This chapter describes the predefined assertion templates defined for the current release. Use the predefined assertion templates to construct your own policies or clone to create new policies.
Note:
The predefined policies and assertion templates distributed with the current release are read only. You must copy the policy or assertion template before modifying it. You also have the option of configuring the attributes in an assertion after you have added it to a policy. For information about managing the assertion templates and adding them to policies, see "Managing Policy Assertion Templates".This chapter includes the following sections:
For a detailed description of the configuration settings in the tables, see "Assertion Template Settings".
For a detailed description of the configuration properties listed in the tables, see "Assertion Template Configuration Properties". For details on how to edit the configuration properties, see "Editing the Configuration Properties in an Assertion Template". For information about overriding policies, see "Overview of Policy Configuration Overrides".
The following sections describe the security assertion templates in more detail.
You can jump to a specific assertion template description using the following links (listed alphabetically):
oracle/http_spnego_token_client_template or oracle/http_spnego_token_service_template
oracle/http_saml20_token_bearer_client_template or oracle/http_saml20_token_bearer_service_template
oracle/wss_http_token_over_ssl_client_template or oracle/wss_http_token_over_ssl_service_template
oracle/wss_http_token_client_template or oracle/wss_http_token_service_template
oracle/wss_saml_token_bearer_over_ssl_client_template or oracle/wss_saml_token_bearer_over_ssl_service_template
oracle/wss_saml20_token_bearer_over_ssl_client_template or oracle/wss_saml20_token_bearer_over_ssl_service_template
oracle/wss_saml_token_over_ssl_client_template or oracle/wss_saml_token_over_ssl_service_template
oracle/wss_saml20_token_over_ssl_client_template or oracle/wss_saml20_token_over_ssl_service_template
oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template or oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template
oracle/wss_username_token_over_ssl_client_template or oracle/wss_username_token_over_ssl_service_template
oracle/wss_username_token_client_template or oracle/wss_username_token_service_template
oracle/wss_username_token_over_ssl_client_template or oracle/wss_username_token_over_ssl_service_template
oracle/wss10_message_protection_client_template or oracle/wss10_message_protection_service_template
oracle/wss10_saml_token_client_template or oracle/wss10_saml_token_service_template
oracle/wss10_saml20_token_client_template or oracle/wss10_saml20_token_service_template
oracle/wss10_saml_token_with_message_protection_client_template or oracle/wss10_saml_token_with_message_protection_service_template
oracle/wss10_saml20_token_with_message_protection_client_template or oracle/wss10_saml20_token_with_message_protection_service_template
oracle/wss10_username_token_with_message_protection_client_template or oracle/wss10_username_token_with_message_protection_service_template
oracle/wss10_x509_token_with_message_protection_client_template or oracle/wss10_x509_token_with_message_protection_service_template
oracle/wss11_kerberos_token_client_template or oracle/wss11_kerberos_token_service_template
oracle/wss11_kerberos_token_with_message_protection_client_template or oracle/wss11_kerberos_token_with_message_protection_service_template
oracle/wss11_saml_token_with_message_protection_client_template or oracle/wss11_saml_token_with_message_protection_service_template
oracle/wss11_saml20_token_with_message_protection_client_template or oracle/wss11_saml20_token_with_message_protection_service_template
oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template or oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template
oracle/wss11_sts_issued_saml_with_message_protection_client_template
oracle/wss11_username_token_with_message_protection_client_template or oracle/wss11_username_token_with_message_protection_service_template
oracle/wss11_x509_token_with_message_protection_client_template or oracle/wss11_x509_token_with_message_protection_service_template
Table 18-1 summarizes the assertion templates that enforce authentication only, and indicates whether the token is inserted at the transport layer or SOAP header.
Table 18-1 Authentication Only Assertion Templates
| Client Template | Service Template | Authentication Transport | Authentication SOAP | Authentication REST | Message Protection Transport | Message Protection SOAP |
|---|---|---|---|---|---|---|
|
N/A |
No |
No |
Yes |
No |
No |
|
|
No |
No |
Yes |
Yes |
No |
||
|
No |
No |
Yes |
Yes |
No |
||
|
Yes |
No |
No |
No |
No |
||
|
No |
Yes |
No |
No |
No |
||
|
No |
Yes |
No |
No |
No |
||
|
No |
Yes |
No |
No |
No |
||
|
No |
Yes |
No |
No |
No |
Display Name: Http OAM Service Assertion Template
Category: Security
Type: http-oam-security
The http_oam_token_service_template assertion template verifies that OAM agent has authenticated the user and has established an identity. This policy can be applied to any HTTP-based endpoint.
