Contents

Title and Copyright Information

Preface

• Audience
• How to Use This Guide
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide

• New and Changed Features for Release 12c (12.1.3)
• Other Significant Changes in This Document for Release 12c (12.1.3)
• New and Changed Features for Release 12c (12.1.2)
• Other Significant Changes in this Book for Release 12c (12.1.2)

Part I Introducing OWSM

1 Overview

• 1.1 Web Services Security and Policy Management

2 Using OWSM with WebLogic Server

• 2.1 Installing OWSM with WebLogic Server
• 2.2 Configuring OWSM with a Domain-Wide Administration Port
• 2.3 Using Cross-Component Wiring for Auto-Discovery of Policy Manager
  • 2.3.1 Verifying Service Table Entries and Components Using Fusion Middleware Control
  • 2.3.2 Verifying Agent Bindings Using Fusion Middleware Control
• 2.4 Modifying the Default User
  • 2.4.1 Configuring an Authentication Provider
  • 2.4.2 Configuring the Credential Store Provider
  • 2.4.3 Configuring the Policy Manager CSF Key for the Domain
  • 2.4.4 Modifying the User's Group or Role

3 Determining Which Predefined Policies to Use

• 3.1 Security Policy Questionnaire
  • 3.1.1 Choosing the Right Authentication Policy
  • 3.1.2 Choosing the Right Confidentiality and Integrity Policy
• 3.2 Summary of Predefined Security Policies
  • 3.2.1 Authentication Only Policies
  • 3.2.2 Message Protection Only Policies
  • 3.2.3 Message Protection and Authentication Policies
  • 3.2.4 Authorization Policies
  • 3.2.5 WS-Trust Policies
  • 3.2.6 MTOM Attachment Policies
  • 3.2.7 Reliable Messaging Policies
  • 3.2.8 No Behavior Policies
• 3.3 Which OWSM Policies Are Supported for Java EE Web Services and Clients?
• 3.4 Which OWSM Policies Are Supported for RESTful Web Services and Clients?
• 3.5 Which OWSM Policies Are Supported for Web Services and Clients That Use SOAP Over JMS Transport
• 3.6 Which OWSM Policies Are Supported for SOA Composite Services and Clients
• 3.7 Which OWSM Policies Require You to Configure SSL?
  • 3.7.1 Which Policies Require You to Configure Two-Way SSL?
• 3.8 Which OWSM Policies Are Supported for Identity Context?
• 3.9 Which OWSM Policies Support WS-SecureConversation?
• 3.10 Which OWSM Policies Are Supported for JCA Adapters?
• 3.11 Which OWSM Policies Are Supported for OES Integration?
• 3.12 Which OWSM Policies Are Supported for PII?
• 3.13 Which OWSM Policies Are Supported for Oracle Service Bus?

Part II Attaching and Managing Policies

4 Attaching Policies

• 4.1 Overview of Policy Attachment
• 4.2 Attaching Policies to Web Services and Clients at Design Time
  • 4.2.1 Attaching Policies to Java EE Web Services and Clients at Design TIme
    • 4.2.1.1 Attaching Policies to Java EE Web Services and Clients Using Annotations
    • 4.2.1.2 Attaching Policies to Java EE Web Service Clients Using Feature Classes
    • 4.2.1.3 Attaching Policies to Java EE Web Services and Clients Using JDeveloper
  • 4.2.2 Attaching Policies to RESTful Web Services and Clients at Design Time
    • 4.2.2.1 Attaching Policies to RESTful Web Services Using Annotations
    • 4.2.2.2 Attaching Policies to RESTful Web Service Clients Using Feature Classes
    • 4.2.2.3 Attaching Policies to RESTful Web Services and Clients Using JDeveloper
  • 4.2.3 Attaching Policies to Oracle Infrastructure Web Services and Clients at Design Time
    • 4.2.3.1 Attaching Policies to Oracle Infrastructure Web Services Using Annotations
    • 4.2.3.2 Attaching Policies to Oracle Infrastructure Web Service Clients Using Feature Classes
    • 4.2.3.3 Attaching Policies to Oracle Infrastructure Web Services Using Oracle JDeveloper
• 4.3 Attaching Policies to Web Services and Clients Using Fusion Middleware Control
  • 4.3.1 Attaching Policies Directly Using Fusion Middleware Control
    • 4.3.1.1 Attaching Policies Directly to a Single Subject Using Fusion Middleware Control
    • 4.3.1.2 Attaching Policies Directly to Web Service Clients Using Fusion Middleware Control
    • 4.3.1.3 Enabling or Disabling Directly Attached Policies Using Fusion Middleware Control
    • 4.3.1.4 Detaching Directly Attached Policies Using Fusion Middleware Control
  • 4.3.2 Attaching Policies Globally Using Fusion Middleware Control
    • 4.3.2.1 Navigating to the WSM Policy Set Summary Page Using Fusion Middleware Control
    • 4.3.2.2 Viewing the Configuration of a Policy Set Using Fusion Middleware Control
    • 4.3.2.3 Creating a Policy Set Using Fusion Middleware Control
    • 4.3.2.4 Cloning a Policy Set Using Fusion Middleware Control
    • 4.3.2.5 Editing a Policy Set Using Fusion Middleware Control
    • 4.3.2.6 Specifying Run-time Constraints in a Policy Set Using Fusion Middleware Control
    • 4.3.2.7 Enabling and Disabling a Policy Set Using Fusion Middleware Control
    • 4.3.2.8 Deleting Policy Sets Using Fusion Middleware Control
  • 4.3.3 Viewing Policies Attached to a Web Service Using Fusion Middleware Control
  • 4.3.4 Validating Policy Attachments
  • 4.3.5 Validating a Policy Set
• 4.4 Attaching Policies to Web Services and Clients Using WLST
  • 4.4.1 Viewing Available Policies Using WLST
  • 4.4.2 Attaching Policies Directly to Java EE Web Services and Clients Using WLST
    • 4.4.2.1 Viewing the Policies That Are Attached to a Java EE Web Service
    • 4.4.2.2 Viewing the Policies That Are Attached to a Java EE Web Service Client
    • 4.4.2.3 Attaching Policies Directly to a Java EE Web Service Using WLST
    • 4.4.2.4 Attaching Policies Directly to Java EE Web Service Clients Using WLST
    • 4.4.2.5 Detaching Directly Attached Policies from Java EE Web Service and Clients Using WLST
    • 4.4.2.6 Enabling and Disabling Web Service Client Policies Using WLST
  • 4.4.3 Attaching Policies Directly to RESTful and Oracle Infrastructure Web Services and Clients Using WLST
    • 4.4.3.1 Identifying and Selecting the Policy Subject Using WLST
    • 4.4.3.2 Attaching Policies Directly Using WLST
    • 4.4.3.3 Enabling and Disabling Directly Attached Policies Using WLST
    • 4.4.3.4 Detaching Directly Attached Policies Using WLST
  • 4.4.4 Attaching Policies Globally Using WLST
    • 4.4.4.1 Viewing a List of Policy Sets
    • 4.4.4.2 Displaying the Configuration of a Policy Set
    • 4.4.4.3 Managing Sessions Using WLST
    • 4.4.4.4 Creating a New Policy Set Using WLST
    • 4.4.4.5 Cloning a Policy Set using WLST
    • 4.4.4.6 Editing a Policy Set
    • 4.4.4.7 Validating a Policy Set
    • 4.4.4.8 Enabling and Disabling a Policy Set
    • 4.4.4.9 Deleting Policy Sets Using WLST
    • 4.4.4.10 Specifying Runtime Constraints in Policy Sets Using WLST
  • 4.4.5 Viewing Policies Attached to a Web Service with WLST
  • 4.4.6 Displaying the Effective Policy Set Using WLST
• 4.5 Attaching Policies to Servlet Applications
  • 4.5.1 Attaching Policies Directly to Servlet Applications
  • 4.5.2 Attaching Policies Globally to Servlet Applications
• 4.6 Specifying Run-time Constraints in Policy Sets
• 4.7 Defining the Type and Scope of Resources for Globally Attached Policies
  • 4.7.1 Defining the Resource Type
  • 4.7.2 Defining the Resource Scope
  • 4.7.3 Determining the Namespace for a Web Service
  • 4.7.4 Examples
• 4.8 Migrating Direct Policy Attachments to Global Policy Attachments
• 4.9 Disabling a Globally Attached Policy
• 4.10 Specifying the Priority of a Policy Attachment
• 4.11 Determining the Secure Status of an Endpoint
• 4.12 How the Effective Set of Policies is Calculated
• 4.13 Determining the Source of Policy Attachments

