例2 package.xml: HTTP Basicが有効

.....
    <service-endpoint path="/inquiry" version="3.0" name="UDDIInquiryV3Endpoint"
        service-instance="tns:UDDIInquiryV3" processing="tns:UDDIv1v2v3InquiryProcessing"
          accepting-security-providers="HttpBasic">
        <wsdl uri="uddi_api_v3.wsdl" service="uddi_api_v3:UDDI_Inquiry_SoapService"/>
        <envelopePrefix xmlns="arbitraryNamespace" value=""/>
        <namespaceOptimization xmlns="arbitraryNamespace">false</namespaceOptimization>
    </service-endpoint>
    <service-instance
        implementation-class="com.systinet.uddi.publishing.v3.PublishingApiImpl"
        name="UDDIPublishingV3"/>
    <service-endpoint path="/publishing" version="3.0" name="UDDIPublishingV3Endpoint"
        service-instance="tns:UDDIPublishingV3"
        processing="tns:UDDIv1v2v3PublishingProcessing"
        accepting-security-providers="HttpBasic">
        <wsdl uri="uddi_api_v3.wsdl" service="uddi_api_v3:UDDI_Publication_SoapService"/>
        <envelopePrefix xmlns="arbitraryNamespace" value=""/>
        <namespaceOptimization xmlns="arbitraryNamespace">false</namespaceOptimization>
    </service-endpoint>

    <processing name="UDDIv3Processing">
      <use ref="uddiclient_v3:UDDIClientProcessing"/>
      <fault-serialization name="MessageTooLargeFaultSerializer"
      serializer-class="com.systinet.uddi.publishing.v3.serialization.MessageTooLargeFaultSerializer"
      serialized-exception-class="com.systinet.uddi.interceptor.wasp.MessageTooLargeException"/>
    </processing>

    <processing name="UDDIv1v2v3PublishingProcessing">
     <use ref="uddiclient_v3:UDDIClientProcessing"/>
     <use ref="uddiclient_v2:UDDIClientProcessing"/>
     <use ref="uddiclient_v1:UDDIClientProcessing"/>
     <!-- HttpBasic (without authtoken)         -->
     <use ref="tns:HttpBasicInterceptor"/>

    <interceptor name="MessageSizeCheckerInterceptor"
       implementation-class="com.systinet.uddi.interceptor.wasp.MessageSizeCheckerInterceptor"
       direction="in">
        <config:maxMessageSize>2097152</config:maxMessageSize>
        </interceptor>
    </processing>

    <processing name="UDDIv1v2v3InquiryProcessing">
        <use ref="tns:UDDIv3Processing"/>
        <use ref="tns:UDDIv2Processing"/>
        <use ref="tns:UDDIv1Processing"/>
        <use ref="tns:HttpBasicInterceptor"/>
    </processing>
.....

例3 package.xml: Netegrity SiteMinderが有効

.....
  <!-- Netegrity SiteMinded security provider preferences for the server side -->
    <securityProviderPreferences xmlns="http://systinet.com/wasp/package/extension"
       name="Siteminder">
        <loginNameHeader>sm-userdn</loginNameHeader>
        <groupHeader>sm-role</groupHeader>
        <delimiter>^</delimiter>
    </securityProviderPreferences>

    <!-- Netegrity SiteMinded interceptor-->
    <interceptor name="SiteMinderInterceptor"
         implementation-class="com.systinet.uddi.security.siteminder.SmInterceptor" >
        <config:loginNameHeader>sm-userdn</config:loginNameHeader>
        <config:groupHeader>sm-role</config:groupHeader>
        <config:delimiter>^</config:delimiter>
    </interceptor>
.....

例4 双方向SSLが有効なserverconf.xmlの一部

<?xml version="1.0" encoding="UTF-8"?>
<config name="main">
   ...
  <securityPreferences name="main">
     <!-- Added acceptingSecurityProvider -->
    <acceptingSecurityProvider>SSL</acceptingSecurityProvider>
    <pstoreInitParams/>
    ...
  </securityPreferences>
  ...
  <httpsPreferences name="https">
    ...
    <!-- Client authentication required -->
    <needsClientAuth>true</needsClientAuth>
    ...
  </httpsPreferences>
  ...
  <!-- security provider preferences intended mainly for SSL client authentication -->
  <securityProviderPreferences name="SSL">
      <!-- What to do when SSL is not used to access the resource? Avalaible options:
      redirect
        - perform HTTP redirect to associated HTTPS URL (302 Moved Temporarily)
      fail
        - return a message that informs to use HTTPS URL (400 Bad Request)
      skip
        - do not perform certififate mapping at all
      perform
        - try to perform certificate mapping with no client certificates
      -->
      <whenNotSsl>skip</whenNotSsl>
      <!-- Can certificate mapping fail? If set to true and it fails, no received subject will be constructed. -->
      <certMappingMayFail>false</certMappingMayFail>
      <!-- Can a default account be created when no account for a mapped user exists? -->
      <createDefaultAccount>false</createDefaultAccount>
  </securityProviderPreferences>
</config>

例5 CertsMapping JAASの構成

CertsMapping{
 com.systinet.uddi.security.jaas.CertMappingLoginModule sufficient pattern="(?<!\\,\s?)EMAILADDRESS=(.+)@" debug=false issuer="CN=Company CA, OU=mycomp";
};

例6 2人の発行者が許可されたCertsMapping JAASの構成

CertsMapping{
 com.systinet.uddi.security.jaas.CertMappingLoginModule sufficient pattern="(?<!\\,\s?)EMAILADDRESS=(.+)@" debug=false issuer="CN=Company CA, OU=mycomp";
 com.systinet.uddi.security.jaas.CertMappingLoginModule sufficient pattern="CN=([^,]*)" issuer="CN=Company CA2, OU=mycomp" debug=false;
};

例7 web.xmlの一部

<?xml version="1.0" encoding="UTF-8"?>
<web-app>
    <display-name>Registry</display-name>
...
    <context-param>
        <param-name>use.request.user</param-name>
        <param-value>true</param-value>
    </context-param>
....
<!-- Added CLIENT-CERT authentication method -->
    <login-config>
      <auth-method>CLIENT-CERT</auth-method>
    </login-config>

<!-- Added security contraint that allow to access registry only via HTTPS -->
    <security-constraint>
      <display-name>HTTPS required to access registry</display-name>
      <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>DELETE</http-method>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
      </web-resource-collection>
      <user-data-constraint>
        <description>Require confidentiality</description>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
    </security-constraint>
</web-app>

例8 web.xmlの一部

    <login-config>
      <auth-method>CLIENT-CERT</auth-method>
    </login-config>

    <context-param>
      <param-name>twowayssl.use_user</param-name>
      <param-value>true</param-value>
    </context-param>
    <context-param>
      <param-name>twowayssl.issuer</param-name>
      <param-value>C=CZ, ST=Czech, L=Prague, O=Example company, OU=Security Team, CN=CA</param-value>
    </context-param>