Table 18-2 lists the settings for the http_oam_token_service_template assertion template.
Table 18-2 http_oam_token_service_template Settings
| Name | Default Value |
|---|---|
|
Authentication Header |
|
|
|
|
|
None |
Table 18-3 lists the default configuration properties and the default settings for the http_oam_token_service_template assertion template.
Display Name: Http Saml Bearer V2.0 Token Client Assertion Template
Category: Security
Type: http-saml20-bearer-security
The http_saml20_token_bearer_client_template assertion template includes SAML 2.0 tokens in outbound SOAP request messages. The SAML token with confirmation method [Bearer] is created automatically.
Table 18-4 lists the settings for the http_saml20_token_bearer_client_template assertion template.
Table 18-4 http_saml20_token_bearer_client_template Settings
| Name | Default Value |
|---|---|
|
Authentication Header |
|
|
|
|
|
None |
Table 18-5 lists the configuration properties and the default settings for the http_saml20_token_bearer_client_template assertion template.
Display Name: Http Saml Bearer V2.0 Token Service Assertion Template
Category: Security
Type: http-saml20-bearer-security
The http_saml20_token_bearer_service_template assertion template authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header.
The settings for the http_saml20_token_bearer_service_template assertion template are identical to the client version of the assertion template. See Table 18-4 for information about the settings.
Table 18-45 lists the configuration properties and the default settings for the http_saml20_token_bearer_service_template assertion template.
Display Name: SPNEGO Token Client Assertion Template
Category: Security
Type: http-spnego-security
The http_spnego_token_client_template assertion template provides authentication using a Kerberos token and the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) protocol.
Table 18-7 lists the settings for the http_spnego_token_client_template assertion template.
Table 18-7 http_spnego_token_client_template Settings
| Name | Default Value |
|---|---|
|
Authentication Header |
|
|
|
|
|
None |
Table 18-8 lists the configuration properties and the default settings for the http_spnego_token_client_template assertion template.
Display Name: SPNEGO Token Service Assertion Template
Category: Security
Type: http-spnego-security
The http_spnego_token_service_template assertion template provides authentication using a Kerberos token and the SPNEGO protocol.
The settings for the http_spnego_token_service_template assertion template are identical to the client version of the assertion template. See Table 18-7 for information about the settings.
Table 18-9 lists the configuration properties and the default settings for the http_spnego_token_service_template assertion template.
Display Name: Wss HTTP Token client Assertion Template
Category: Security
Type: http-security
The wss_http_token_client_template assertion template includes username and password credentials in the HTTP header. You can control whether one-way or two-way authentication is required.
Table 18-10 lists the settings for the wss_http_token_client_template assertion template.
Table 18-10 wss_http_token_client_template Settings
| Name | Default Value |
|---|---|
|
Authentication Header |
|
|
|
|
|
None |
|
|
Transport Layer Security |
|
|
Disabled |
|
|
Disabled |
|
|
Disabled |
Table 18-11 lists the configuration properties and the default settings for the wss_http_token_client_template assertion template.
Display Name: Wss HTTP Token service Assertion Template
Category: Security
Type: http-security
The wss_http_token_service_template assertion template uses the credentials in the HTTP header to authenticate users against the Oracle Platform Security Services identity store. You can control whether one-way or two-way authentication is required.
The settings for the wss_http_token_service_template are identical to those for the client version of the assertion template. See Table 18-10 for information about the settings.
Table 18-12 lists the configuration properties and the default settings for the wss_http_token_service_template assertion template.
Display Name: Wss Username Token client Assertion Template
Category: Security
Type: wss-username-token
The wss_username_token_client_template assertion template includes authentication with username and password credentials in the WS-Security UsernameToken header. The assertion supports three types of password credentials: plain text, digest, and no password.
Note:
If you do not use a digest password, policies created using this template are not secure. You should use this assertion with plain text or no password in low security situations only, or when you know that the transport is protected using some other mechanism. Alternatively, consider using the SSL version of this assertion, "oracle/wss_username_token_over_ssl_client_template".To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token.
Table 18-13 lists the settings for the wss_username_token_client_template assertion template.
Table 18-13 wss_username_token_client_template Settings
| Name | Default Value |
|---|---|
|
Username Token |
|
|
|
|
|
Disabled |
|
|
Disabled |
Table 18-14 lists the configuration properties and the default settings for the wss_username_token_client_template assertion template.