5 Overriding Policy Configuration Properties

• 5.1 Overview of Policy Configuration Overrides
• 5.2 Scope of Predefined Configuration Properties
• 5.3 Overriding Client Policy Configuration Properties at Design Time
• 5.4 Overriding Policy Configuration Properties Using Fusion Middleware Control
  • 5.4.1 Overriding Configuration Properties at the Domain Level (Defining the Default Value)
  • 5.4.2 Overriding Configuration Properties for Directly Attached Service Policies Using Fusion Middleware Control
  • 5.4.3 Overriding Configuration Properties at the Web Service Client Application Level Using Fusion Middleware Control
  • 5.4.4 Overriding Configuration Properties for Globally Attached Policies Using Fusion Middleware Control
• 5.5 Overriding Policy Configuration Properties Using WLST
  • 5.5.1 Overriding Configuration Properties for Directly Attached Service Policies Using WLST
  • 5.5.2 Overriding Configuration Properties at the Web Service Client Application Using WLST
  • 5.5.3 Overriding Configuration Properties for Globally Attached Policies Using WLST
• 5.6 Configuring User-Defined Properties for Web Service and Client Policies Using Fusion Middleware Control
  • 5.6.1 Scope of User-Defined Configuration Properties
  • 5.6.2 Adding a User-Defined Configuration Property
  • 5.6.3 Editing a User-Defined Configuration Property
  • 5.6.4 Deleting a User-Defined Configuration Property
  • 5.6.5 Overriding the User-Defined Configuration Properties

6 Managing Web Service Policies with Fusion Middleware Control

• 6.1 Overview of Web Services Policy Management
• 6.2 Managing Web Service Policies
  • 6.2.1 Navigating to the WSM Policies Page
  • 6.2.2 Searching for Policies in the WSM Policies Page
    • 6.2.2.1 Using Advanced Search
    • 6.2.2.2 Using the Query by Example Filter
  • 6.2.3 Viewing the Details of a Web Service Policy
  • 6.2.4 Creating and Editing Web Service Policies
    • 6.2.4.1 Creating a New Web Service Policy
    • 6.2.4.2 Cloning a Web Service Policy
    • 6.2.4.3 Creating Custom Policies
    • 6.2.4.4 Editing a Web Service Policy
  • 6.2.5 Using Local Optimization with OWSM Policies (SOA Composites)
    • 6.2.5.1 Viewing the Default Local Optimization Setting in OWSM Policies
    • 6.2.5.2 Controlling When Local Optimization is Used
  • 6.2.6 Generating Client Policies from a WSDL
  • 6.2.7 Adding Assertions to a Policy
  • 6.2.8 Adding an OR Group to a Policy
  • 6.2.9 Importing Web Service Policies
  • 6.2.10 Exporting Web Service Policies
  • 6.2.11 Versioning Web Service Policies
    • 6.2.11.1 Viewing the Version History of a Web Service Policy
    • 6.2.11.2 Changing the Current Version of a Policy
    • 6.2.11.3 Deleting Versions of a Web Service Policy
    • 6.2.11.4 Exporting a Version of a Policy
  • 6.2.12 Deleting a Web Service Policy
• 6.3 Validating Web Service Policies
• 6.4 Managing Policy Assertion Templates
  • 6.4.1 Navigating to the Assertion Templates Page
  • 6.4.2 Searching for an Assertion Template in the Assertion Templates Page
    • 6.4.2.1 Using Advanced Search
    • 6.4.2.2 Using the Query by Example Filter
  • 6.4.3 Viewing the Details of an Assertion Template
  • 6.4.4 Naming Conventions for Assertion Templates
  • 6.4.5 Cloning an Assertion Template
  • 6.4.6 Editing an Assertion Template
  • 6.4.7 Editing the Configuration Properties in an Assertion Template
  • 6.4.8 Exporting an Assertion Template
  • 6.4.9 Importing an Assertion Template
  • 6.4.10 Deleting an Assertion Template
• 6.5 Enabling or Disabling Policies and Assertions
  • 6.5.1 Enabling or Disabling a Policy for all Policy Subjects
  • 6.5.2 Enabling or Disabling Assertions Within a Policy
• 6.6 Analyzing Policy Usage
• 6.7 Advertising Policy Assertions
• 6.8 Advertising WS-Policy and WS-SecurityPolicy Versions

Part III Securing Web Services

7 Configuring Message Protection

• 7.1 Overview of Message Protection Configuration
• 7.2 Configuring Keystores for Message Protection
  • 7.2.1 Using the OPSS Keystore Service for Message Protection
    • 7.2.1.1 Migrating a JKS Keystore Into the KSS Keystore
    • 7.2.1.2 Importing Certificates Into the KSS Keystore
    • 7.2.1.3 Change Values if You Override keystore.sig.csf.key and keystore.enc.csf.key
  • 7.2.2 Using the Java Keystore for Message Protection
    • 7.2.2.1 Generating Private Keys and Creating the Java Keystore
    • 7.2.2.2 Obtaining a Trusted Certificate and Importing it into the Keystore
    • 7.2.2.3 Configuring the OWSM Keystore
  • 7.2.3 Configuring the Credential Store
    • 7.2.3.1 Adding Keys and User Credentials to the Credential Store
• 7.3 Using the Service Identity Certificate Extensions
  • 7.3.1 Ignoring the Service Identity Certificate Extension From the Client
  • 7.3.2 Ignoring Hostname Verification from the Client
• 7.4 Caching the Nonce with Oracle Coherence
  • 7.4.1 Caching the Nonce Where There Are No Managed Coherence Servers
  • 7.4.2 Caching the Nonce for Storage-Disabled WebLogic Servers and Storage-Enabled Managed Coherence Servers
• 7.5 Configuring Partial Encryption with Fusion Middleware Control
  • 7.5.1 Example for Partial Encryption
  • 7.5.2 Securing SwA Attachments

8 Protecting Personally Identifiable Information

• 8.1 Protecting PII Information: Main Steps
  • 8.1.1 Determine What PII Data to Protect
  • 8.1.2 Compose the XPath Expressions to Protect the PII Data
  • 8.1.3 Configure the PII Encryption Key
  • 8.1.4 Attach the pii_security_policy Policy
  • 8.1.5 Attach the pii_security_policy to SOA Composite
  • 8.1.6 Attach the pii_security_policy to JCA Binding
• 8.2 Using WLST to Override the pii_security_policy Attributes
• 8.3 Using the API to Decrypt PII

