WS-X and WSE 2

By Martin Heller

September 8, 2003

(WS-X and WSE 2 :  Page 1 of 1 )

When XML Web services were first introduced, they sounded (at least if you believed the hype) like the ultimate answer to the question of life, the universe, and everything—no, wait, that's 42. At any rate, they sounded like a terrific way to build distributed systems over the Internet. Once the bandwagon started forming, the implementations started rolling out, and the interoperability questions got resolved, they actually did become a pretty good way to build distributed systems over the Internet, even if you had to deal with multiple programming languages and multiple operating systems.

There was one small problem, however: Web services didn't have any real security mechanism at that point. The original XML Web services standard had an empty security section. If you wanted a secure application, the basic idea was to lock it down yourself with a combination of perimeter security (firewalls), encryption (SSL and VPNs), and application-level security (typically encrypted user IDs and passwords).

That was kind of fixed in the WS-Security specification, but when you started building applications with WS-Security it was clear that a whole bunch of secondary problems—practical things like establishing inter-domain trust—had been left hanging. These have been addressed in the WS-Trust, WS-SecureConversation, WS-SecurityPolicy, WS-Addressing, and WS-Policy specifications.

As it says in the WS-Trust specification, "By using the XML, SOAP and WSDL extensibility models, the WS* specifications are designed to be composed with each other to provide a rich Web services environment." In other words, all the different WS-X specs are pieces of the puzzle.

Microsoft Web Services Enhancements

As you might expect given Microsoft's marketing push around XML Web services, Microsoft has been one of the leaders in getting these specifications written, approved, and implemented. Microsoft's implementation of WS-Security for the .NET Framework was part of its BYTE.com > Mr. Computer Language Person > 2003