Oracle® Fusion Middleware

Oracle API Gateway Explorer User Guide

11g Release 2 (11.1.2.3.0)

Oracle API Gateway Explorer User Guide, 11g Release 2 (11.1.2.3.0)

Copyright © 1999, 2014, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. This documentation is in prerelease status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Software License and Service Agreement, which has been executed and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

27 May 2014


Contents

1. Getting Started
Oracle API Gateway Explorer Overview
Overview
Stress Test Services
Traffic Simulation
Sample SOAP Messages
Application-level Networking
Test Federated Identity Deployments
Test XML, REST, and SOAP
SOAP Attachments
Simple Graphical Keystore
Add or Remove Security Tokens
Transfer Encoding
Testing Tool for Design-time Governance
System Requirements
Prerequisites
Requirements
Installation Instructions
API Gateway Explorer Release Notes
Overview
In this Version
Installation
Documentation
Acknowledgements
OpenSSL License Issues
Overview
OpenSSL License
Original SSLeay License
2. General Configuration
Introducing Oracle API Gateway Explorer
Overview
API Gateway Explorer Classic View
API Gateway Explorer Design View
Checking WSDL for WS-I Compliance
Using the Send Request Command
Using the API Gateway Explorer Classic Mode
Overview
Auto-Generating SOAP Messages from WSDL Files
SOAP Request and Response
Connection Settings
Sign Request
Encrypt Request
Decrypt Request
Insert SAML Token
Insert WS-Security UsernameToken
Generating and Running Test Cases
Overview
Using WSDL to Generate Test Cases
Running Test Cases
Viewing the Results
Configuring Individual Test Cases
Running Attack Vectors
Overview
Configuring an Attack Vector
Inserting Attack Vectors into Sample Messages
Viewing the Results
Testing WSDL Files for WS-I Compliance
Overview
Running the WS-I Compliance Test
Manage certificates and keys
Overview
View certificates and private keys
Configure an X.509 certificate
Configure a private key
Global options
Manage certificates and keystores
Configure key pairs
Configure PGP key pairs
Configuring Connection Settings
Overview
URL
Proxy Settings
Trusted Certificates
Client SSL Authentication
HTTP Authentication
Stress Testing with Send Request (SR)
Overview
Basic SR Examples
Advanced SR Examples
SR Arguments
Global Schema Cache
Overview
Adding Schemas to the Cache
Schema Validation
General Preferences
Overview
Auto Format Response
JMS
Kerberos
Proxy Settings
Runtime Dependencies
SMTP
SSL Settings
TCP/IP Monitor
Test Case Colors
Trace Level
VM Arguments
Web and XML
Wildcards
WS-I Settings
3. Attributes
Retrieve attribute from HTTP header
Overview
Configuration
Insert SAML attribute assertion
Overview
General settings
Assertion Details
Assertion Location
Subject Confirmation Method
Advanced settings
Retrieve attribute from message
Overview
Configuration
4. Authentication
Insert SAML Authentication Assertion
Overview
General Configuration
Assertion Details
Assertion Location
Subject Confirmation Method
Advanced
Insert WS-Security Username Token
Overview
General Configuration
Credential Details
Advanced
Set User Name
Overview
Configuration
5. Authorization
Insert SAML Authorization Assertion
Overview
General Configuration
Assertion Details
Assertion Location
Subject Confirmation Method
Advanced
6. Content Filtering
Content type filtering
Overview
Allow or deny content types
Configure MIME/DIME types
Content validation
Overview
Manual XPath configuration
XPath wizard
HTTP Status
Overview
Configuration
Has SOAP Body?
Overview
Configuration
Is SOAP Fault?
Overview
Configuration
HTTP header validation
Overview
Configure HTTP header regular expressions
Configure threatening content regular expressions
Schema validation
Overview
General settings
Selecting the schema
Selecting which part of the message to match
Advanced settings
Reporting schema validation errors
Validate selector expression
Overview
Configure selector-based regular expressions
Threatening content regular expressions
7. Conversion
Add HTTP Header
Overview
Configuration
Set HTTP Verb
Overview
Configuration
Remove Attachments
Overview
Configuration
Set Message
Overview
Configuration
Example of using selectors in the message body
8. Encryption
XML decryption
Overview
Configuration
Auto-generation using the XML decryption wizard
XML decryption settings
Overview
XML encryption overview
Nodes to decrypt
Decryption key
Options
Auto-generation using the XML decryption wizard
XML encryption
Overview
Configuration
Auto-generation using the XML encryption settings wizard
XML encryption settings
Overview
XML encryption overview
Encryption key settings
Key info settings
Recipient settings
What to encrypt settings
Advanced settings
Auto-generation using the XML encryption settings wizard
XML Encryption Wizard
Overview
Configuration
9. Integrity
XML Signature Generation
Overview
Signing Key
What to Sign
Where to Place Signature
Advanced
Additional
Algorithm Suite
Options
XML Signature Verification
Overview
Signature Verification
What Must Be Signed
Advanced
10. Kerberos
Kerberos configuration
Overview
Kerberos configuration file—krb5.conf
Advanced settings
Native GSS library
Kerberos Client Authentication
Overview
Kerberos Client
Kerberos Token Profile
11. Routing
Connection
Overview
General settings
SSL settings
Authentication settings
Additional settings
Connect to URL
Overview
General settings
Request settings
SSL settings
Authentication settings
Additional settings
HTTP Status Code
Overview
Configuration
Insert WS-Addressing
Overview
Configuration
Messaging System Filter
Overview
Request Settings
Response Settings
Rewrite URL
Overview
Configuration
SMTP Routing
Overview
General Settings
Message Settings
Static Router
Overview
Configuration
12. Utility
False Filter
Overview
Configuration
Find certificate
Overview
Configuration
Pause Filter
Overview
Configuration
Scripting language filter
Overview
Write a script
Add your script JARs to the classpath
Configure a script filter
Add a script to the library
Test Case Shortcut
Overview
Configuration
True Filter
Overview
Configuration
13. Common Configuration
Retrieving WSDL files from a UDDI registry
Overview
Introducing UDDI
UDDI definitions
Configuring a registry connection
WSDL search
Quick search
Name search
Advanced search
Advanced options
Publish
Connecting to a UDDI registry
Overview
Configuring a registry connection
Securing a connection to a UDDI registry
Configuring XPath Expressions
Overview
Manual Configuration
XPath Wizard
Signature Location
Overview
Configuration
What To Sign
Overview
ID Configuration
Node Locations
XPath Configuration
XPath Predicates
Message Attribute
Selecting configuration values at runtime
Overview
Selector syntax
Example Selector Expressions
Extracting Message Attributes