9 Configuring Transport-Level Security (SSL)

• 9.1 Configuring Keystores for SSL
  • 9.1.1 How to Configure a KSS Keystore on WebLogic Server
    • 9.1.1.1 Configuring the OPSS Keystore Service for Demo Identity and Trust
    • 9.1.1.2 Recreating the OPSS Keystore Service for Demo Identity and Trust
    • 9.1.1.3 Configuring the OPSS Keystore Service for Custom Identity and Trust
  • 9.1.2 How to Configure a JKS Keystore on WebLogic Server
• 9.2 Configuring SSL on WebLogic Server (One-Way)
• 9.3 Configuring SSL on WebLogic Server (Two-Way)
• 9.4 Configuring SSL for a Web Service Client
• 9.5 Configuring Two-Way SSL for a Web Service Client
• 9.6 Configuring SSL on Oracle HTTP Server
  • 9.6.1 One-Way SSL
  • 9.6.2 Two-Way SSL

10 Configuring Authentication

• 10.1 Overview of Authentication Configuration
• 10.2 Configuring an Authentication Provider in WebLogic Server
• 10.3 Configuring Digest Authentication
  • 10.3.1 Prerequisites for Configuring Digest Authentication
  • 10.3.2 Configure the Default Authenticator and Identity Asserter
  • 10.3.3 Attach a Policy and Enable Digest Authentication
• 10.4 Configuring SAML
  • 10.4.1 How the SAML Token is Validated
    • 10.4.1.1 Which Authentication Provider is Used?
  • 10.4.2 How to Configure SAML Web Service Client at Design Time
    • 10.4.2.1 Configure the Username for the SAML Assertion
  • 10.4.3 Including User Attributes in the Assertion
  • 10.4.4 Including User Roles in the Assertion
  • 10.4.5 How to Configure Oracle Platform Security Services (OPSS) for SAML Policies
  • 10.4.6 Adding an Additional SAML Assertion Issuer Name
  • 10.4.7 Configuring SAML Web Service Clients for Identity Switching
    • 10.4.7.1 Set the javax.xml.ws.security.auth.username Property
    • 10.4.7.2 Set the WSIdentityPermission Permission
  • 10.4.8 Defining Trusted Issuers and Trusted Distinguished Names List for SAML Signing Certificates
  • 10.4.9 Using Anonymous Users with SAML Policies
• 10.5 Propagating Identity Context with OWSM
  • 10.5.1 Using SAML Policies to Propagate Identity Context
  • 10.5.2 Configuring Identity Context Propagation: Main Steps
• 10.6 Configuring Kerberos Tokens
  • 10.6.1 Using MIT Kerberos
    • 10.6.1.1 Initializing and Starting the MIT Kerberos KDC
    • 10.6.1.2 Creating Principals
    • 10.6.1.3 Configuring the Web Service Client to Use the Correct KDC
  • 10.6.2 Using Microsoft Active Directory with Key Distribution Center
    • 10.6.2.1 Setting Up the Web Service Client
    • 10.6.2.2 Set Up the Web Service
  • 10.6.3 Setting the Service Principal Name In the Web Service Client
  • 10.6.4 Configuring the Web Service to Use the Correct KDC
  • 10.6.5 Using the Correct Keytab File in Enterprise Manager
    • 10.6.5.1 Extract and Export the Keytab File
    • 10.6.5.2 Modify the krb5 Login Module to use the Keytab File
  • 10.6.6 Authenticating the User Corresponding to the Service Principal
  • 10.6.7 Creating a Ticket Cache for the Web Service Client
  • 10.6.8 Configuring Kerberos Over SSL
  • 10.6.9 Configuring Kerberos With SPNEGO Negotiation
  • 10.6.10 Configuring Credential Delegation
    • 10.6.10.1 Configuring Credential Delegation in Kerberos
    • 10.6.10.2 Configuring Delegation Permission to OWSM
    • 10.6.10.3 Enabling Credential Delegation in the Client Policy and the Service Policy
    • 10.6.10.4 Configuring Credential Delegation for a Service in Active Directory
    • 10.6.10.5 Credential Delegation Example
• 10.7 Configuring WS-Trust
  • 10.7.1 Overview of Web Services WS-Trust
    • 10.7.1.1 How the STS Configuration is Obtained
    • 10.7.1.2 What Token Types Are Exchanged?
  • 10.7.2 Supported STS Servers
  • 10.7.3 Token Lifetime and Token Caching
  • 10.7.4 Setting Up Automatic Policy Configuration for STS
    • 10.7.4.1 Requirements for Automatic Policy Configuration
    • 10.7.4.2 Setting Up Automatic Policy Configuration: Main Steps
    • 10.7.4.3 Manually Configuring the STS Config Policy From the Web Service Client: Main Steps
  • 10.7.5 Configuring Web Services Federation
    • 10.7.5.1 Configuring a Web Service for Web Services Federation
    • 10.7.5.2 Configuring a Web Client for Web Services Federation
    • 10.7.5.3 Configuring an STS for Web Services Federation
  • 10.7.6 SAML Holder of Key and SAML Bearer as Issued Tokens
    • 10.7.6.1 How the Proof Key is Determined (SAML HOK Only)
  • 10.7.7 SAML Sender Vouches as Issued Tokens
    • 10.7.7.1 Configuring SAML Sender Vouches with WS-Trust
  • 10.7.8 On Behalf Of Use Cases
  • 10.7.9 Programmatically Overriding Policy Configuration for WS-Trust Client Policies

11 Configuring Authorization

• 11.1 Overview of Authorization
• 11.2 Determining Which Resources to Protect
• 11.3 Determining Authorization Permissions
• 11.4 Determining the OPSS Resource Name
• 11.5 Configuring Fine-Grained Authorization Using Oracle Entitlements Server
  • 11.5.1 Prerequisites for Configuring OES Integration
  • 11.5.2 Determine Attributes for Obligations
  • 11.5.3 Configure the OES Policies For Fine-Grained Authorization
    • 11.5.3.1 Configure the OES Resource
    • 11.5.3.2 Create Authorization Policy to Return Obligations
    • 11.5.3.3 Create the Actual OES Authorization Policy
  • 11.5.4 Configure the OES Policies For Coarse-Grained Authorization
    • 11.5.4.1 Configure the OES Resource
    • 11.5.4.2 Create the Actual OES Authorization Policy
  • 11.5.5 Configure the OES Policy For Masking
    • 11.5.5.1 Configure the OES Resource
    • 11.5.5.2 Create Masking Policy to Return Obligations
    • 11.5.5.3 Create the Actual OES Masking Policy
  • 11.5.6 Attach the OWSM OES Policy
    • 11.5.6.1 Configuration Properties and Overrides
• 11.6 Configuring the Oracle HTTP Server to Specify the Request Origin

12 Configuring Secure Conversation

• 12.1 Configuring Secure Conversation
  • 12.1.1 Configuring Secure Conversation Using Fusion Middleware Control
  • 12.1.2 Configuring Secure Conversation Using WLST
• 12.2 Attaching a Secure Conversation Policy at Design Time
• 12.3 Configuring Persistence
• 12.4 Managing Secure Conversation Sessions
  • 12.4.1 WLST Commands to Manage Secure Conversation Sessions

