4 Interoperability with Oracle WebLogic Server 11g Web Service Security Environments

This chapter contains the following sections:

4.1 Overview of Interoperability with Oracle WebLogic Server 11g Web Service Security Environments

In Oracle Fusion Middleware 11g, you can attach both Oracle WSM and Oracle WebLogic Server Web service policies to WebLogic Java EE Web services.

For more details about the predefined Oracle WSM 11g policies, see the following sections in Oracle Fusion Middleware Security and Administrator's Guide for Web Services:

For more details about the predefined Oracle WebLogic Server 11g Web service policies, see:

Table 4-1 summarizes the most common Oracle WebLogic Server 11g Web service policy interoperability scenarios based on the following security requirements: authentication, message protection, and transport.

Table 4-1 Interoperability With Oracle WebLogic Server 11g Web Services Security Environments

Interoperability Scenario Client—>Web Service Oracle WSM 11g Policies Oracle WebLogic Server 11g Policies

"Username Token With Message Protection (WS-Security 1.1)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss11_username_token_with_message_protection_service_policy

  • Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token With Message Protection (WS-Security 1.1)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_username_token_with_message_protection_client_policy

  • Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token With Message Protection (WS-Security 1.1) and MTOM"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss10_username_token_with_message_protection_service_policy

  • Wssp1.2-wss10_username_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token With Message Protection (WS-Security 1.1) and MTOM"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_username_token_with_message_protection_client_policy

  • Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token With Message Protection (WS-Security 1.0)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss10_username_token_with_message_protection_service_policy

  • Wssp1.2-wss10_username_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token With Message Protection (WS-Security 1.0)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss10_username_token_with_message_protection_client_policy

  • Wssp1.2-wss10_username_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Username Token Over SSL"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss_username_token_over_ssl_service_policy

Wssp1.2-2007-Https-UsernameToken-Plain.xml

"Username Token Over SSL with MTOM"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss_username_token_over_ssl_service_policy

Wssp1.2-2007-Https-UsernameToken-Plain.xml

"SAML Token (Sender Vouches) Over SSL"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss_saml_token_over_ssl_service_policy

Wssp1.2-2007-Saml1.1-SenderVouches-Https.xml

"SAML Token (Sender Vouches) Over SSL with MTOM"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss_saml_token_over_ssl_service_policy

Wssp1.2-2007-Saml1.1-SenderVouches-Https.xml

"SAML Token 2.0 (Sender Vouches) With Message Protection (WS-Security 1.1)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss11_saml_token_with_message_protection_service_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token 2.0 (Sender Vouches) With Message Protection (WS-Security 1.1)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_saml_token_with_message_protection_client_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss11_saml_token_with_message_protection_service_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_saml_token_with_message_protection_client_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1) and MTOM"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss11_saml_token_with_message_protection_service_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1) and MTOM"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_saml_token_with_message_protection_client_policy

wsmtom_policy

  • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.0)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss10_saml_token_with_message_protection_service_policy

  • Wssp1.2-wss10_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"SAML Token (Sender Vouches) with Message Protection (WS-Security 1.0)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss10_saml_token_with_message_protection_client_policy

  • Wssp1.2-wss10_saml_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Mutual Authentication with Message Protection (WS-Security 1.0)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss10_x509_token_with_message_protection_service_policy

  • Wssp1.2-wss10_x509_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Mutual Authentication with Message Protection (WS-Security 1.0)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss10_x509_token_with_message_protection_client_policy

  • Wssp1.2-wss10_x509_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Mutual Authentication with Message Protection (WS-Security 1.1)"

Oracle WebLogic Server 11g—>Oracle WSM 11g

oracle/wss11_x509_token_with_message_protection_service_policy

  • Wssp1.2-wss11_x509_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

"Mutual Authentication with Message Protection (WS-Security 1.1)"

Oracle WSM 11g—>Oracle WebLogic Server 11g

oracle/wss11_x509_token_with_message_protection_client_policy

  • Wssp1.2-wss11_x509_token_with_message_protection_owsm_policy.xml

  • Wssp1.2-2007-SignBody.xml

  • Wssp1.2-2007-EncryptBody.xml

4.2 Username Token With Message Protection (WS-Security 1.1)

This section describes how to implement username token with message protection that conforms to the WS-Security 1.1 standard in the following interoperability scenarios:

4.2.1 Configuring JSE Client Using Oracle WebLogic Server 11g Security Policy and Oracle WSM 11g Web Service

To configure a JSE (or JEE) client that uses Oracle WebLogic Server 11g security policy and Oracle WSM 11g Web service, perform the following steps:

4.2.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a Web service.

