WebLogic Web Services: Security

Introduction and Roadmap

Document Scope and Audience

WebLogic Web Services Documentation Set

Guide to This Document

Related Documentation

Samples for the Web Services Developer

Release-Specific WebLogic Web Services Information

Summary of WebLogic Web Services Security Features

Overview of Web Services Security

Overview of Web Services Security

What Type of Security Should You Configure?

Configuring Message-Level Security

Overview of Message-Level Security

Web Services Security Supported Standards

Web Services Secure Conversation

Web Services SecurityPolicy 1.2

Main Use Cases of Message-Level Security

Using Policy Files for Message-Level Security Configuration

Configuring Simple Message-Level Security: Main Steps

Ensuring That WebLogic Server Can Validate the Client’s Certificate

Updating the JWS File with @Policy and @Policies Annotations

Using Key Pairs Other Than the Out-Of-The-Box SSL Pair

Updating a Client Application to Invoke a Message-Secured Web Service

Invoking a Message-Secured Web Service From a Client Running in a WebLogic Server Instance

Creating and Using a Custom Policy File

Multiple Transport Assertions

Configuring and Using Security Contexts and Derived Keys (WS-SecureConversation)

WS-SecureConversation and Clusters

Updating a Client Application to Negotiate Security Contexts

Associating Policy Files at Runtime Using the Administration Console

Using Security Assertion Markup Language (SAML) Tokens For Identity

Associating a Web Service with a Security Configuration Other Than the Default

Using System Properties to Debug Message-Level Security

Using a Client-Side Security Policy File

Associating a Policy File with a Client Application: Main Steps

Updating clientgen to Generate Methods That Load Policy Files

Updating a Client Application To Load Policy Files

Using WS-SecurityPolicy 1.2 Policy Files

Transport Level Policies

Protection Assertion Policies

WS-Security 1.0 Username and X509 Token Policies

WS-Security 1.1 Username and X509 Token Policies

WS-SecureConversation 2005/2 Policies

Choosing a Policy

Smart Policy Selection

Unsupported WS-SecurityPolicy 1.2 Assertions

BEA Web Services Security Policy Files

Abstract and Concrete Policy Files

Auth.xml

Sign.xml

Encrypt.xml

Wssc-dk.xml

Wssc-sct.xml

Configuring Transport-Level Security

Configuring Transport-Level Security: Main Steps

Configuring Two-Way SSL for a Client Application

Additional Web Services SSL Examples

Configuring Access Control Security

Configuring Access Control Security: Main Steps

Updating the JWS File With the Security-Related Annotations

Updating the JWS File With the @RunAs Annotation

Setting the Username and Password When Creating the JAX-RPC Service Object