13 Integrating Hardware with Oracle Web Services Manager

• 13.1 Using Hardware Security Modules With OWSM
  • 13.1.1 Using SafeNet Luna SA With OWSM for Key Storage
  • 13.1.2 About Installing and Configuring the Luna SA HSM Client
  • 13.1.3 Configuring the JRE Used By OWSM
  • 13.1.4 Logging On to Luna SA
  • 13.1.5 Copying Keys and Certificates to Luna SA
  • 13.1.6 Configuring OWSM to Use Luna SA
• 13.2 Configuring OWSM for Oracle SPARC T5 and SPARC T4 Cryptographic Acceleration
  • 13.2.1 Terms You Need to Understand
  • 13.2.2 Overview of Oracle SPARC T5 and SPARC T4 Hardware Assisted Cryptographic Acceleration
  • 13.2.3 Configuring Transport-Level Security for Cryptographic Acceleration
  • 13.2.4 Configuring Message-level Security for Cryptographic Acceleration
  • 13.2.5 Additional Reading

Part IV Managing and Troubleshooting OWSM

14 Managing OWSM Domain Configuration

• 14.1 Understanding OWSM Domain Configuration
• 14.2 Navigating to the WSM Domain Configuration Page
• 14.3 Viewing General OWSM Domain Configuration Using Fusion Middleware Control
• 14.4 Configuring Domain-Level Authentication Using Fusion Middleware Control
  • 14.4.1 Configuring SAML Trusted Issuers and DN Lists Using Fusion Middleware Control
  • 14.4.2 Configuring Token Attribute Rules for Trusted Issuers Using Fusion Middleware Control
  • 14.4.3 Configuring the Lifetime for the Issued Token Using Fusion Middleware Control
  • 14.4.4 Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control
  • 14.4.5 Configuring the Kerberos Login Module
  • 14.4.6 Configuring Subject Properties Using Fusion Middleware Control
  • 14.4.7 Configuring the X509 Login Module Using Fusion Middleware Control
  • 14.4.8 Creating Custom Login Modules
• 14.5 Configuring Domain-Level Message Security Using Fusion Middleware Control
  • 14.5.1 Configuring the OWSM Keystore Using Fusion Middleware Control
    • 14.5.1.1 Configuring OWSM to Use the KSS Keystore
    • 14.5.1.2 Configuring OWSM to Use the JKS Keystore
    • 14.5.1.3 Configuring OWSM to Use HSM Keystores
    • 14.5.1.4 Configuring OWSM to Use the PKCS11 Keystore
  • 14.5.2 Configuring Security Policy Enforcement Using Fusion Middleware Control
  • 14.5.3 Configuring Identity Extension Properties Using Fusion Middleware Control
  • 14.5.4 Configuring Secure Conversation for the Domain Using Fusion Middleware Control
• 14.6 Configuring OWSM Policy Access Using Fusion Middleware Control
  • 14.6.1 Configuring the Policy Manager Connection Using Fusion Middleware Control
  • 14.6.2 Configuring SSL for the Policy Manager Connection Using Fusion Middleware Control
  • 14.6.3 Configuring High Availability and Cache Management Using Fusion Middleware Control
• 14.7 Managing OWSM Domain Configuration Using WLST
  • 14.7.1 Viewing OWSM Domain Configuration Using WLST
  • 14.7.2 Using the setWSMConfiguration Command to Set OWSM Domain Configuration
• 14.8 Configuring Domain-Level Authentication Using WLST
  • 14.8.1 Configuring SAML Trusted Issuers, DN Lists, and Token Attribute Rules Using WLST
  • 14.8.2 Deleting a Token Issuer Trust Document Using WLST
  • 14.8.3 Configuring the Lifetime for the Issued Token Using WLST
  • 14.8.4 Configuring Subject Properties Using WLST
  • 14.8.5 Configuring the SAML and SAML2 Login Modules Using WLST
  • 14.8.6 Configuring the Kerberos Login Module Using WLST
  • 14.8.7 Configuring the X509 Login Module Using WLST
  • 14.8.8 Configuring Custom Login Modules Using WLST
• 14.9 Configuring Domain-Level Message Security Using WLST
  • 14.9.1 Configuring the OWSM Keystore Using WLST
  • 14.9.2 Configuring Security Policy Enforcement Using WLST
  • 14.9.3 Configuring Identity Extension Properties Using WLST
  • 14.9.4 Configuring Secure Conversation for the Domain Using WLST
• 14.10 Configuring Policy Access Using WLST
  • 14.10.1 Configuring the Policy Manager Connection Using WLST
  • 14.10.2 Configuring High Availability and Cache Management Using WLST

15 Managing the OWSM Repository

• 15.1 About the OWSM Repository
• 15.2 Registering an OWSM Repository
• 15.3 Understanding the Different Mechanisms for Importing and Exporting Policies
• 15.4 Importing and Exporting Documents in the Repository
  • 15.4.1 Exporting Documents from the Repository
  • 15.4.2 Exporting Application Metadata from the Repository
  • 15.4.3 Importing Documents into the Repository
• 15.5 Exporting Policies from the OWSM Repository for Use in JDeveloper
• 15.6 Patching Policies in the Repository
• 15.7 Backing Up and Restoring the OWSM Repository
• 15.8 Upgrading the OWSM Repository
• 15.9 Rebuilding the OWSM Repository

16 Diagnosing Problems with OWSM

• 16.1 Diagnosing Problems with OWSM Policy Manager
• 16.2 Diagnosing Common Problems with OWSM
  • 16.2.1 Unable to Connect to the Policy Manager
  • 16.2.2 Key or Credential Store Error After an Application Invokes Web Service
  • 16.2.3 Trust Certificate Error After Application Invokes Web Service
  • 16.2.4 SAML Assertion Error Appears During Identity Propagation
  • 16.2.5 Policy Access Error After an Application Invokes Web Service
  • 16.2.6 Unable to Access User in Credential Store
  • 16.2.7 Authorization Error After an Application Invokes Web Service
  • 16.2.8 Timestamp Error After an Application Invokes Web Service
  • 16.2.9 Multiple Authentication Security Policy Error After an Application Invokes a Web Service
• 16.3 Diagnosing Policy Attachment Issues Using WLST
• 16.4 Diagnosing Problems With a Domain Configuration using WLST
• 16.5 Diagnosing Common OWSM Exceptions for WS-Trust Use Cases