  2. Attach the following policy to the Web service: oracle/wss11_username_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.2.1.2 Configuring the Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Provide the configuration for the server (encryption key) in the client, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the encryption key configured for the Web service.

  4. Invoke the Web service method from the client.

4.2.2 Configuring the Client and Oracle WebLogic Server 11g Web Service

To configure a JSE (or JEE) client that uses Oracle WSM 11g policies and Oracle WebLogic Server 11g Web service, perform the following steps:

4.2.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a Web service.

  2. Attach the following policies:

    • Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Configure message-level security, as described in:

    - "Configuring Message-Level Security" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server

    - "Create a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    You only need to configure the Confidentiality Key for a WS-Security 1.1 policy.

  5. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

4.2.2.2 Configuring the Client

  1. Create a client proxy to the Web service (above).

  2. Attach the following policy to the Web service client: oracle/wss11_username_token_with_message_protection_client_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure the policy, as described in "oracle/wss11_username_token_with_message_protection_client_policy" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  4. Specify keystore.recipient.alias in the client configuration.

  5. Ensure that the keystore.recipient.alias keys specified for the client exist as trusted certificate entry in the trust store configured for the Web service.

  6. Provide a valid username and password as part of the configuration.

  7. Invoke the Web service method from the client.

4.3 Username Token With Message Protection (WS-Security 1.1) and MTOM

This section describes how to implement username token with message protection that conforms to the WS-Security 1.1 standard and uses Message Transmission Optimization Mechanism (MTOM) in the following interoperability scenarios:

4.3.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

  1. Configure the Oracle WebLogic Server 11g client and Oracle WSM 11g Web service as described in "Username Token With Message Protection (WS-Security 1.1)".

  2. To enable MTOM communication, use the @MTOM annotation in the Web service in Step 2 of "Configuring the Client".

4.3.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

  1. Configure the Oracle WSM 11g client and Oracle WebLogic Server 11g Web service as described in "Username Token With Message Protection (WS-Security 1.1)".

  2. To enable MTOM communication, perform one of the following:

4.4 Username Token With Message Protection (WS-Security 1.0)

This section describes how to implement username token with message protection that conforms to the WS-Security 1.0 standard in the following interoperability scenarios:

Note:

WS-Security 1.0 policy is supported for legacy applications only. Use WS-Security 1.1 policy for maximum performance. For more information, see "Username Token With Message Protection (WS-Security 1.1)".

4.4.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.4.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a Web service.

  2. Attach the following policy to the Web service: oracle/wss10_username_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.4.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-wss10_username_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Configure the client for server (encryption key) and client certificates, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the decryption key configured for the Web service.

  4. Invoke the Web service method from the client.

4.4.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

4.4.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a Web service.

  2. Attach the following policies:

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-wss10_username_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Configure message-level security, as described in:

    - "Configuring Message-Level Security" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server

    - "Create a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  5. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

4.4.2.2 Configuring Oracle WSM 11g Client

  1. Create a client proxy to the Web service (above).

  2. Attach the following policy to the Web service client: oracle/wss10_username_token_with_message_protection_client_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Service Clients" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure the policy, as described in "oracle/wss10_username_token_with_message_protection_client_policy" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  4. Ensure that you use different keys for client (sign and decrypt key) and keystore recipient alias (server public key used for encryption). Ensure that the recipient alias is in accordance with the keys defined in the Web service policy security configuration.

  5. Ensure that the signing and encryption keys specified for the client exist as trusted certificate entries in the trust store configured for the Web service.

  6. Provide a valid username and password as part of the configuration.

  7. Invoke the Web service method from the client.

4.5 Username Token Over SSL

The following section describes how to implement username token over SSL, describing the following interoperability scenario:

4.5.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.5.1.1 Configuring Oracle WSM 11g Web Service

  1. Configure the server for one-way SSL.

    For more information, see "Configuring SSL on WebLogic Server (One-Way)" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  2. Create a Web service.

  3. Attach the following policy: oracle/wss_username_token_over_ssl_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.5.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen. Provide a valid username and password as part of the configuration for this policy in the client proxy.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server.