Display Name: Wss Username Token service Assertion Template
Category: Security
Type: wss-username-token
The wss_username_token_service_template assertion template enforces authentication with username and password credentials in the WS-Security UsernameToken SOAP header. The assertion supports three types of password credentials: plain text, digest, and no password.
Note:
If you do not use a digest password, policies created using this template are not secure. You should use this assertion with plain text or no password in low security situations only, or when you know that the transport is protected using some other mechanism. Alternatively, consider using the SSL version of this assertion, "oracle/wss_username_token_over_ssl_service_template".To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token.
The settings for the wss_username_token_service_template are identical to the client version of the assertion template. See Table 18-13 for information about the settings.
Table 18-15 lists the configuration properties and the default settings for the wss_username_token_service_template assertion template.
Display Name: Wss10 SAML Token client Assertion Template
Category: Security
Type: wss10-saml-token
The wss10_saml_token_client_template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token is created automatically.
Table 18-16 lists the settings for the wss10_saml_token_client_template assertion template.
Table 18-16 wss10_saml_token_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
unspecified |
Table 18-17 lists the configuration properties and the default settings for the wss10_saml_token_client_template assertion template.
Display Name: Wss10 SAML Token service Assertion Template
Category: Security
Type: wss10-saml-token
The wss10_saml_token_service_template assertion template authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header.
The settings for the wss10_saml_token_service_template are identical to the client version of the assertion. See Table 18-16 for information about the settings.
Table 18-18 lists the configuration properties and the default settings for the wss10_saml_token_service_template assertion template.
Display Name: Wss10 SAML V2.0 Token client Assertion Template
Category: Security
Type: wss10-saml-token
The wss10_saml20_token_client_template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token is created automatically.
Table 18-19 lists the settings for the wss10_saml20_token_client_template assertion template.
Table 18-19 wss10_saml20_token_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
unspecified |
Table 18-20 lists the configuration properties and the default settings for the wss10_saml20_token_client_template assertion template. For details about the configuration property settings, see "Editing the Configuration Properties in an Assertion Template".
For information about overriding policies, see "Overview of Policy Configuration Overrides".
Display Name: Wss10 SAML V2.0 Token service Assertion Template
Category: Security
Type: wss10-saml-token
The wss10_saml20_token_service_template assertion template authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header.
The settings for the wss10_saml20_token_service_template are similar to the client version of the assertion template. See Table 18-19 for information about the settings.
Table 18-21 lists the configuration properties and the default settings for the wss10_saml20_token_service_template assertion template. For details about the configuration property settings, see "Editing the Configuration Properties in an Assertion Template".
For information about overriding policies, see "Overview of Policy Configuration Overrides".
Display Name: Wss11 Kerberos Token client Assertion Template
Category: Security
Type: kerberos-security
The wss11_kerberos_token_client_template assertion template includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard.
Table 18-22 lists the settings for the wss11_kerberos_token_client_template assertion template.
Table 18-22 wss11_kerberos_token_client_template Settings
| Name | Default Value |
|---|---|
|
Kerberos Token Type |
|
|
|
|
|
Disabled |
Table 18-23 lists the configuration properties and the default settings for the wss11_kerberos_token_client_template assertion template.
Display Name: Wss11 Kerberos Token service Assertion Template
Category: Security
Type: kerberos-security
The wss11_kerberos_token_service_template assertion template enforces in accordance with the WS-Security Kerberos Token Profile v1.1 standard. It extracts the Kerberos token from the SOAP header and authenticates the user. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
The settings for the wss11_keberos_token_service_template are identical to the client version of the assertion template. See Table 18-22 for information about the settings.
Table 18-24 lists the configuration properties and the default settings for the wss11_kerberos_token_service_template assertion template.
Table 18-25 summarizes the assertion templates that enforce message protection only, and indicates whether the token is inserted at the transport layer or SOAP header.
Table 18-25 Message-Protection Only Assertion Templates
| Client Template | Service Template | Authentication Transport | Authentication SOAP | Message Protection Transport | Message Protection SOAP |
|---|---|---|---|---|---|
|
No |
No |
No |
Yes |
||
|
No |
No |
No |
Yes |
Display Name: Wss10 Message Protection client Assertion Template
Category: Security
Type: wss10-anonymous-with-certificates
The wss10_message_protection_client_template assertion template provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
Table 18-26 lists the settings for the wss10_message_protection_client_template assertion template.