Part V Predefined Policies and Assertions

17 Predefined Policies

• 17.1 Addressing Policies
  • 17.1.1 oracle/wsaddr_policy
  • 17.1.2 oracle/no_addressing_policy
• 17.2 Atomic Transaction Policies
  • 17.2.1 oracle/atomic_transaction_policy
  • 17.2.2 oracle/no_atomic_transaction_policy
• 17.3 Configuration Policies
  • 17.3.1 oracle/async_web_service_policy
  • 17.3.2 oracle/cache_binary_content_policy
  • 17.3.3 oracle/fast_infoset_client_policy
  • 17.3.4 oracle/fast_infoset_service_policy
  • 17.3.5 oracle/max_request_size_policy
  • 17.3.6 oracle/mex_request_processing_service_policy
  • 17.3.7 oracle/mtom_encode_fault_service_policy
  • 17.3.8 oracle/no_async_web_service_policy
  • 17.3.9 oracle/no_cache_binary_content_policy
  • 17.3.10 oracle/no_fast_infoset_client_policy
  • 17.3.11 oracle/no_fast_infoset_service_policy
  • 17.3.12 oracle/no_max_request_size_policy
  • 17.3.13 oracle/no_mex_request_processing_service_policy
  • 17.3.14 oracle/no_mtom_encode_fault_service_policy
  • 17.3.15 oracle/no_persistence_policy
  • 17.3.16 oracle/no_pox_http_binding_service_policy
  • 17.3.17 oracle/no_request_processing_service_policy
  • 17.3.18 oracle/no_schema_validation_policy
  • 17.3.19 oracle/no_soap_request_processing_service_policy
  • 17.3.20 oracle/no_test_page_processing_service_policy
  • 17.3.21 oracle/no_ws_logging_level_policy
  • 17.3.22 oracle/no_wsdl_request_processing_service_policy
  • 17.3.23 oracle/persistence_policy
  • 17.3.24 oracle/pox_http_binding_service_policy
  • 17.3.25 oracle/request_processing_service_policy
  • 17.3.26 oracle/schema_validation_policy
  • 17.3.27 oracle/soap_request_processing_service_policy
  • 17.3.28 oracle/test_page_processing_policy
  • 17.3.29 oracle/ws_logging_level_policy
  • 17.3.30 oracle/wsdl_request_processing_service_policy
• 17.4 Management Policies
  • 17.4.1 oracle/log_policy
• 17.5 MTOM Policies
  • 17.5.1 oracle/no_mtom_policy
  • 17.5.2 oracle/wsmtom_policy
• 17.6 Reliable Messaging Policies
  • 17.6.1 oracle/no_reliable_messaging_policy
  • 17.6.2 oracle/no_wsrm_policy
  • 17.6.3 oracle/reliable_messaging_policy
  • 17.6.4 oracle/wsrm10_policy
  • 17.6.5 oracle/wsrm11_policy
• 17.7 Security Policies—Authentication Only
  • 17.7.1 oracle/http_basic_auth_over_ssl_client_policy
  • 17.7.2 oracle/http_basic_auth_over_ssl_service_policy
  • 17.7.3 oracle/http_oam_token_service_policy
  • 17.7.4 oracle/http_saml20_token_bearer_client_policy
  • 17.7.5 oracle/http_saml20_token_bearer_service_policy
  • 17.7.6 oracle/http_saml20_token_bearer_over_ssl_client_policy
  • 17.7.7 oracle/http_saml20_bearer_token_over_ssl_service_policy
  • 17.7.8 oracle/multi_token_rest_service_policy
  • 17.7.9 oracle/multi_token_over_ssl_rest_service_policy
  • 17.7.10 oracle/no_authentication_client_policy
  • 17.7.11 oracle/no_authentication_service_policy
  • 17.7.12 oracle/wss_http_token_client_policy
  • 17.7.13 oracle/wss_http_token_service_policy
  • 17.7.14 oracle/wss_username_token_client_policy
  • 17.7.15 oracle/wss_username_token_service_policy
  • 17.7.16 oracle/wss10_saml_token_client_policy
  • 17.7.17 oracle/wss10_saml_token_service_policy
  • 17.7.18 oracle/wss10_saml20_token_client_policy
  • 17.7.19 oracle/wss10_saml20_token_service_policy
  • 17.7.20 oracle/wss11_kerberos_token_client_policy
  • 17.7.21 oracle/wss11_kerberos_token_service_policy
• 17.8 Security Policies—Authorization Only
  • 17.8.1 oracle/binding_authorization_denyall_policy
  • 17.8.2 oracle/binding_authorization_permitall_policy
  • 17.8.3 oracle/binding_permission_authorization_policy
  • 17.8.4 oracle/component_authorization_denyall_policy
  • 17.8.5 oracle/component_authorization_permitall_policy
  • 17.8.6 oracle/component_permission_authorization_policy
  • 17.8.7 oracle/no_authorization_component_policy
  • 17.8.8 oracle/no_authorization_service_policy
  • 17.8.9 oracle/whitelist_authorization_policy
• 17.9 Security Policies—Message Protection Only
  • 17.9.1 oracle/no_messageprotection_client_policy
  • 17.9.2 oracle/no_messageprotection_service_policy
  • 17.9.3 oracle/wss10_message_protection_client_policy
  • 17.9.4 oracle/wss10_message_protection_service_policy
  • 17.9.5 oracle/wss11_message_protection_client_policy
  • 17.9.6 oracle/wss11_message_protection_service_policy
• 17.10 Security Policies—Messages Protection and Authentication
  • 17.10.1 oracle/pii_security_policy
  • 17.10.2 oracle/sts_trust_config_client_policy
  • 17.10.3 oracle/sts_trust_config_service_policy
  • 17.10.4 oracle/wss_saml_bearer_or_username_token_service_policy
  • 17.10.5 oracle/wss_saml_or_username_token_service_policy
  • 17.10.6 oracle/wss_saml_or_username_token_over_ssl_service_policy
  • 17.10.7 oracle/wss_saml_token_bearer_client_policy
  • 17.10.8 oracle/wss_saml_token_bearer_over_ssl_client_policy
  • 17.10.9 oracle/wss_saml_token_bearer_over_ssl_service_policy
  • 17.10.10 oracle/wss_http_token_over_ssl_client_policy
  • 17.10.11 oracle/wss_http_token_over_ssl_service_policy
  • 17.10.12 oracle/wss_saml_token_over_ssl_client_policy
  • 17.10.13 oracle/wss_saml_token_over_ssl_service_policy
  • 17.10.14 oracle/wss_saml20_token_bearer_over_ssl_client_policy
  • 17.10.15 oracle/wss_saml20_token_bearer_over_ssl_service_policy
  • 17.10.16 oracle/wss_saml20_token_over_ssl_client_policy
  • 17.10.17 oracle/wss_saml20_token_over_ssl_service_policy
  • 17.10.18 oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_policy
  • 17.10.19 oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_policy
  • 17.10.20 oracle/wss_username_token_over_ssl_client_policy
  • 17.10.21 oracle/wss_username_token_over_ssl_service_policy
  • 17.10.22 oracle/wss_username_token_over_ssl_wssc_client_policy
  • 17.10.23 oracle/wss_username_token_over_ssl_wssc_service_policy
  • 17.10.24 oracle/wss10_saml_hok_token_with_message_protection_client_policy
  • 17.10.25 oracle/wss10_saml_hok_token_with_message_protection_service_policy
  • 17.10.26 oracle/wss10_saml_token_with_message_integrity_client_policy
  • 17.10.27 oracle/wss10_saml_token_with_message_integrity_service_policy
  • 17.10.28 oracle/wss10_saml_token_with_message_protection_client_policy
  • 17.10.29 oracle/wss10_saml_token_with_message_protection_service_policy
  • 17.10.30 oracle/wss10_saml_token_with_message_protection_ski_basic256_client_policy
  • 17.10.31 oracle/wss10_saml_token_with_message_protection_ski_basic256_service_policy
  • 17.10.32 oracle/wss10_saml20_token_with_message_protection_client_policy
  • 17.10.33 oracle/wss10_saml20_token_with_message_protection_service_policy
  • 17.10.34 oracle/wss10_username_id_propagation_with_msg_protection_client_policy
  • 17.10.35 oracle/wss10_username_id_propagation_with_msg_protection_service_policy
  • 17.10.36 oracle/wss10_username_token_with_message_protection_client_policy
  • 17.10.37 oracle/wss10_username_token_with_message_protection_service_policy
  • 17.10.38 oracle/wss10_username_token_with_message_protection_ski_basic256_client_policy
  • 17.10.39 oracle/wss10_username_token_with_message_protection_ski_basic256_service_policy
  • 17.10.40 oracle/wss10_x509_token_with_message_protection_client_policy
  • 17.10.41 oracle/wss10_x509_token_with_message_protection_service_policy
  • 17.10.42 oracle/wss11_kerberos_token_with_message_protection_client_policy
  • 17.10.43 oracle/wss11_kerberos_token_with_message_protection_service_policy
  • 17.10.44 oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy
  • 17.10.45 oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy
  • 17.10.46 oracle/wss11_saml_or_username_token_with_message_protection_service_policy
  • 17.10.47 oracle/wss11_saml_token_identity_switch_with_message_protection_client_policy
  • 17.10.48 oracle/wss11_saml_token_with_message_protection_client_policy
  • 17.10.49 oracle/wss11_saml_token_with_message_protection_service_policy
  • 17.10.50 oracle/wss11_saml_token_with_message_protection_wssc_client_policy
  • 17.10.51 oracle/wss11_saml_token_with_message_protection_wssc_service_policy
  • 17.10.52 oracle/wss11_saml_token_with_message_protection_wssc_reauthn_client_policy
  • 17.10.53 oracle/wss11_saml_token_with_message_protection_wssc_reauthn_service_policy
  • 17.10.54 oracle/wss11_saml20_token_with_message_protection_client_policy
  • 17.10.55 oracle/wss11_saml20_token_with_message_protection_service_policy
  • 17.10.56 oracle/wss11_sts_issued_saml_hok_with_message_protection_client_policy
  • 17.10.57 oracle/wss11_sts_issued_saml_hok_with_message_protection_service_policy
  • 17.10.58 oracle/wss11_sts_issued_saml_hok_with_message_protection_client_policy
  • 17.10.59 oracle/wss11_sts_issued_saml_hok_with_message_protection_service_policy
  • 17.10.60 oracle/wss11_sts_issued_saml_with_message_protection_client_policy
  • 17.10.61 oracle/wss11_username_token_with_message_protection_client_policy
  • 17.10.62 oracle/wss11_username_token_with_message_protection_service_policy
  • 17.10.63 oracle/wss11_username_token_with_message_protection_wssc_client_policy
  • 17.10.64 oracle/wss11_username_token_with_message_protection_wssc_service_policy
  • 17.10.65 oracle/wss11_x509_token_with_message_protection_client_policy
  • 17.10.66 oracle/wss11_x509_token_with_message_protection_service_policy
  • 17.10.67 oracle/wss11_x509_token_with_message_protection_wssc_client_policy
  • 17.10.68 oracle/wss11_x509_token_with_message_protection_wssc_service_policy
• 17.11 Security Policies—Oracle Entitlements Server
  • 17.11.1 oracle/binding_oes_authorization_policy
  • 17.11.2 oracle/binding_oes_masking_policy
  • 17.11.3 oracle/component_oes_authorization_policy
• 17.12 SOAP Over JMS Transport Policies
  • 17.12.1 oracle/jms_transport_client_policy
  • 17.12.2 oracle/jms_transport_service_policy
  • 17.12.3 oracle/no_jms_transport_client_policy
  • 17.12.4 oracle/no_jms_transport_service_policy