  2. Configure WebLogic Server for SSL.

    For more information, see "Configuring SSL on WebLogic Server (One-Way)" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Attach Wssp1.2-2007-Https-UsernameToken-Plain.xml to the Web service client.

  5. Provide the truststore and other required System properties in the SSL client, as described in "Using SSL Authentication in Java Clients" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

  6. Invoke the Web service.

4.6 Username Token Over SSL with MTOM

The following section describes how to implement username token over SSL with Message Transmission Optimization Mechanism (MTOM) in the following interoperability scenario:

4.6.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

  1. Configure the Oracle WebLogic Server 11g client and Oracle WSM 11g Web service as described in "Username Token Over SSL".

  2. To enable MTOM communication, use the @MTOM annotation in the Web service in Step 4 of "Configuring Oracle WebLogic Server 11g Client".

4.7 SAML Token (Sender Vouches) Over SSL

The following section describes how to implement SAML token sender vouches with SSL. It describes the following interoperability scenario:

4.7.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.7.1.1 Configuring Oracle WSM 11g Web Service

  1. Configure the oracle/wss_saml_token_over_ssl_service_policy policy for two-way SSL, as described in "oracle/wss_saml_token_over_ssl_service_policy" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  2. Create a Web service.

  3. Attach the following policy to the Web service: oracle/wss_saml_token_over_ssl_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.7.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server.

  2. Configure Oracle WebLogic Server for two-way SSL.

    For more information, see "Configuring SSL on WebLogic Server (Two-Way)" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure identity and trust stores, as described in "Configure Identity and Trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Attach Wssp1.2-2007-Saml1.1-SenderVouches-Https.xml to the Web service client.

  5. Configure a SAML credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAMLCredentialMapperV2.

    Select the new provider, click on Provider Specific, and configure it as follows:

    1. Set Issuer URI to www.oracle.com.

    2. Set Name Qualifier to www.oracle.com.

  6. Restart Oracle WebLogic Server.

  7. Create a SAML relying party, as described in "Create a SAML 1.1 Relying Party" and "Configure a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Set the Profile to WSS/Sender-Vouches.

  8. Configure the SAML relying party, as described in "Configure a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Configure the SAML relying party as follows (leave other values set to the defaults):

    • Target URL: <url_used_to_access_Web_service>

    • Description: <your_description>

    Select the Enabled checkbox and click Save.

    Ensure the Target URL is set to the URL used for the client Web service.

  9. Create a servlet and call the proxy code from the servlet.

  10. Use BASIC authentication so that the authenticated subject can be created.

  11. Provide the truststore and other required System properties in the SSL client, as described in "Using SSL Authentication in Java Clients" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

  12. Invoke the Web application client.

    Enter the credentials of the user whose identity is to be propagated using the SAML token.

4.8 SAML Token (Sender Vouches) Over SSL with MTOM

The following section describes how to implement SAML token sender vouches over SSL with MTOM. It describes the following interoperability scenario:

4.8.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

  1. Configure the Oracle WebLogic Server 11g client and Oracle WSM 11g Web service as described in "SAML Token (Sender Vouches) Over SSL".

  2. To enable MTOM communication, use the @MTOM annotation in the Web service in Step 4 of "Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service".

4.9 SAML Token 2.0 (Sender Vouches) With Message Protection (WS-Security 1.1)

This section describes how to implement SAML 2.0 token sender vouches with message protection that conforms to the WS-Security 1.1 standard in the following interoperability scenarios:

4.9.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.9.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a JAX-WS Web service.

  2. Attach the following policy to the Web service: oracle/wss11_saml20_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.9.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a J2EE client for the deployed Web service using JDeveloper. Create a Web project and create a proxy using WSDL proxy.

  2. Attach the following policies:

    • Wssp1.2-2007-Saml2.0-SenderVouches-Wss1.1.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    Extract weblogic.jar to a folder and provide the absolute path to the above policies files.

  3. Add servlet to above web project.

  4. Configure the client for server (encryption key) and client certificates, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the decryption key configured for the Web service.

  5. Secure the Web application client using BASIC Authentication. For more information, see "Developing BASIC Authentication Web Applications" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

  6. Deploy the J2EE Web application client.

    See "Deploying Web Services Applications" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  7. Configure a SAML credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the Oracle WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAML2CredentialMapper.

