Authentication Token 

Specifies which supporting token will be used to sign and/or encrypt the specified message parts. Options include Username, X509, SAML, Issued, or None 

Username 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

An algorithm suite specifies actual algorithms and allowed key lengths. A mechanism alternative will define what algorithms are used and how they are used. The value of this attribute is typically referenced by a security binding and is used to specify the algorithms used for all cryptographic operations performed under the security binding. The default value is Basic 128 bit.  

Some of the algorithm suite settings require that Unlimited StrengthEncryption be configured in the Java Runtime Environment (JRE), particularly the algorithm suites that use 256 bit encryption. For instructions on downloading and configuring unlimited strength encryption, see: http://java.sun.com/products/jce/javase.html or http://java.sun.com/javase/downloads/index_jdk5.jsp#docs

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header.  

The options are:

• Strict: Items are added to the security header following the general principle of ?declare before use?

• Lax: Items are added to the security header in any order that conforms to WSS: SOAP Message Security. However, WSIT follows Strict even when Lax is selected.

• Lax (Timestamp First): The same as Lax, except that the first item in the security header must be a wsse:Timestamp.

• Lax (Timestamp Last):The same as for Lax, except that the last item in the security header must be a wsse:Timestamp.

Strict 

Require Derived Keys 

Specifies that a derived key is required.  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key (for example, when using Secure Conversation) for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

When this option and Require Derived Keys are both enabled, a derived key will be used. If not, the original session key will be used.  

Note on Secure Session and Reliable Message Delivery: Reliable Messaging can be used independently of the security mechanisms; however, when used with a security mechanism, Reliable Messaging requires the use of Secure Session, which will be automatically configured for a security mechanism when Reliable Messaging is selected before the security mechanism is selected. If Secure Session is selected for a security mechanism and the Reliable Messaging option is not selected before the security mechanism is specified, Reliable Messaging will need to be manually selected in order for Secure Session to work. 

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Key above for more information. 

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys 

Specifies that a derived key is required.  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key (for example, when using Secure Session) for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys above for more information. 

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Client Certificate 

Specifies that a client certificate must be provided to the server for verification. 

If you are using a security mechanism with SSL, a client certificate will be required by the server both during its initial handshake and again during verification.  

Check box Selected indicates disabled. 

Authentication Token 

Specifies which supporting token will be used to sign and/or encrypt the specified message parts. Options include Username, X509, SAML, Issued, or None 

Username 

WSS Version 

Specifies which version of the Web Services Security specification is followed. Options are 1.0 and 1.1. 

Enabling WSS 1.1 enables the Server to reuse an encrypted key already generated by the client. This saves the time otherwise required to create a Symmetric Key during the course of response, encrypt it with the client public key (which is also an expensive RSA operation), and transmit the encrypted key in the message (it occupies markup and requires Base64 operations). Enabling WSS 1.1 also enables encrypted headers.  

1.1 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session.  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys for Secure Session.  

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

SAML Version 

Specifies which version of the SAML token should be used. The SAML Version is something the CallbackHandler has to verify, not the security runtime.  

SAML tokens are defined in WSS: SAML Token Profile documents, available from http://www.oasis-open.org/specs/index.php.

1.1 (Profile 1.0) 

WSS Version 

Specifies which version of the Web Services Security specification is followed. Options are 1.0 and 1.1. 

Enabling WSS 1.1 enables the Server to reuse an encrypted key already generated by the client. This saves the time otherwise required to create a Symmetric Key during the course of response, encrypt it with the client public key (which is also an expensive RSA operation), and transmit the encrypted key in the message (it occupies markup and requires Base64 operations). Enabling WSS 1.1 also enables encrypted headers.  

1.1 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Client Certificate 

Specifies that a client certificate must be provided to the server for verification. 

If you are using a security mechanism with SSL, a client certificate will be required by the server both during its initial handshake and again during verification.  

Check box Selected indicates disabled. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Key above for more information. 

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys for Secure Session.  

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

SAML Version 

Specifies which version of the SAML token should be used. The SAML Version is something the CallbackHandler has to verify, not the security runtime.  

SAML tokens are defined in WSS: SAML Token Profile documents, available from http://www.oasis-open.org/specs/index.php.

1.1 (Profile 1.0) 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys 

Specifies that a derived key is required.  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys above for more information. 

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

SAML Version 

Specifies which version of the SAML token should be used. The SAML Version is something the CallbackHandler has to verify, not the security runtime.  

SAML tokens are defined in WSS: SAML Token Profile documents, available from http://www.oasis-open.org/specs/index.php.

1.1 (Profile 1.0) 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys 

Specifies that a derived key is required  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys above for more information. 

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

Issuer Address 

Specifies the address of the issuer (STS) that will accept the security token presented in the message. The element type is an endpoint reference. An STS contains a set of interfaces used to issue, exchange, and validate security tokens. 

For example, for JAX-WS services, the Issuer Address is: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Issuer Metadata Address 

Specifies the address from which to retrieve the issuer metadata. This should just be the URLs.  

For example, for JAX-WS services, the Issuer Metadata Address is as follows: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Token Type 

Specifies the type of SAML token required by the service provider. For example: urn:oasis:names:tc:SAML1.0:assertion.

The options are 1.0, 1.1, or 2.0. 

1.1 

Key Type 

Specifies the type of key preferred by the service provider.  

