Chapter 6: Service Deployment Patterns

Chapter 6: Service Deployment Patterns

Web Service Security: Scenarios, Patterns, and Implementation Guidance for Web Services Enhancements (WSE) 3.0

Microsoft Corporation

patterns & practices Developer Center
Web Service Security: Home
December 2005

One or more Web services are most easily deployed on an application server, such as Windows Server 2003, that hosts the Web service. Frequently, the application server then communicates with other resources, such as database servers, and in some cases, other application servers that contain data for the Web service to process.

As organizations consider externally exposing Web services, there is often a reluctance to deploy the application server hosting the Web service in the perimeter network that external applications can access. However, Web service standards are designed for this scenario through the use of message layer security and intermediaries that can inspect message content and perform message validation and routing capabilities. Intermediaries can be used to supplement existing firewall devices, which are often used to protect an organization's perimeter network.

This chapter includes a design pattern for a perimeter service router, which acts as an intermediary that can be deployed in your perimeter network and route messages to a Web service endpoint that resides on an internal network that is invisible to the client. It also includes an implementation pattern that shows how the perimeter service router can be implemented using Microsoft technologies. The implementation pattern also contains variations from the core design pattern that show how the intermediary can perform actions such as message validation in addition to routing. These patterns are the following:

• Perimeter Service Router
• Implementing Perimeter Service Router in WSE 3.0