Integration Server Security
Integration Server’s security mechanisms prevent its unauthorized administration, prevent data from being intercepted during transmission, and protect Integration Server services from unauthorized access. You can configure Integration Server to:
Use an
Enterprise Gateway Server to intercept requests from external clients before passing the requests to your
Integration Server. This allows you to isolate
Integration Server behind an internal firewall.
Require clients to present valid credentials (i.e., user name and password or a client certificate) to authenticate a connection.
Authorize access to individual services by user groups, through use of Access Control Lists (ACLs) that you associate with a service. For the greatest security, associate
all services with an ACL.
Provide transport-level security through Secure Sockets Layer (SSL), and message-level security for web services through WS-Security.
Digitally sign documents and verify digital signatures.
Control access to services based on the port through which a service request is received.
Restrict who can access
Integration Server Administrator, and who can use
Software AG Designer to connect to the
Integration Server.
Require clients to present valid user names (with passwords) that have Administrator privileges before allowing access to the
Integration Server Administrator functions.
Simplify security administration by storing
Integration Server SSL certificates and private keys in industry-standard keystore files.
Allow different client certificates to be used for different connections.
Integration Server security also depends on the security of its underlying operating system. Make sure you do the following:
Follow all vendor recommendations for secure configuration.
Remove unnecessary network services that may contain security flaws, such as telnet.
Regularly check for and install updates and patches from the operating system vendor that might affect security.
See your operating system’s documentation for instructions on accomplishing these tasks.
For information about security auditing, refer to the webMethods Audit Logging Guide.