18 Predefined Assertion Templates

• 18.1 Security Assertion Templates
  • 18.1.1 Authentication Only Assertion Templates
    • 18.1.1.1 oracle/http_oam_token_service_template
    • 18.1.1.2 oracle/http_saml20_token_bearer_client_template
    • 18.1.1.3 oracle/http_saml20_token_bearer_service_template
    • 18.1.1.4 oracle/http_spnego_token_client_template
    • 18.1.1.5 oracle/http_spnego_token_service_template
    • 18.1.1.6 oracle/wss_http_token_client_template
    • 18.1.1.7 oracle/wss_http_token_service_template
    • 18.1.1.8 oracle/wss_username_token_client_template
    • 18.1.1.9 oracle/wss_username_token_service_template
    • 18.1.1.10 oracle/wss10_saml_token_client_template
    • 18.1.1.11 oracle/wss10_saml_token_service_template
    • 18.1.1.12 oracle/wss10_saml20_token_client_template
    • 18.1.1.13 oracle/wss10_saml20_token_service_template
    • 18.1.1.14 oracle/wss11_kerberos_token_client_template
    • 18.1.1.15 oracle/wss11_kerberos_token_service_template
  • 18.1.2 Message-Protection Only Assertion Templates
    • 18.1.2.1 oracle/wss10_message_protection_client_template
    • 18.1.2.2 oracle/wss10_message_protection_service_template
    • 18.1.2.3 oracle/wss11_message_protection_client_template
    • 18.1.2.4 oracle/wss11_message_protection_service_template
  • 18.1.3 Message Protection and Authentication Assertion Templates
    • 18.1.3.1 oracle/wss_http_token_over_ssl_client_template
    • 18.1.3.2 oracle/wss_http_token_over_ssl_service_template
    • 18.1.3.3 oracle/wss_saml_token_bearer_client_template
    • 18.1.3.4 oracle/wss_saml_token_bearer_service_template
    • 18.1.3.5 oracle/wss_saml_token_bearer_over_ssl_client_template
    • 18.1.3.6 oracle/wss_saml_token_bearer_over_ssl_service_template
    • 18.1.3.7 oracle/wss_saml20_token_bearer_over_ssl_client_template
    • 18.1.3.8 oracle/wss_saml20_token_bearer_over_ssl_service_template
    • 18.1.3.9 oracle/wss_saml_token_over_ssl_client_template
    • 18.1.3.10 oracle/wss_saml_token_over_ssl_service_template
    • 18.1.3.11 oracle/wss_saml20_token_over_ssl_client_template
    • 18.1.3.12 oracle/wss_saml20_token_over_ssl_service_template
    • 18.1.3.13 oracle/wss_username_token_over_ssl_client_template
    • 18.1.3.14 oracle/wss_username_token_over_ssl_service_template
    • 18.1.3.15 oracle/wss10_saml_hok_token_with_message_protection_client_template
    • 18.1.3.16 oracle/wss10_saml_hok_token_with_message_protection_service_template
    • 18.1.3.17 oracle/wss10_saml_token_with_message_protection_client_template
    • 18.1.3.18 oracle/wss10_saml_token_with_message_protection_service_template
    • 18.1.3.19 oracle/wss10_saml20_token_with_message_protection_client_template
    • 18.1.3.20 oracle/wss10_saml20_token_with_message_protection_service_template
    • 18.1.3.21 oracle/wss10_username_token_with_message_protection_client_template
    • 18.1.3.22 oracle/wss10_username_token_with_message_protection_service_template
    • 18.1.3.23 oracle/wss10_x509_token_with_message_protection_client_template
    • 18.1.3.24 oracle/wss10_x509_token_with_message_protection_service_template
    • 18.1.3.25 oracle/wss11_kerberos_token_over_ssl_client_template
    • 18.1.3.26 oracle/wss11_kerberos_token_over_ssl_service_template
    • 18.1.3.27 oracle/wss11_kerberos_token_with_message_protection_client_template
    • 18.1.3.28 oracle/wss11_kerberos_token_with_message_protection_service_template
    • 18.1.3.29 oracle/wss11_saml_token_with_message_protection_client_template
    • 18.1.3.30 oracle/wss11_saml_token_with_message_protection_service_template
    • 18.1.3.31 oracle/wss11_saml20_token_with_message_protection_client_template
    • 18.1.3.32 oracle/wss11_saml20_token_with_message_protection_service_template
    • 18.1.3.33 oracle/wss11_username_token_with_message_protection_client_template
    • 18.1.3.34 oracle/wss11_username_token_with_message_protection_service_template
    • 18.1.3.35 oracle/wss11_x509_token_with_message_protection_client_template
    • 18.1.3.36 oracle/wss11_x509_token_with_message_protection_service_template
  • 18.1.4 Oracle Entitlements Server (OES) Integration Templates
    • 18.1.4.1 oracle/binding_oes_authorization_template
    • 18.1.4.2 oracle/binding_oes_masking_template
    • 18.1.4.3 oracle/component_oes_authorization_template
  • 18.1.5 PII Assertion Templates
    • 18.1.5.1 oracle/pii_security_template
  • 18.1.6 WS-Trust Assertion Templates
    • 18.1.6.1 oracle/sts_trust_config_client_template
    • 18.1.6.2 oracle/sts_trust_config_service_template
    • 18.1.6.3 oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template
    • 18.1.6.4 oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template
    • 18.1.6.5 oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template
    • 18.1.6.6 oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template
    • 18.1.6.7 oracle/wss11_sts_issued_saml_with_message_protection_client_template
  • 18.1.7 Authorization Assertion Templates
    • 18.1.7.1 oracle/binding_authorization_template
    • 18.1.7.2 oracle/binding_permission_authorization_template
    • 18.1.7.3 oracle/component_authorization_template
    • 18.1.7.4 oracle/component_permission_authorization_template
  • 18.1.8 Supported Algorithm Suites
  • 18.1.9 Message Signing and Encryption Settings for Request, Response, and Fault Messages
• 18.2 Management Assertion Templates
  • 18.2.1 oracle/security_log_template