Table 18-26 wss10_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation versions 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-27 lists the configuration properties and the default settings for the wss10_message_protection_client_template assertion template.
Display Name: Wss10 Message Protection service Assertion Template
Category: Security
Type: wss10-anonymous-with-certificates
The wss10_message_protection_service_template assertion template provides message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The settings for the wss10_message_protection_service_template are identical to the client version of the assertion template. See Table 18-26 for information about the settings.
Table 18-28 lists the configuration properties and the default settings for the wss10_message_protection_service_template assertion template.
Display Name: Wss11 Message Protection client Assertion Template
Category: Security
Type: wss11-anonymous-with-certificates
The wss11_message_protection_client_template assertion template provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
Table 18-29 lists the settings for the wss11_message_protection_client_template assertion template.
Table 18-29 wss11_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
X509 Token |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-30 lists the configuration properties and the default settings for the wss11_message_protection_client_template assertion template.
Display Name: Wss11 Message Protection service Assertion Template
Category: Security
Type: wss11-anonymous-with-certificates
The wss11_message_protection_service_template assertion template enforces message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
The settings for the wss11_message_protection_service_template are identical to the client version of the assertion template. See Table 18-29 for information about the settings.
Table 18-31 lists the configuration properties and the default settings for the wss11_message_protection_service_template assertion template.
Table 18-32 summarizes the assertion templates that enforce both message protection and authentication, and indicates whether the token is inserted at the transport layer or SOAP header.
Table 18-32 Message Protection and Authentication Assertion Templates
Display Name: Wss HTTP Token Over SSL client Assertion Template
Category: Security
Type: http-security
The wss_http_token_over_ssl_client_template assertion template includes credentials in the HTTP header for outbound client requests and authenticates users against the Oracle Platform Security Services identity store. This policy verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be applied to any HTTP-based client.
Table 18-33 lists the settings for the wss_http_token_over_ssl_client_template assertion template.
Table 18-33 wss_http_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
Authentication Header |
|
|
|
|
|
None |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
|
Table 18-34 lists the configuration properties and the default settings for the wss_http_token_over_ssl_client_template assertion template.
Display Name: Wss HTTP Token Over SSL service Assertion Template
Category: Security
Type: http-security
The wss_http_token_over_ssl_service_template assertion template extracts the credentials in the HTTP header and authenticates users against the Oracle Platform Security Services identity store.
The settings for the wss_http_token_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-33 for information about the settings.
Table 18-35 lists the configuration properties and the default settings for the wss_http_token_service_template assertion template.
Display Name: Wss SAML Bearer Token client Assertion Template
Category: Security
Type: wss10-saml-token
The wss_saml_token_bearer_client_template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method [Bearer] is created automatically.
Table 18-36 lists the settings for the wss_saml_token_bearer_client_template assertion template.
Table 18-36 wss_saml_token_bearer_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
unspecified |
Table 18-41 lists the configuration properties and the default settings for the wss_saml_token_bearer_client_template assertion template.
Display Name: Wss SAML Bearer Token service Assertion Template
Category: Security
Type: wss10-saml-token
The wss_saml_token_bearer_service_template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method [Bearer] is created automatically.
Table 18-36 lists the settings for the wss_saml_token_bearer_service_template assertion template.
Table 18-38 wss_saml_token_bearer_service_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
unspecified |
Table 18-41 lists the configuration properties and the default settings for the wss_saml_token_bearer_service_template assertion template.
Display Name: Wss SAML Token (Confirmation method as bearer) Over SSL client Assertion Template
Category: Security
Type: wss-saml-token-bearer-over-ssl
The wss_saml_token_bearer_over_ssl_client template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method [Bearer] is created automatically.
Table 18-40 lists the settings for the wss_saml_token_bearer_over_ssl_client_template assertion template.
Table 18-40 wss_saml_token_bearer_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
unspecified |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-41 lists the configuration properties and the default settings for the wss_saml_token_bearer_over_ssl_client_template assertion template.
Table 18-41 wss_saml_token_bearer_over_ssl_client_template Configuration Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
Display Name: Wss SAML Token (Confirmation method as bearer) Over SSL service Assertion Template
Category: Security
Type: wss-saml-token-bearer-over-ssl
The wss_saml_token_bearer_over_ssl_service_template assertion template authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header.
The settings for the wss_saml_token_bearer_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-40 for information about the settings.
Table 18-42 lists the configuration properties and the default settings for the wss_saml_token_bearer_over_ssl_service_template assertion template.