    Select the new provider, click on Provider Specific, and configure it as follows:

    1. Set Issuer URI to www.oracle.com.

    2. Set Name Qualifier to www.oracle.com.

  8. Restart WebLogic Server.

  9. To create a new service provider partner, perform the following steps:

    1. Select the credential mapper created in Step 7 in the WebLogic Administration Console, and then select the Management tab.

    2. Select New, and then select New Webservice Service Provider Partner.

    3. Provide a name, and select Finish.

  10. Configure the service provider partner as follows:

    1. Select the service provide partner created in Step 9.

    2. Select the Enabled check box.

    3. Provide the Audience URI.

    4. Set Issuer URI to www.oracle.com.

    5. Set Target URL to <url_used_to_access_Web_service>.

    6. Set Profile to WSS/Sender-Vouches.

  11. Invoke the Web application client.

    Enter the credentials of the user whose identity is to be propagated using SAML token.

4.9.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

4.9.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a Web service.

  2. Attach the following policies:

    • Wssp1.2-2007-Saml2.0-SenderVouches-Wss1.1.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure the keystore properties for message signing and encryption. The configuration should be in accordance with the keystore used on the server side. Create the trust store out of the keystore by exporting both keys, and trust both of them while importing into trust store. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  4. Configure message-level security, as described in:

    Since this is a WS-Security 1.1 policy, you need to configure Confidentiality Key only.

  5. Attach new configuration using the annotation:

    @WssConfiguration(value="my_security_configuration") where my_security_configuration is the name of the Web Security Configuration created in Step 4. For more information, see "Configuring Message-Level Security" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  6. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

  7. Create a SAML Identity Asserter, as described in "Configuring Authentication and Identity Assertion providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAML2IdentityAsserter.

  8. Restart WebLogic Server.

  9. To add the identity provider to the identity assertor created in Step 7, perform the following steps:

    1. Select the identity assertor created in Step 7 in the WebLogic Administration Console.

    2. Create a new identity provider partner, select New, and then select New Webservice Identity Provider Partner.

    3. Provide a name, and select Finish.

  10. Configure the identity provider as follows:

    1. Select the identity provide partner created in Step 9.

    2. Select the Enabled check box.

    3. Provide the Audience URI. For example: target:*:/saml20WLSWS-Project1-context-root/Class1Port

    4. Set Issuer URI to www.oracle.com.

    5. Set Target URL to <url_used_to_access_Web_service>.

    6. Set Profile to WSS/Sender-Vouches.

4.9.2.2 Configuring Oracle WSM 11g Client

  1. Generate a client using JDeveloper for the Web service created in "Configuring Oracle WSM 11g Client". Create a Web project and then select New, and create a client proxy using the WSDL.

  2. Add a servlet in the above project.

  3. Attach the following policy to the Web service client: oracle/wss11_saml20_token_with_message_protection_client_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Service Clients" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  4. Specify keystore.recipient.alias in the client configuration.

    Ensure that keystore.recipient.alias is the same as the decryption key specified for the Web service.

  5. Ensure that the keystore.recipient.alias keys specified for the client exist as trusted certificate entry in the trust store configured for the Web service.

  6. In JDeveloper, secure web project with Form-based authentication using the Configure ADF Security Wizard.

  7. Invoke the Web application client.

4.10 SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)

This section describes how to implement SAML token sender vouches with message protection that conforms to the WS-Security 1.1 standard in the following interoperability scenarios:

4.10.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.10.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a Web service.

  2. Attach the following policy to the Web service: oracle/wss11_saml_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.10.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Configure the client for server (encryption key) and client certificates, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the decryption key configured for the Web service.

  4. Secure the Web application client using BASIC Authentication. For more information, see "Developing BASIC Authentication Web Applications" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

  5. Deploy the Web service client.

    See "Deploying Web Services Applications" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  6. Configure a SAML credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the Oracle WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAMLCredentialMapperV2.

    Select the new provider, click on Provider Specific, and configure it as follows:

    1. Set Issuer URI to www.oracle.com.

    2. Set Name Qualifier to www.oracle.com.

  7. Restart WebLogic Server.

  8. Create a SAML relying party, as described in "Create a SAML 1.1 Relying Party" and "Configure a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Set the Profile to WSS/Sender-Vouches.

