Patent ID: 7788716

Claim:
A web services security system comprising: a computer, including a plurality of web services operating thereon which are configured to receive requests and provide responses in the form of messages, and wherein each web service has a security policy associated therewith; a security framework including a plurality of security service provider interface (SSPI) which is configured to provide identity assertion, credential mapping, and validation of requests to the web services; a web services security handler associated with each web service, which is configured to extract tokens from the messages directed as requests to that web service; a token handler application programming interface (API) provided as an interface between the web services security handler and the security framework, which API can be instantiated to accept token types defined by the security policy for the web service, and convert the tokens extracted by the web services security handler to object credentials for processing by the security framework; wherein when a message is received for a web service, the web services security handler associated with the web service extracts tokens from the message according to the security policy, and provides corresponding object credentials via the API to the security framework; wherein the security framework then uses the object credentials to enable secured access to the web service; and wherein the messages are simple object access protocol (SOAP) messages, and wherein the token handler API converts token XML in the SOAP messages into java object credentials.