Display Name: Wss SAML V2.0 Token (Confirmation method as bearer) Over SSL client Assertion Template
Category: Security
Type: wss-saml-token-bearer-over-ssl
The wss_saml20_token_bearer_over_ssl_client template assertion template includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method [Bearer] is created automatically.
Table 18-43 lists the settings for the wss_saml20_token_bearer_over_ssl_client_template assertion template.
Table 18-43 wss_saml20_token_bearer_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
unspecified |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-44 lists the configuration properties and the default settings for the wss_saml20_token_bearer_over_ssl_client_template assertion template.
Display Name: Wss SAML V2.0 Token (Confirmation method as bearer) Over SSL service Assertion Template
Category: Security
Type: wss-saml-token-bearer-over-ssl
The wss_saml20_token_bearer_over_ssl_service_template assertion template authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header.
The settings for the wss_saml20_token_bearer_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-43 for information about the settings.
Table 18-45 lists the configuration properties and the default settings for the wss_saml20_token_bearer_over_ssl_service_template assertion template.
Display Name: Wss SAML Token Over SSL client Assertion Template
Category: Security
Type: wss-saml-token-over-ssl
The wss_saml_token_over_ssl_client_template assertion template enables the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
Table 18-46 lists the settings for the wss_saml_token_over_ssl_client_template assertion template.
Table 18-46 wss_saml_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
|
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-47 lists the configuration properties and the default settings for the wss_saml_token_over_ssl_client_template assertion template.
Display Name: Wss SAML Token Over SSL service Assertion Template
Category: Security
Type: wss-saml-token-over-ssl
The wss_saml_token_over_ssl_service_template enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
The settings for the wss_saml_token_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-46 for information about the settings.
Table 18-48 lists the configuration properties and the default settings for the wss_saml_token_over_ssl_service_template assertion template.
Display Name: Wss SAML V2.0 Token Over SSL client Assertion Template
Category: Security
Type: wss-saml-token-over-ssl
The wss_saml20_token_over_ssl_client_template assertion template enables the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
Table 18-49 lists the settings for the wss_saml20_token_over_ssl_client_template assertion template.
Table 18-49 wss_saml20_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-50 lists the configuration properties and the default settings for the wss_saml20_token_over_ssl_client_template assertion template.
Display Name: Wss SAML V2.0 Token Over SSL service Assertion Template
Category: Security
Type: wss-saml-token-over-ssl
The wss_saml20_token_over_ssl_service_template enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
The settings for the wss_saml20_token_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-49 for information about the settings.
Table 18-51 lists the configuration properties and the default settings for the wss_saml20_token_over_ssl_service_template assertion template.
Display Name: Wss Username Token Over SSL client Assertion Template
Category: Security
Type: wss-username-token-over-ssl
The wss_username_token_over_ssl_client_template assertion template includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages. The assertion supports three types of password credentials: plain text, digest, and no password.
To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token.
Table 18-52 lists the settings for the wss_username_token_over_ssl_client_template assertion template.
Table 18-52 wss_username_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
Username Token |
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-53 lists the configuration properties and the default settings for the wss_username_token_over_ssl_client_template assertion template.
Display Name: Wss Username Token Over SSL service Assertion Template
Category: Security
Type: wss-username-token-over-ssl
The wss_username_token_over_ssl_service_template assertion template uses the credentials in the UsernameToken WS-Security SOAP header to authenticate users against the Oracle Platform Security Services configured identity store. The assertion supports three types of password credentials: plain text, digest, and no password.
To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token.
The settings for the wss_username_token_over_ssl_service_template assertion template are identical to the client version of the assertion template. See Table 18-52 for information about the settings.
Table 18-54 lists the configuration properties and the default settings for the wss_username_token_over_ssl_service_template assertion template.
Display Name: Wss10 SAML Holder-Of-Key Token with Message Protection client Assertion Template
Category: Security
Type: wss10-saml-hok-with-certificates
The wss10_saml_hok_token_with_message_protection_client_template assertion template provides message protection (integrity and confidentiality) and SAML holder of key based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard.
Table 18-55 lists the settings for the wss10_saml_hok_token_with_message_protection_client_template assertion template.
Table 18-55 wss10_saml_hok_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-56 lists the configuration properties and the default settings for the wss10_saml_hok_token_with_message_protection_client_template assertion template.
