SOA Web Services Security Testing

Today, while I was searching for some information regarding SOA and security in web services, I found this article written by one of my colleagues.

Here is the link to  the article:


http://ipsec.pl/web-application-security/2013/web-services-security-testing.html

Java vs J2EE vs JEE - Java Enterprise Edition Explained

TL;DR

• Java - is a programming language

• JEE - Java Enterprise Edition based on Java 1.5+ - is a platform as a collection of technologies based on Java, for developing and deploying enterprise applications. The J2EE platform consists of a set of services, application programming interfaces (APIs), and protocols that provide the functionality for developing  highly available, scalable, secure, modular applications.

• J2EE - older 'version' of J2EE based on java <1.5

• JEE = Web Clients (HTML/XML) + Web Components (Servlets/ JSP) + Business Components (EJBs)

• JEE Components - self-contained functional software assembled into JEE application with its related classes and files, and communicates with other components. In most cases component provides specific function and is part of a larger program and runs within container. Example components:

• Client components - Application clients / applets

• Web components - JSP/ Servlets

• Business components - EJB (Enterprise Java Beans)

• Resource Adapter components

• JEE Container - maintains individual components, it is the interface between a component and the low-level platform specific functionality that supports the component. Before a Web, enterprise bean, or application client component can be executed, it must be assembled into a J2EE application and deployed into its container.

• JEE Modules - one or more JEE components for the same container type and one component DD (Deployment Descriptor) of that type.

Source: http://docs.oracle.com/javaee/1.3/tutorial/doc/images/Fig55.gif

Details:

JEE stands for:

"Java Enterprise Edition based on Java 1.5+ - is a platform as a collection of technologies based on Java, for developing and deploying enterprise applications"

JEE consists of many different technologies. Main parts are:

Application Components - Components are self-contained functional software assembled into JEE application with its related classes and files, and communicates with other components. In most cases component provides specific function and is part of a larger program and runs within container. Example components:

• Client components - Application clients / applets
• native/ 'fat' applications
• applets on the user side

• Web components - JSP/ Servlets

• Business components - EJB (Enterprise Java Beans)

• Resource Adapter components

Containers - Every kind of component sits within a container and has one container.

Containers also provide a declarative mechanism for configuring applications and components during assembly or deployment through the DD (deployment Descriptors). Inside one container we can have several applications with different DDs. Example containers:

• Web Containers
• Web Containers provide runtime support for the user requetsts and produce responses based on the form and variables in the request. Process usually startes the execution of Servlets or JSP.

• EJB Containers
• These provide EJB (Enterprise Java Beans) components by automated support for transaction, security, persistence, and life cycle management of deployed components. 

• Resource managed drivers - resource adapters
• these are mainly drivers that provide connectivity to an external components.