  9. Configure the SAML relying party, as described in "Configure a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Ensure the Target URL is set to the URL used for the client Web service.

  10. Invoke the Web application client.

    Enter the credentials of the user whose identity is to be propagated using SAML token.

4.10.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

4.10.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a Web service.

  2. Attach the following policies:

    • Wssp1.2-wss11_saml_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Configure message-level security, as described in:

    Since this is a WS-Security 1.1 policy, you need to configure Confidentiality Key only.

  5. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

  6. Create a SAMLIdentityAsserterV2 authentication provider, as described in "Configuring Authentication and Identity Assertion providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAMLCredentialMapperV2.

  7. Restart WebLogic Server.

  8. Select the authentication provider created in step 5.

  9. Create a SAML asserting party, as described in "Create a SAML 1.1 Asserting Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Set Profile to WSS/Sender-Vouches.

  10. Configure the SAML asserting party, as described in "Configure a SAML 1.1 Asserting Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Configure the SAML asserting party as follows:

    1. Set Issuer URI to www.oracle.com.

    2. Set Target URL to <url_used_to_access_Web_service>.

4.10.2.2 Configuring Oracle WSM 11g Client

  1. Create a client proxy to the Web service (above).

  2. Attach the following policy to the Web service client: oracle/wss11_saml_token_with_message_protection_client_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Service Clients" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure the policy, as described in oracle/wss11_saml_token_with_message_protection_client_policy.

  4. Specify keystore.recipient.alias in the client configuration.

    Ensure that keystore.recipient.alias is the same as the decryption key specified for the Web service.

  5. Ensure that the keystore.recipient.alias keys specified for the client exist as trusted certificate entry in the trust store configured for the Web service.

  6. Provide a valid username whose identity needs to be propagated using SAML token in the client configuration.

  7. Invoke the Web application client.

    Enter the credentials of the user whose identity is to be propagated using SAML token.

4.11 SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1) and MTOM

This section describes how to implement SAML token with sender vouches and message protection that conforms to the WS-Security 1.1 standard and uses Message Transmission Optimization Mechanism (MTOM) in the following interoperability scenarios:

4.11.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

  1. Configure the Oracle WebLogic Server 11g client and Oracle WSM 11g Web service as described in "SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)".

  2. To enable MTOM communication, use the @MTOM annotation in the Web service in Step 2 of "Configuring Oracle WebLogic Server 11g Client".

4.11.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

  1. Configure the Oracle WSM 11g client and Oracle WebLogic Server 11g Web service as described in "SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)".

  2. To enable MTOM communication, perform one of the following:

4.12 SAML Token (Sender Vouches) with Message Protection (WS-Security 1.0)

This section describes how to implement SAML token with sender vouches and message protection that conforms to the WS-Security 1.0 standard in the following interoperability scenarios:

Note:

WS-Security 1.0 policy is supported for legacy applications only. Use WS-Security 1.1 policy for maximum performance. For more information, see "SAML Token (Sender Vouches) with Message Protection (WS-Security 1.1)".

4.12.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the following steps:

4.12.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a Web service.

  2. Attach the following policy to the Web service: oracle/wss10_saml_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.12.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-wss10_saml_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Configure the client for server (encryption key) and client certificates, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the decryption key configured for the Web service.

  4. Secure the Web application client using BASIC Authentication. For more information, see "Developing BASIC Authentication Web Applications" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

  5. Deploy the Web service client.

    See "Deploying Web Services Applications" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  6. Configure a SAML credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAMLCredentialMapperV2.

  7. Select the SAMLCredentialMapperV2, click on Provider Specific, and configure it as follows:

    1. Set Issuer URI to www.oracle.com.

    2. Set Name Qualifier to www.oracle.com.

  8. Restart WebLogic Server.

  9. Create a SAML relying party, as described in "Create a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Set the profile to WSS/Sender-Vouches.

  10. Configure the SAML relying party, as described in "Configure a SAML 1.1 Relying Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Ensure the target URL is set to the URL used for the client Web service.

  11. Invoke the Web application client and enter the appropriate credentials.

4.12.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the following steps:

4.12.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a Web service.

  2. Attach the following policies:

    • Wssp1.2-wss10_saml_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Configure message-level security, as described in:

    Since this is a WS-Security 1.1 policy, you need to configure Confidentiality Key only.