Part VI Reference

A Security and Policy Annotation Reference

• A.1 @Addressing
• A.2 @AtomicTransaction
• A.3 @CacheBinaryContent
• A.4 @CallbackManagementPolicy
• A.5 @CallbackMtomPolicy
• A.6 @CallbackPolicySet
• A.7 @CallbackSecurityPolicy
• A.8 @FastInfosetCallbackClient
• A.9 @FastInfosetService
• A.10 @JMSTransportClient
• A.11 @JMSTransportService
• A.12 @ManagementPolicy
• A.13 @MaxRequestSize
• A.14 @MEXRequestProcessingService
• A.15 @MTOM
• A.16 @MTOMEncodeFaultService
• A.17 @MtomPolicy
• A.18 @Persistence
• A.19 @PolicyReference
• A.20 @PolicySet
• A.21 @POXHttpBindingService
• A.22 @Property
• A.23 @ReliabilityPolicy
• A.24 @ReliableMessaging
• A.25 @RequestProcessingService
• A.26 @SchemaValidation
• A.27 @SecurityPolicies (Oracle Infrastructure Web Services)
• A.28 @SecurityPolicies (Java EE Web Services)
• A.29 @SecurityPolicy (Oracle Infrastructure Web Services)
• A.30 @SecurityPolicy (Java EE Web Services)
• A.31 @SOAPRequestProcessingService
• A.32 @TestPageProcessingService
• A.33 @WSDLRequestProcessingService
• A.34 @WSLoggingLevel

B Predefined Assertion Templates Reference

• B.1 Assertion Template Settings
  • B.1.1 Action Match
  • B.1.2 Algorithm Suite
  • B.1.3 Authentication Header—Header Name
  • B.1.4 Authentication Header—Mechanism
  • B.1.5 Body Elements
  • B.1.6 Bootstrap Message Security
  • B.1.7 Client Entropy
  • B.1.8 Client Policy URI
  • B.1.9 Confirm Signature
  • B.1.10 Confirmation Type
  • B.1.11 Constraint Match
  • B.1.12 Creation Time Required
  • B.1.13 Derived Keys
  • B.1.14 Enabled
  • B.1.15 Encrypt Signature
  • B.1.16 Encryption Key Reference Mechanism
  • B.1.17 Fault
  • B.1.18 Fault Message Settings
  • B.1.19 Header Elements
  • B.1.20 Include Entire Body
  • B.1.21 Include MIME Headers
  • B.1.22 Include SwA Attachment
  • B.1.23 Include Timestamp
  • B.1.24 Is Encrypted
  • B.1.25 Is Signed
  • B.1.26 Kerberos Token Type
  • B.1.27 Key Type
  • B.1.28 Keystore Recipient Alias
  • B.1.29 Mutual Authentication Required
  • B.1.30 Name Identifier Format
  • B.1.31 Nonce Required
  • B.1.32 Password Type
  • B.1.33 Permissions
  • B.1.34 Permission Class
  • B.1.35 Port Endpoint
  • B.1.36 Port URI
  • B.1.37 Re-authenticate
  • B.1.38 Recipient Encryption Key Reference Mechanism
  • B.1.39 Recipient Sign Key Reference Mechanism
  • B.1.40 Request
  • B.1.41 Request Message Settings
  • B.1.42 Request XPaths
  • B.1.43 Request Namespaces
  • B.1.44 Require Applies To
  • B.1.45 Require Client Entropy
  • B.1.46 Require External Reference
  • B.1.47 Require Internal Reference
  • B.1.48 Require Server Entropy
  • B.1.49 Resource Match
  • B.1.50 Response
  • B.1.51 Response Message Settings
  • B.1.52 Response Namespaces
  • B.1.53 Response XPaths
  • B.1.54 Roles
  • B.1.55 Server Entropy
  • B.1.56 Sign Key Reference Mechanism
  • B.1.57 Sign Then Encrypt
  • B.1.58 Token Type
  • B.1.59 Transport Layer Security
  • B.1.60 Transport Layer Security—Include Timestamp
  • B.1.61 Transport Layer Security—Mutual Authentication Required
  • B.1.62 Version
  • B.1.63 Trust Version
  • B.1.64 Use Derived Keys
  • B.1.65 Use PKI Path
  • B.1.66 WSDL Exist
  • B.1.67 WSDL
• B.2 Assertion Template Configuration Properties
  • B.2.1 algorithm
  • B.2.2 application.name
  • B.2.3 attesting.mapping.attribute
  • B.2.4 caller.principal.name
  • B.2.5 credential.delegation
  • B.2.6 csf-key
  • B.2.7 encryption-algorithm
  • B.2.8 execute.action
  • B.2.9 ignore.timestamp.in.response
  • B.2.10 issued.token.caching
  • B.2.11 issued.token.lifetime
  • B.2.12 iteration
  • B.2.13 keysize
  • B.2.14 keytab.location
  • B.2.15 keystore.enc.csf.key
  • B.2.16 keystore.recipient.alias
  • B.2.17 keystore.sig.csf.key
  • B.2.18 lookup.action
  • B.2.19 on.behalf.of
  • B.2.20 propagate.identity.context
  • B.2.21 realm
  • B.2.22 reference.priority
  • B.2.23 resource.mapping.model
  • B.2.24 resource.name
  • B.2.25 resource.type
  • B.2.26 rm.encrypt.body
  • B.2.27 role
  • B.2.28 salt
  • B.2.29 saml.assertion.filename
  • B.2.30 saml.audience.uri
  • B.2.31 saml.envelope.signature.required
  • B.2.32 saml.issuer.name
  • B.2.33 saml.trusted.issuers
  • B.2.34 sc.token.lifetime
  • B.2.35 service.principal.name
  • B.2.36 subject.precedence
  • B.2.37 sts.auth.caller.principal.name
  • B.2.38 sts.auth.keytab.location
  • B.2.39 sts.auth.on.behalf.of.csf.key
  • B.2.40 sts.auth.on.behalf.of.username.only
  • B.2.41 sts.auth.service.principal.name
  • B.2.42 sts.auth.user.csf.key
  • B.2.43 sts.auth.x509.csf.key
  • B.2.44 sts.in.order
  • B.2.45 sts.keystore.recipient.alias
  • B.2.46 use.single.step
  • B.2.47 user.attributes
  • B.2.48 user.roles.include
  • B.2.49 user.tenant.name

