Administration Console Online Help

Before you begin

You must install a Web service before you can associate a WS-Policy file with it. See Install a Web service.

A Web service can have zero or more WS-Policy files associated with it. WS-Policy files follow the guidelines of the WS-Policy specification. WebLogic Server uses WS-Policy files to specify the details of the message-level security (digital signatures and encryption) and reliable messaging capabilities of a Web service.

You can attach a WS-Policy file to a Web service endpoint, which means that the policy assertions apply to all the operations of a Web service endpoint. You can also attach a WS-Policy file to an operation, which means that the policy assertions apply only to the specific operation.

In addition, you can attach a WS-Policy file to the inbound or outbound SOAP message, or both. For example, if a WS-Policy file that specifies encryption for the body of a SOAP message is attached to just the inbound message of a particular operation, only the SOAP request needs to be encrypted.

Programmers, when creating the Web service, can use the Java Web service (JWS) annotation @Policy inside the implementation Java file of the Web service to attach a WS-Policy file. Administrators modify or attach additional WS-Policy files at runtime using the Administration Console, as described in this procedure.

After you have attached a WS-Policy file to a Web service endpoint or operation, the assistant updates the application's deployment plan. If the application does not currently have a configured deployment plan, the assistant creates one for you in the location you specify.

Types of Policies

You can attach two types of policies to WebLogic Web Services, as summarized in the following table.

Policy Type	Description
Oracle Web Services Manager (Oracle WSM)	Provided by Oracle WSM. For more information about the Oracle WSM and predefined policies, see Understanding Oracle WSM Policy Framework in Security and Administrator's Guide for Web Services.
WebLogic Web Service Policy	Provided by Oracle WebLogic Server. For more information about the WebLogic Web service policies, see Securing WebLogic Web Services for Oracle WebLogic Server.

Pre-packaged WebLogic Web Service Policies

WebLogic Server includes pre-packaged WS-Policy files that you can use for configuring message-level security and reliable messaging, including the following. These files are static and you cannot change them. Predefined policies are available in the following categories:

Reliable Messaging: Set of WS-Policy files that enable you to configure Web services reliable messaging. Reliable messaging policies are provide for JAX-RPC Web services only.
SOAP Message Transmission Optimization Mechanism (MTOM): Used to specify that the Web service supports MTOM to transport binary data. MTOM describes a method for optimizing the transmission of XML data of type xs:base64Binary using MIME attachments over HTTP to carry that data while at the same time allowing both the sender and the receiver direct access to the XML data without having to be aware that any MIME artifacts were used to marshal the xs:base64Binary data.

Security: Two sets of pre-packaged security policy files are available for configuring message-level security. One set of security policy files conforms to the OASIS WS-SecurityPolicy 1.2 specification. These security policy files are described in Using WS-SecurityPolicy 1.2 Policy Files in Securing Web Services for Oracle WebLogic Server. The other set of security policy files conforms to a proprietary Oracle Web services security policy schema and are described in Proprietary Web Services Security Policy Files (JAX-RPC Only) in Securing Web Services for Oracle WebLogic Server. You can use security policy files from either set, but the two sets are not mutually compatible; you cannot define both types of policy file in the same Web service.

Pre-packaged Oracle WSM Policies

Oracle WSM includes a set of predefined policies in the following categories: security, WS-Addressing, MTOM, reliable messaging, and management. For specific details, see Predefined Policies in Security and Administrator's Guide for Web Services.

Using Custom Policies

If the Web service programmer includes additional WS-Policy files in the J2EE module or application in which the service is packaged, or a shared J2EE library has been deployed that contains additional WS-Policy files, then you can attach them to your Web service also. To make available the custom WebLogic Web service policies, perform one of the following steps:

Place the custom policy JAR in the classpath and set the WebLogic Server property weblogic.wsee.policy.LoadFromClassPathEnabled to true.
Place the custom policy JAR in WEB-INF/policies (Web application) or META-INF/policies (EJB).
Place the custom policy XML file in WEB-INF (Web application) or META-INF (EJB).

Note:

The Administration Console allows you to associate as many WS-Policy files as you want to a Web service and its operations, even if the policy assertions in the files contradict each other. It is up to you to ensure that mulitple associated WS-Policy files work together. If any contradictions do exist, WebLogic Server will return a runtime error when a client application invokes the Web service.

To associate a WS-Policy file with a Web service:

If you have not already done so, in the Change Center of the Administration Console, click Lock & Edit (see Use the Change Center).
In the left pane of the Administration Console, select Deployments.
In the right pane, navigate within the Deployments table until you find the Web service for which you want to configure a WS-Policy file.
Note: Web services are deployed as part of an Enterprise application, Web application, or EJB. To understand how Web services are displayed in the Administration Console, see View installed Web services.
In the Deployments table, click the name of the Web service.
Select Configuration -> WS-Policy.
The table lists the WS-Policy files that are currently associated with the Web service. The top level lists all the ports of the Web service. Click the + next to a Web service port to see its operations and associated WS-Policy files.
To associate a WS-Policy file with an entire Web service endpoint (port):
1. Click the name of the Web service port. A page appears which includes two columns: one labelled Available Endpoint Policies that lists the names of the WS-Policy files that you can attach to a Web service endpoint and one labelled Chosen Endpoint Policies that lists the WS-Policy files that are currently configured for this endpoint.
2. Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are attached to the Web service endpoint.
3. Click OK.
  If your Web service already has a deployment plan associated to it, then the newly attached WS-Policy files are displayed in the Policies column in the table.
  
  If the J2EE module of which the Web service is a part does not currently have a deployment plan associated with it, the assistant asks you for the directory that should contain the deployment plan. Use the navigation tree to specify a directory, then click Finish.
To associate a WS-Policy file with a Web service operation:
1. Click the name of the operation. A page appears which includes two columns: one labelled Operation Message Policies that lists the names of the WS-Policy files that are available to attach to the inbound (request) and outbound (response) SOAP message of the operation invoke and one labelled Chosen Message Policies that lists the WS-Policy files that are currently attached to the inbound and outbound SOAP message of the operation invoke.
2. Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the inbound and outbound SOAP message when this operation is invoked by a client application.
3. Click Next.
4. A page appears which includes two columns: one labelled Operation Inbound Message Policies that lists the names of the WS-Policy files that are available to attach to the inbound (request) SOAP message of the operation invoke and one labelled Chosen Outbound Message Policies that lists the WS-Policy files that are currently attached to the inbound SOAP message of the operation invoke.
5. Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the inbound (request) SOAP message when this operation is invoked by a client application.
6. Click Next.
7. A page appears which includes two columns: one labelled Operation Outbound Message Policies that lists the names of the WS-Policy files that are available to attach to the outbound (response) SOAP message of the operation invoke and one labelled Chosen Outbound Message Policies that lists the WS-Policy files that are currently attached to the outbound SOAP message of the operation invoke.
8. Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the outbound (response) SOAP message when this operation is invoked by a client application.
9. Click Finish.
  If your Web service already has a deployment plan associated with it, the attached WS-Policy files are displayed in the Policies column in the table.
  
  If the J2EE module of which the Web service is a part does not currently have a deployment plan associated with it, the assistant asks you for the directory that should contain the deployment plan. Use the navigation tree to specify a directory, then click Finish.
To activate these changes, in the Change Center of the Administration Console, click Activate Changes.
Not all changes take effect immediately—some require a restart (see Use the Change Center).

Administration Console Online Help

Attach a WS-Policy file to a Web service