  5. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

  6. Create a SAMLIdentityAsserterV2 authentication provider, as described in "Configuring Authentication and Identity Assertion providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    In the WebLogic Server Administration Console, navigate to Security Realms > RealmName > Providers > Credential Mapping page and create a New Credential Mapping Provider of type SAMLCredentialMapperV2.

  7. Restart WebLogic Server.

  8. Select the authentication provider created in step 5.

  9. Create a SAML asserting party, as described in "Create a SAML 1.1 Asserting Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    • Set Profile to WSS/Sender-Vouches.

  10. Configure a SAML asserting party, as described in "Configure a SAML 1.1 Asserting Party" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Configure the SAML asserting party as follows (leave other values set to the defaults):

    1. Set Issuer URI to www.oracle.com.

    2. Set Target URL to <url_used_by_client>.

4.12.2.2 Configuring Oracle WSM 11g Client

  1. Create a client proxy to the Web service (above).

  2. Attach the following policy to the Web service client: oracle/wss10_saml_token_with_message_protection_client_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Service Clients" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

  3. Configure the policy, as described in oracle/wss10_saml_token_with_message_protection_client_policy.

  4. Ensure that you use different keys for client (sign and decrypt key) and keystore recipient alias (server public key used for encryption). Ensure that the recipient alias is in accordance with the keys defined in the Web service policy security configuration.

  5. Ensure that the signing and encryption keys specified for the client exist as trusted certificate entries in the trust store configured for the Web service.

  6. Provide valid username whose identity needs to be propagated using SAML token in the client configuration.

  7. Invoke the Web service method.

4.13 Mutual Authentication with Message Protection (WS-Security 1.0)

The following sections describe how to implement mutual authentication with message protection that conform to the WS-Security 1.0 standards:

4.13.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 10g client and Oracle WSM 11g Web service, perform the steps in the following sections.

4.13.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a Web service.

  2. Attach the following policy to the Web service: oracle/wss10_x509_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.13.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-wss10_x509_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Provide the configuration for the server (encryption key) in the client, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the encryption key configured for the Web service.

  4. Invoke the Web service method from the client.

4.13.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the steps in the following sections.

4.13.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a JAX-WS Web service.

  2. Attach the following policies:

    • Wssp1.2-wss10_x509_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  4. Configure message-level security, as described in:

    - "Configuring Message-Level Security" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server

    - "Create a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

    You only need to configure the Confidentiality Key for a WS-Security 1.0 policy.

  5. Create and configure token handlers for X.509 and for username token. In WebLogic Administration Console, navigate to the Web Service Security page of the domain and create the token handlers as follows:

    • Create a token handle for username token and configure the following:

      • Name: <name>

      • Class name: weblogic.xml.crypto.wss.UsernameTokenHandler

      • Token Type: ut

      • Handling Order: 1

    • Create a token handler for X.509 and configure the following:

      • Name: <name>

      • Class name: weblogic.xml.crypto.wss.BinarySecurityTokenHandler

      • Token Type: x509

      • Handling Order: 0

    • For the X.509 token handler, add the following properties:

      • Name: UserX509ForIdentity

      • Value: true

      • IsEncrypted: False

      For more information on token handlers, see "Create a token handler of a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  6. Configure a credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Create a PKICredentialMapper and configure it as follows (leave all other values set to the defaults):

    • Keystore Provider: N/A

    • Keystore Type: jks

    • Keystore File Name: default_keystore.jks

    • Keystore Pass Phrase: <password>

    • Confirm Keystore Pass Phrase: <password>

  7. Configure Authentication, as described in "Configure Authentication and Identity Assertion providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Select the Authentication tab and configure as follows:

    • Click DefaultIdentityAsserter and add X.509 to Chosen active types

    • Click Provider Specific and configure the following:

      • Default User Name Mapper Attribute Type: CN

      • Active Types: X.509

      • Use Default User Name Mapper: True

  8. If the users are not added, add the Common Name (CN) user specified in the certificate as described in "Create users" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  9. Restart Oracle WebLogic Server.

  10. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

4.13.2.2 Configuring Oracle WSM 10g Client

  1. Create a client proxy for the Web service using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server.

  2. Attach the following policy to the client: wss10_x509_token_with_message_protection_client_policy

  3. Provide the configuration for the server (encryption key) in the client, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the encryption key configured for the Web service.