C Schema Reference for Predefined Assertions

• C.1 Graphical Representation
• C.2 Element Descriptions
  • C.2.1 wsp:Policy
    • C.2.1.1 Attributes
    • C.2.1.2 Example
  • C.2.2 wsp:ExactlyOne
    • C.2.2.1 Attributes
    • C.2.2.2 Example
  • C.2.3 orasp:Assertion
    • C.2.3.1 Attributes
    • C.2.3.2 Example
  • C.2.4 orawsp:bindings
    • C.2.4.1 Example
  • C.2.5 orawsp:Config
    • C.2.5.1 Attributes
    • C.2.5.2 Example
  • C.2.6 orawsp:PropertySet
    • C.2.6.1 Attributes
    • C.2.6.2 Example
  • C.2.7 orawsp:Property
    • C.2.7.1 Attributes
    • C.2.7.2 Example
  • C.2.8 orawsp:Description
    • C.2.8.1 Example
  • C.2.9 orawsp:Value
    • C.2.9.1 Example
  • C.2.10 orawsp:guard
    • C.2.10.1 Examples
  • C.2.11 orawsp:resource-match
    • C.2.11.1 Examples
  • C.2.12 orawsp:action-match
    • C.2.12.1 Examples
  • C.2.13 orawsp:constraint-match
    • C.2.13.1 Example
  • C.2.14 oralgp:Logging
    • C.2.14.1 Example
  • C.2.15 orasp:binding-authorization
    • C.2.15.1 Example
  • C.2.16 orasp:binding-permission-authorization
    • C.2.16.1 Example
  • C.2.17 orasp:coreid-security
    • C.2.17.1 Example
  • C.2.18 orasp:http-security
    • C.2.18.1 Example
  • C.2.19 orasp:kerberos-security
    • C.2.19.1 Example
  • C.2.20 orasp:sca-component-authorization
    • C.2.20.1 Example
  • C.2.21 orasp:sca-component-permission-authorization
    • C.2.21.1 Example
  • C.2.22 orasp:sts-trust-config
    • C.2.22.1 Attributes
    • C.2.22.2 Example
  • C.2.23 orasp:wss10-anonymous-with-certificates
    • C.2.23.1 Example
  • C.2.24 orasp:wss10-mutual-auth-with-certificates
    • C.2.24.1 Example
  • C.2.25 orasp:wss10-saml-hok-with-certificates
    • C.2.25.1 Example
  • C.2.26 orasp:wss10-saml-token
    • C.2.26.1 Example
  • C.2.27 orasp:wss10-saml-with-certificates
    • C.2.27.1 Example
  • C.2.28 orasp:wss10-username-with-certificates
    • C.2.28.1 Example
  • C.2.29 orasp:wss11-anonymous-with-certificates
    • C.2.29.1 Example
  • C.2.30 orasp:wss11-mutual-auth-with-certificates
    • C.2.30.1 Example
  • C.2.31 orasp:wss11-saml-with-certificates
    • C.2.31.1 Example
  • C.2.32 orasp:wss11-sts-issued-token-with-certificates
    • C.2.32.1 Attributes
    • C.2.32.2 Example
  • C.2.33 orasp:wss11-username-with-certificates
    • C.2.33.1 Example
  • C.2.34 orasp:wss-saml-token-bearer-over-ssl
    • C.2.34.1 Example
  • C.2.35 orasp:wss-saml-token-over-ssl
    • C.2.35.1 Example
  • C.2.36 orasp:wss-sts-issued-token-over-ssl
    • C.2.36.1 Attributes
    • C.2.36.2 Example
  • C.2.37 orasp:wss-username-token
    • C.2.37.1 Example
  • C.2.38 orasp:wss-username-token-over-ssl
    • C.2.38.1 Example
  • C.2.39 rm:RMAssertion
    • C.2.39.1 Example
  • C.2.40 wsaw:UsingAddressing
    • C.2.40.1 Example
  • C.2.41 wsoma:OptimizedMimeSerialization
    • C.2.41.1 Example
  • C.2.42 oralgp:fault
    • C.2.42.1 Example
  • C.2.43 oralgp:request
    • C.2.43.1 Example
  • C.2.44 oralgp:response
    • C.2.44.1 Example
  • C.2.45 oralgp:msg-log
    • C.2.45.1 Example
  • C.2.46 orasp:attachment
    • C.2.46.1 Attributes
    • C.2.46.2 Example
  • C.2.47 orasp:auth-header
    • C.2.47.1 Attributes
    • C.2.47.2 Examples
  • C.2.48 orasp:body
    • C.2.48.1 Example
  • C.2.49 orasp:check-permission
    • C.2.49.1 Example
  • C.2.50 orasp:coreid-token
    • C.2.50.1 Attributes
    • C.2.50.2 Example
  • C.2.51 orasp:denyAll
    • C.2.51.1 Example
  • C.2.52 orasp:element
    • C.2.52.1 Attributes
    • C.2.52.2 Example
  • C.2.53 orasp:encrypted-elements
    • C.2.53.1 Example
  • C.2.54 orasp:encrypted-parts
    • C.2.54.1 Example
  • C.2.55 orasp:fault
    • C.2.55.1 Example
  • C.2.56 orasp:header
    • C.2.56.1 Attributes
    • C.2.56.2 Example
  • C.2.57 orasp:issued-token
    • C.2.57.1 Attributes
    • C.2.57.2 Example
  • C.2.58 orasp:kerberos-token
    • C.2.58.1 Attributes
    • C.2.58.2 Example
  • C.2.59 orasp:msg-security
    • C.2.59.1 Attributes
    • C.2.59.2 Example
  • C.2.60 orasp:permitAll
    • C.2.60.1 Example
  • C.2.61 orasp:request
    • C.2.61.1 Example
  • C.2.62 orasp:require-tls
    • C.2.62.1 Attributes
    • C.2.62.2 Examples
  • C.2.63 orasp:response
    • C.2.63.1 Example
  • C.2.64 orasp:role
    • C.2.64.1 Attribute
    • C.2.64.2 Example
  • C.2.65 orasp:saml-token
    • C.2.65.1 Attributes
    • C.2.65.2 Example
  • C.2.66 orasp:signed-elements
    • C.2.66.1 Example
  • C.2.67 orasp:signed-parts
    • C.2.67.1 Example
  • C.2.68 orasp:username-token
    • C.2.68.1 Attributes
    • C.2.68.2 Example
  • C.2.69 orasp:x509-token
    • C.2.69.1 Attributes
    • C.2.69.2 Example
  • C.2.70 orawsp:Description
    • C.2.70.1 Example

D Schema Reference for Policy Sets

• D.1 Graphical Representation
• D.2 Element Descriptions
  • D.2.1 policySet
    • D.2.1.1 Attributes
  • D.2.2 wsp:policyReference
    • D.2.2.1 Attributes
    • D.2.2.2 Example
  • D.2.3 orawsp:OverrideProperty
    • D.2.3.1 Example

E OWSM Introspection Plug-in for Oracle Virtual Assembly Builder

• E.1 Overview of the OWSM Introspection Plug-in for Oracle Virtual Assembly Builder
• E.2 OWSM Introspection Plug-in Parameter
• E.3 Reference System Prerequisites
• E.4 OWSM Introspection Plug-in Usage Requirements
• E.5 Resulting Artifact Type
• E.6 Wiring
• E.7 Wiring Properties
• E.8 OWSM Appliance Properties
• E.9 Supported Template Types