpsales@pearsontechgroup.com For sales ouside of the U.S., please contact: International Sales (317) 581-3793 international@pearsontechgroup.com Visit Addison-Wesley on the Web: www.awprofessional.com Library of Congress Cataloging-in-Publication Data Enterprise Java security : building secure J2EE applications / Marco Pistoia p cm Includes bibliographical references and index ISBN 0-321-11889-8 (pbk ; alk paper) Java (Computer program language) 2 Computer security I Pistoia, QA76.73.J3E58 2004 005.8dc22 2003063781 Copyright © 2004 by Pearson Education, Inc All rights reserved No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form, or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior consent of the publisher Printed in the United States of America Published simultaneously in Canada For information on obtaining permission for use of material from this work, please submit a written request to: Pearson Education, Inc Rights and Contracts Department 75 Arlington Street, Suite 300 Boston, MA 02116 Fax: (617) 848-7047 Text printed on recycled paper 1 2 3 4 5 6 7 8 9 10CRS0807060504 First printing, February 2004 Dedication To my wife, Paolina, for giving me the strength and courage to be the man God wants me to be Marco In loving memory of my father, who continues to inspire my L LAN local area network LDAP Lightweight Directory Access Protocol M MAC media access control MAC message authentication code MD5 Message Digest V5 MD5withRSA Message Digest V5 with Rivest-Shamir-Adleman MIME Multipurpose Internet Mail Extensions MIT Massachusetts Institute of Technology MQ message queuing MVC Model-View-Controller MVS multiple virtual storage N NCSA National Center for Supercomputing Applications NCSA National Computer Security Association NSAPI Netscape Connection Application Programming Interface NetBIOS Network Basic Input Output System NetREXX Net Restructured Extended Executor O OASIS Organization for the Advancement of Structured Information Standards OGSA Open Grid Services Architecture OMG Object Management Group OO object-oriented OOPSLA Object-Oriented Programming, Systems, Languages, and Applications ORB Object Request Broker OS operating system OS/2 Operating System 2 OS/390 Operating System 390 OSI Open Systems Interconnection OU organizational unit P PAM Pluggable Authentication Module PBE password-based encryption PC personal computer PDA personal digital assistant PKCS Public-Key Cryptography Standards PKI Public Key Infrastructure PRNG Pseudorandom Number Generator Q QoS quality of service R RACF Resource Access Control Facility RC2 Rivest's Cipher V2 RC4 Rivest's Cipher V4 RDBMS relational database management system RFC Request for Comments RMI Remote Method Invocation RMI-IIOP RMI over Internet Inter-Object Request Broker ROM read-only memory RSA Rivest-Shamir-Adleman S S/MIME Secure/Multipurpose Internet Mail Extensions S2ML Security Services Markup Language SASL Simple Authentication and Security Layer SDK Software Development Kit SHA-1 Secure Hash Algorithm V1 SHA1withDSA SHA-1 with Digital Signature Algorithm SMTP Simple Mail Transfer Protocol SNA Systems Network Architecture SOAP Simple Object Access Protocol SOCKS SOCKet Secure SPI service provider interface SQLJ Structured Query Language for Java SSL Secure Sockets Layer SSO single sign-on T TCP Transmission Control Protocol TCP/IP TCP/Internet Protocol TLS Transport Layer Security TPA Trading Partner Agreement TRNG true random number generator U UDDI Universal Description, Discovery and Integration UDP User Datagram Protocol URI universal resource identifier URL uniform resource locator V VDU visual display unit VM Virtual Machine VPN virtual private network W W3C World Wide Web Consortium WAR Web Archive WAS Web application server WS-Addressing Web Services Addressing specification WS-Policy Web Services Policy Framework specification WS-PolicyAssertions Web Services General Policy Assertions Language specification WS-PolicyAttachment Web Services Policy Attachment specification WS-SecureConversation Web Services Secure Conversation Language specification WS-Security Web Services Security specification WS-SecurityPolicy Web Services Security Policy Language specification WS-Trust Web Services Trust Language specification WSDL Web Services Description Language WWW World Wide Web X XACML eXtensible Access Control Markup Language XKMS XML Key Management Specification XML eXtensible Markup Language XOR eXclusive OR Appendix D Sources Used in This Book This book draws and expands on material from the following sources: • M Hondo, N Nagaratnam, and A Nadalin "Securing Web Services," IBM Systems Journal 41, 2, 2002 • L Koved, A Nadalin, D Deal, and T Lawson "The evolution of Java security," IBM Systems Journal 37, 3, 1998 • L Koved, A Nadalin, N Nagaratnam, M Pistoia, and T Shrader "The Security Challenges for Enterprise Java in an eBusiness Environment," IBM Systems Journal 40, 1, 2001 • A Nadalin and N Nagaratnam "J2EE Security: A WebSphere 4.0 Perspective," IBM DeveloperToolbox Technical Magazine October 2001 http://www.ibm.com/developerworks • A Nadalin, T Shrader, and B Rich "Java Cryptography Part 1: Encryption and Decryption," IBM DeveloperToolbox Technical Magazine December 1999 http://www.ibm.com/developerworks • A Nadalin, T Shrader, and B Rich "Java Cryptography Part II: Key Generation and Management," IBM DeveloperToolbox Technical Magazine March 2000 http://www.ibm.com/developerworks • A Nadalin, T Shrader, and B Rich "Java Cryptography Part III: Implementing Your Own Provider," IBM DeveloperToolbox Technical Magazine June 2000 http://www.ibm.com/developerworks • A Nadalin, T Shrader, and B Rich "Java Cryptography Part IV: JCE Export Considerations," IBM DeveloperToolbox Technical Magazine September 2000 http://www.ibm.com/developerworks • M Pistoia, D F Reller, D Gupta, M Nagnur, and A K Ramani Java 2 Network Security (Upper Saddle River, NJ: Prentice-Hall, 1999) • T Shrader, A Nadalin, and B Rich "When Cryptographic Messages Go Bad," IBM DeveloperToolbox Technical Magazine June 2000 http://www.ibm.com/developerworks ... To aid developers who need to build secure J2EE applications, Enterprise Java( TM) Security covers at length the J2EE security technologies, including the security aspects of servlets, JavaServer Pages(TM) (JSP(TM)), and Enterprise JavaBeans(TM)... 2 Platform, Enterprise Edition (J2EE) , and Java 2 Platform, Standard Edition (J2SE), security technologies in building a secure enterprise infrastructure containing Java- based enterprise applications. .. Public-Key Cryptography Standards (PKCS) Secure/ Multipurpose Internet Mail Extensions (S/MIME) Java Secure Socket Extension (JSSE) • Table of Contents Enterprise Java Security: Building Secure J2EE Applications