The choices are public key or symmetric key:

• Symmetric Key cryptography relies on a shared secret and is usually faster than Public Key cryptography

• Public Key cryptography relies on a key that is made public to all and is primarily used for encryption but can be used for verifying signatures.

Applies to Issued Token mechanisms only. 

Symmetric Key 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys for Issued Token 

Specifies that a derived key is required for Secure Session.  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys for Issued Token.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys for Issue Token above for more information. 

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

Issuer Address 

Specifies the address of the issuer (STS) that will accept the security token presented in the message. The element type is an endpoint reference. An STS contains a set of interfaces used to issue, exchange, and validate security tokens. 

For example, for JAX-WS services, the Issuer Address is: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Issuer Metadata Address 

Specifies the address from which to retrieve the issuer metadata. This should just be the URLs.  

For example, for JAX-WS services, the Issuer Metadata Address is as follows: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Token Type 

Specifies the type of SAML token required by the service provider. For example: urn:oasis:names:tc:SAML1.0:assertion.

The options are 1.0, 1.1, or 2.0. 

1.1 

Key Type 

Specifies the type of key preferred by the service provider.  

The choices are public key or symmetric key:

• Symmetric Key cryptography relies on a shared secret and is usually faster than Public Key cryptography

• Public Key cryptography relies on a key that is made public to all and is primarily used for encryption but can be used for verifying signatures.

Applies to Issued Token mechanisms only. 

Symmetric Key 

Key Size 

Specifies the size of the symmetric key requested in number of bits.  

This information is provided as an indication of the desired strength of the security. Valid choices include 128, 192, and 256. The security token is not obligated to use the requested key size, nor is the STS obligated to issue a token with the same key size. That said, the recipient should try to use a key at least as strong as the specified value if possible.  

Applies to Issued Token mechanisms only. 

128 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys 

Specifies that a derived key is required  

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys.  

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys above for more information. 

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled. 

Issuer Address 

Specifies the address of the issuer (STS) that will accept the security token presented in the message. The element type is an endpoint reference. An STS contains a set of interfaces used to issue, exchange, and validate security tokens. 

For example, for JAX-WS services, the Issuer Address is: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Issuer Metadata Address 

Specifies the address from which to retrieve the issuer metadata. This should just be the URLs.  

For example, for JAX-WS services, the Issuer Metadata Address is as follows: http://localhost:8080/jaxws-sts/sts

http://localhost:8080/jaxws-sts/sts 

Token Type 

Specifies the type of SAML token required by the service provider. For example: urn:oasis:names:tc:SAML1.0:assertion.

The options are 1.0, 1.1, or 2.0. 

1.1 

Key Type 

Specifies the type of key preferred by the service provider.  

The choices are public key or symmetric key:

• Symmetric Key cryptography relies on a shared secret and is usually faster than Public Key cryptography

• Public Key cryptography relies on a key that is made public to all and is primarily used for encryption but can be used for verifying signatures.

Applies to Issued Token mechanisms only. 

Symmetric Key 

Key Size 

Specifies the size of the symmetric key requested in number of bits.  

This information is provided as an indication of the desired strength of the security. Valid choices include 128, 192, and 256. The security token is not obligated to use the requested key size, nor is the STS obligated to issue a token with the same key size. That said, the recipient should try to use a key at least as strong as the specified value if possible.  

Applies to Issued Token mechanisms only. 

128 

Algorithm Suite 

Specifies the algorithm suite required to perform cryptographic operations with symmetric or asymmetric key-based security tokens.  

See Algorithm Suite under Table 21 for more information.

Basic 128bit 

Security Header Layout 

Specifies the layout rule to apply when adding items to the security header. Options are Strict, Lax, Lax (Timestamp First), and Lax (Timestamp Last). 

See Security Header Layout under Table 21 for more information.

Strict 

Require Derived Keys for X509 Token 

Specifies that a derived key is required for X509 Token. See Require Derived Key above for more information. 

A derived key is a cryptographic key created from a password or other user data. Derived keys allow applications to create session keys as needed, eliminating the need to store a particular key. The use of the same session key for repeated message exchanges is sometimes considered a risk. To reduce that risk, enable Require Derived Keys for X509 Token.  

Select the checkbox to enable. 

Require Derived Keys for Issued Token 

Specifies that a derived key is required for Issued Token. See Require Derived Keys for X509 Token above for more information. 

Select the checkbox to enable. 

Establish Secure Session (Secure Conversation) 

Secure Session enables establishes a shared security context between the consumer and provider when a multiple-message-exchange sequence is first initiated. Subsequent messages use (possibly derived) session keys that increase the overall security while reducing the security processing overhead for each message.  

For more information see Establish Secure Session under Table 21.

Select the checkbox to enable. 

Require Derived Keys for Secure Session 

Specifies that a derived key is required for Secure Session. See Require Derived Keys for X509 Token above for more information. 

Select the checkbox to enable. 

Require Signature Confirmation 

Specifies that the responder process the signature in the request. Select this option to reduce the risk of attacks when the WSS Version is 1.1 .  

Select the checkbox to enable. 

Encrypt Signature 

Specifies whether the primary signature and signature confirmation elements must be encrypted.  

Select the checkbox to enable. 

Encrypt before Signing 

Specifies that the order of message protection is to encrypt the SOAP content, then sign the entire SOAP body. The encryption key and signing key must be derived from the same source key.  

If not selected, the default behavior is Sign Before Encrypt.  

Check box Selected indicates disabled.