kri shan wrote:How to support state and security between loosely coupled services using ESB ?
OAuth and HTTPS work well for the security part of your question. ESBs generally are stateless, so I'm not sure why you ask that part of your question. ESBs do not keep track of multiple calls through it for association of related requests. The caller to the ESB is supposed to track its state. ESBs sometimes aggregate services and reply to requests the status of the aggregation, but here again, the state is not tracked by the ESB nor is it supposed to be.
You might try interfacing with the SOA ESB community : soabus.org