  4. Invoke the Web service method from the client.

4.14 Mutual Authentication with Message Protection (WS-Security 1.1)

The following sections describe how to implement mutual authentication with message protection that conform to the WS-Security 1.1 standards:

4.14.1 Configuring Oracle WebLogic Server 11g Client and Oracle WSM 11g Web Service

To configure Oracle WebLogic Server 11g client and Oracle WSM 11g Web service, perform the steps in the following sections.

4.14.1.1 Configuring Oracle WSM 11g Web Service

  1. Create a JAX-WS Web service.

  2. Attach the following policy to the Web service: oracle/wss11_x509_token_with_message_protection_service_policy.

    For more information about attaching the policy, see "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.

4.14.1.2 Configuring Oracle WebLogic Server 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policies:

    • Wssp1.2-wss11_x509_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

  3. Provide the configuration for the server (encryption key) in the client, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the encryption key configured for the Web service.

  4. Invoke the Web service method from the client.

4.14.2 Configuring Oracle WSM 11g Client and Oracle WebLogic Server 11g Web Service

To configure Oracle WSM 11g client and Oracle WebLogic Server 11g Web service, perform the steps in the following sections:

4.14.2.1 Configuring Oracle WebLogic Server 11g Web Service

  1. Create a JAX-WS Web service.

  2. Attach the following policies:

    • Wssp1.2-wss11_x509_token_with_message_protection_owsm_policy.xml

    • Wssp1.2-2007-SignBody.xml

    • Wssp1.2-2007-EncryptBody.xml

    For more information, see "Updating the JWS File with @Policy and @Policies Annotations" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

  3. Configure identity and trust stores, as described in "Configure identity and trust" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help

  4. Configure message-level security, as described in:

    - "Configuring Message-Level Security" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server

    - "Create a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    You only need to configure the Confidentiality Key for a WS-Security 1.1 policy.

  5. Create and configure token handlers for X.509 and for username token. In WebLogic Administration Console, navigate to the Web Service Security page of the domain and create the token handlers as follows:

    • Create a token handle for username token and configure the following:

      • Name: <name>

      • Class name: weblogic.xml.crypto.wss.UsernameTokenHandler

      • Token Type: ut

      • Handling Order: 1

    • Create a token handler for X.509 and configure the following:

      • Name: <name>

      • Class name: weblogic.xml.crypto.wss.BinarySecurityTokenHandler

      • Token Type: x509

      • Handling Order: 0

    • For the X.509 token handler, add the following properties:

      • Name: UserX509ForIdentity

      • Value: true

      • IsEncrypted: False

      For more information on token handlers, see "Create a token handler of a Web Service security configuration" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  6. Configure a credential mapping provider, as described in "Configure Credential Mapping Providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Create a PKICredentialMapper and configure it as follows (leave all other values set to the defaults):

    • Keystore Provider: N/A

    • Keystore Type: jks

    • Keystore File Name: default_keystore.jks

    • Keystore Pass Phrase: <password>

    • Confirm Keystore Pass Phrase: <password>

  7. Configure Authentication, as described in "Configure Authentication and Identity Assertion providers" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

    Select the Authentication tab and configure as follows:

    • Click DefaultIdentityAsserter and add X.509 to Chosen active types

    • Click Provider Specific and configure the following:

      • Default User Name Mapper Attribute Type: CN

      • Active Types: X.509

      • Use Default User Name Mapper: True

  8. If the users are not added, add the Common Name (CN) user specified in the certificate as described in "Create users" in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help.

  9. Restart Oracle WebLogic Server.

  10. Deploy the Web service.

    See Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

4.14.2.2 Configuring Oracle WSM 11g Client

  1. Create a client proxy for the Web service (above) using clientgen.

    For more information, see "Using the clientgen Ant Task to Generate Client Artifacts" in Oracle Fusion Middleware Getting Started With JAX-WS Web Services for Oracle WebLogic Server

  2. Attach the following policy to the client: wss11_x509_token_with_message_protection_client_policy

    Note:

    Edit the policy as follows:

    <orasp:x509-token orasp:sign-key-ref-mech="thumbprint"orasp:enc-key-ref-mech="thumbprint"/>

  3. Provide the configuration for the server (encryption key) in the client, as described in "Updating a Client Application to Invoke a Message-Secured Web Service" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server.

    Ensure that the encryption key specified is in accordance with the encryption key configured for the Web service.

  4. Invoke the Web service method from the client.