message-security

Specifies message security requirements.

• If the grandparent element is webservice-endpoint, these requirements pertain to request and response messages of the endpoint.

• If the grandparent element is port-info, these requirements pertain to the port of the referenced service.

Superelements

message-security-binding (sun-web.xml, sun-ejb-jar.xml, sun-application-client.xml)

Subelements

The following table describes subelements for the message-security element.

Table A–70 message-security Subelements

Element	Required	Description
message	one or more	Specifies the methods or operations to which message security requirements apply.
request-protection	zero or one	Defines the authentication policy requirements of the application’s request processing.
response-protection	zero or one	Defines the authentication policy requirements of the application’s response processing.

message-security-binding

Specifies a custom authentication provider binding for a parent webservice-endpoint or port-info element in one or both of these ways:

• By binding to a specific provider

• By specifying the message security requirements enforced by the provider

Superelements

webservice-endpoint, port-info (sun-web.xml, sun-ejb-jar.xml, sun-application-client.xml)

Subelements

The following table describes subelements for the message-security-binding element.

Table A–71 message-security-binding Subelements

Element	Required	Description
message-security	zero or more	Specifies message security requirements.

Attributes

The following table describes attributes for the message-security-binding element.

Table A–72 message-security-binding Attributes

Attribute	Default	Description
auth-layer	none	Specifies the message layer at which authentication is performed. The value must be SOAP.
provider-id	none	(optional) Specifies the authentication provider used to satisfy application-specific message security requirements.  If this attribute is not specified, a default provider is used, if it is defined for the message layer.  if no default provider is defined, authentication requirements defined in the message-security-binding are not enforced.