Security issues have to be carefully considered for information systems that support the business processes of an organization, in particular, when these systems build on open interfaces such as web services. In this paper, we examine the new BPEL extension
from an access control perspective. In particular, we discuss the importance of “separation of duty” constraints and identify options to specify such constraints in BPEL4People processes. Moreover, we identify and discuss shortcomings of the BPEL4People specifications that complicate and/or impede separation of duty enforcement. In addition, we suggest solutions which can be introduced into future versions of BPEL4People to mitigate those shortcomings.
Bitte loggen Sie sich ein, um Zugang zu diesem Inhalt zu erhalten