Display Name: Wss10 SAML Holder-Of-Key Token with Message Protection service Assertion Template
Category: Security
Type: wss10-saml-hok-with-certificates
The wss10_saml_hok_token_with_message_protection_service_template assertion template enforces message-level protection and SAML holder of key based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The settings for the wss10_saml_hok_token_with_message_protection_service_template are identical to those for the client version of the assertion template. See Table 18-55 for information about the settings.
Table 18-57 lists the configuration properties and the default settings for the wss10_saml_hok_token_with_message_protection_service_template assertion template.
Display Name: Wss10 SAML Token with Message Protection client Assertion Template
Category: Security
Type: wss10-saml-with-certificates
The wss10_saml_token_with_message_protection_client_template assertion template provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard.
The web service consumer includes a SAML token in the SOAP header, and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
Table 18-58 lists the settings for the wss10_saml_token_with_message_protection_client_template assertion template.
Table 18-58 wss10_saml_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-59 lists the configuration properties and the default settings for the wss10_saml_token_with_message_protection_client_template assertion template.
Table 18-59 wss10_saml_token_with_message_protection_client_template Configuration Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
|
Required |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
Display Name: Wss10 SAML Token with Message Protection service Assertion Template
Category: Security
Type: wss10-saml-with-certificates
The wss10_saml_token_with_message_protection_service_template assertion template enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The web service consumer includes a SAML token in the SOAP header, and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The settings for the wss10_saml_token_with_message_protection_service_template are identical to those for client version of the assertion template. See Table 18-58 for information about the settings.
Table 18-60 lists the configuration properties and the default settings for the wss10_saml_token_with_message_protection_service_template assertion template.
Display Name: Wss10 SAML V2.0 Token with Message Protection client Assertion Template
Category: Security
Type: wss10-saml-with-certificates
The wss10_saml20_token_with_message_protection_client_template assertion template provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard.
The web service consumer includes a SAML token in the SOAP header, and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
Table 18-61 lists the settings for the wss10_saml20_token_with_message_protection_client_template assertion template.
Table 18-61 wss10_saml20_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-62 lists the configuration properties and the default settings for the wss10_saml20_token_with_message_protection_client_template assertion template.
Table 18-62 wss10_saml20_token_with_message_protection_client_template Configuration Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
|
Required |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
Display Name: Wss10 SAML V2.0 Token with Message Protection service Assertion Template
Category: Security
Type: wss10-saml-with-certificates
The wss10_saml20_token_with_message_protection_service_template assertion template enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The web service consumer includes a SAML token in the SOAP header, and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The settings for the wss10_saml20_token_with_message_protection_service_template are similar to those of the client version of the assertion template. See Table 18-61 for information about the settings.
Table 18-63 lists the configuration properties and the default settings for the wss10_saml20_token_with_message_protection_service_template assertion template.
Display Name: Wss10 Username Token with Message Protection client Assertion Template
Category: Security
Type: wss10-username-with-certificates
The wss10_username_token_with_message_protection_client_template assertion template provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Credentials are included in the WS-Security UsernameToken header in the outbound SOAP message.
The assertion supports three types of password credentials: plain text, digest, and no password.
To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
Table 18-64 lists the settings for the wss10_username_token_with_message_protection_client_template assertion template.
Table 18-64 wss10_username_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
Username Token |
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-65 lists the configuration properties and the default settings for the wss10_username_token_with_message_protection_client_template assertion template.
Display Name: Wss10 Username Token with Message Protection service Assertion Template
Category: Security
Type: wss10-username-with-certificates
The wss10_username_token_with_message_protection_service_template assertion template enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The assertion supports three types of password credentials: plain text, digest, and no password.
To protect against replay attacks, the assertion provides the option to require nonce or creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
The settings for the wss10_username_token_with_message_protection_service_template assertion template are identical to the client version of the assertion template. See Table 18-64 for information about the settings.
Table 18-66 lists the configuration properties and the default settings for the wss10_username_token_with_message_protection_service_template assertion template.
Display Name: Wss10 X509 Token with Message Protection client Assertion Template
Category: Security
Type: wss10-mutual-auth-with-certificates
The wss10_x509_token_with_message_protection_client template assertion template provides message protection (integrity and confidentiality) and certificate credential population for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
Table 18-67 lists the settings for the wss10_x509_token_with_message_protection_client template assertion template.
Table 18-67 wss10_x509_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
X509 Token |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-68 lists the configuration properties and the default settings for the wss10_x509_token_with_message_protection_client_template assertion template.
Display Name: Wss10 X509 Token with Message Protection service Assertion Template
Category: Security
Type: wss10-mutual-auth-with-certificates
The wss10_x509_token_with_message_protection_service_template assertion template enforces message protection (integrity and confidentiality) and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The settings for the wss10_x509_token_with_message_protection_service_template assertion template are identical to the client version of the assertion template. See Table 18-67 for information about the settings.
Table 18-69 lists the configuration properties and the default settings for the wss10_x509_token_with_message_protection_service_template assertion template.
Display Name: Wss11 Kerberos Token Over SSL Client Assertion Template
Category: Security
Type: wss11-kerberos-over-ssl-security
The wss11_kerberos_token_over_ssl_client_template assertion template includes a Kerberos token in the WS-Security SOAP header in accordance with the WS-Security Kerberos Token Profile v1.1 standard. The Kerberos token is advertised as an EndorsingSupportingToken, and is used only for authentication and for signing the timestamp. Message protection is provided by SSL.
Table 18-70 lists the settings for the wss11_kerberos_token_over_ssl_client_template assertion template.
Table 18-70 wss11_kerberos_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
Kerberos Token Type |
|
|
|
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
|
|
|
Table 18-71 lists the configuration properties and the default settings for the wss11_kerberos_token_over_ssl_client_template assertion template.
Display Name: Wss11 Kerberos Token Over SSL Service Assertion Template
Category: Security
Type: wss11-kerberos-over-ssl-security
The wss11_kerberos_token_service_template assertion template enforces in accordance with the WS-Security Kerberos Token Profile v1.1 standard. It extracts the Kerberos token from the SOAP header and authenticates the user. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services. The Kerberos token is advertised as an EndorsingSupportingToken, and is used only for authentication and for signing the timestamp. Message protection is provided by SSL.
The settings for the wss11_kerberos_token_over_ssl_service_template are identical to the client version of the assertion template. See Table 18-70 for information about the settings.
Table 18-72 lists the configuration properties and the default settings for the wss11_kerberos_token_over_ssl_service_template assertion template.
Display Name: Wss11 Kerberos Token with message protection client Assertion Template
Category: Security
Type: kerberos-security
The wss11_kerberos_token_with_message_protection_client_template assertion template includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard.
Table 18-73 lists the settings for the wss11_kerberos_token_with_message_protection_client_template assertion template.
Table 18-73 wss11_kerberos_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
Kerberos Token Type |
|
|
|
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-74 lists the configuration properties and the default settings for the wss11_kerberos_token_with_message_protection_client_template assertion template.
Display Name: Wss11 Kerberos Token service with message protection Assertion Template
Category: Security
Type: kerberos-security
The wss11_kerberos_token_with_message_protection_service_template assertion template enforces in accordance with the WS-Security Kerberos Token Profile v1.1 standard. It extracts the Kerberos token from the SOAP header and authenticates the user. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
The settings for the wss11_keberos_token_with_message_protection_service_template are identical to the client version of the assertion template. See Table 18-73 for information about the settings.
Table 18-75 lists the configuration properties and the default settings for the wss11_kerberos_token_with_message_protection_service_template assertion template.
Display Name: Wss11 SAML Token with Message Protection client Assertion Template
Category: Security
Type: wss11-saml-with-certificates
The wss11_saml_token_with_message_protection_client_template assertion template enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests in accordance with WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
Table 18-76 lists the settings for the wss11_saml_token_with_message_protection_client_template assertion template.
Table 18-76 wss11_saml_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
X509 Token |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-77 lists the configuration properties and the default settings for the wss11_saml_token_with_message_protection_client_template assertion template.
Table 18-77 wss11_saml_token_with_message_protection_client_template Configuration Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Constant |
|
|
|
Required |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
Display Name: Wss11 SAML Token with Message Protection service Assertion Template
Category: Security
Type: wss11-saml-with-certificates
The wss11_saml_token_with_message_protection_service_template assertion template enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
The settings for the wss11_saml_token_with_message_protection_service_template are identical to the client version of the assertion template. See Table 18-76 for information about the settings.
Table 18-78 lists the configuration properties and the default settings for the wss11_saml_token__with_message_protection_service_template assertion template.
Display Name: Wss11 SAML V2.0 Token with Message Protection client Assertion Template
Category: Security
Type: wss11-saml-with-certificates
The wss11_saml20_token_with_message_protection_client_template assertion template enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests in accordance with WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
Table 18-79 lists the settings for the wss11_saml20_token_with_message_protection_client_template assertion template.
Table 18-79 wss11_saml20_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
SAML Token Type |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
unspecified |
|
|
X509 Token |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-80 lists the configuration properties and the default settings for the wss11_saml20_token_with_message_protection_client_template assertion template.
Table 18-80 wss11_saml20_token_with_message_protection_client_template Configuration Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Constant |
|
|
|
Required |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
Display Name: Wss11 SAML V2.0 Token with Message Protection service Assertion Template
Category: Security
Type: wss11-saml-with-certificates
The wss11_saml20_token_with_message_protection_service_template assertion template enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
The settings for the wss11_saml_token_with_message_protection_service_template are similar to the client version of the assertion template. See Table 18-79 for information about the settings.
Table 18-81 lists the configuration properties and the default settings for the wss11_saml20_token__with_message_protection_service_template assertion template.
Display Name: Wss11 Username Token with Message Protection client Assertion Template
Category: Security
Type: wss11-username-with-certificates
The ws11_username_token_with_message_protection_client_template assertion template includes authentication and message protection in accordance with the WS-Security v1.1 standard.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
Table 18-82 lists the settings for the wss11_username_token_with_message_protection_client_template assertion template.
Table 18-82 wss11_username_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
Username Token |
|
|
|
|
|
Disabled |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
X509 Token |
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-83 lists the configuration properties and the default settings for the wss11_username_token_with_message_protection_client_template assertion template.
Display Name: Wss11 Username Token with Message Protection service Assertion Template
Category: Security
Type: wss11-username-with-certificates
The ws11_username_token_with_message_protection_service_template assertion template enforces authentication and message protection in accordance with the WS-Security v1.1 standard.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature. To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
The settings for the wss11_username_token_with_message_protection_service_template are identical to the client version of the assertion template. See Table 18-82 for information about the settings.
Table 18-84 lists the configuration properties and the default settings for the wss11_username_token_with_message_protection_service_template assertion template.
Display Name: Wss11 X509 Token with Message Protection client Assertion Template
Category: Security
Type: wss11-mutual-auth-with-certificates
The wss11_x509_token_with_message_protection_client_template assertion template provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Credentials are included in the WS-Security binary security token of the SOAP message.
Table 18-85 lists the settings for the wss11_x509_token_with_message_protection_client_template assertion template.
Table 18-85 wss11_x509_token_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
X509 Token |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-86 lists the configuration properties and the default settings for the wss11_x509_token_with_message_protection_client_template assertion template.
Display Name: Wss11 X509 Token with Message Protection service Assertion Template
Category: Security
Type: wss11-mutual-auth-with-certificates
The wss11_x509_token_with_message_protection_service_template assertion template enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. The certificate is extracted from the WS-Security binary security token header, and the credentials in the certificate are validated against the Oracle Platform Security Services identity store.
The settings for the wss11_x509_token_with_message_protection_service_template are identical to the client version of the assertion template. See Table 18-85 for information about the settings.
Table 18-87 lists the configuration properties and the default settings for the wss11_x509_token_with_message_protection_service_template assertion template.
Table 18-88 summarizes the assertion templates that are used for OES integration.
Table 18-88 OES Integration Templates
| Service Template | Description |
|---|---|
|
Sets authorization based on the policy defined in Oracle Entitlements Server (OES). |
|
|
Does response masking based on a policy defined in Oracle Entitlements Server (OES). |
|
|
Sets authorization based on the policy defined in Oracle Entitlements Server (OES). This template is used for fine-grained authorization on SCA component. |
Display Name: Binding OES Authorization Assertion Template
Category: Security
Type: oes-authorization
The binding_oes_authorization_template assertion template sets authorization based on the policy defined in Oracle Entitlements Server (OES). Authorization is based on attributes, the current authenticated subject, and the web service action invoked by the client. This template is used for fine-grained authorization on any operation on a web service. Policies based on this template should follow an authentication policy where the subject is established. Policies based on this template can be attached to any SOAP endpoint.
Table 18-89 lists the settings for the binding_oes_authorization_template assertion template.
Table 18-89 binding_oes_authorization_template Settings
| Name | Default Value |
|---|---|
|
OES Based Authorization |
|
|
Guard (see Permissions) |
|
|
* |
|
|
None |
|
|
* |
Table 18-90 lists the configuration properties and the default settings for the binding_oes_authorization_template assertion template.
Display Name: Response masking using Oracle Entitlements Server.
Category: Security
Type: oes-masking
The binding_oes_masking_template assertion template does response masking based on the policy defined in OES. Masking is based on attributes, the current authenticated subject, and the web service action invoked by the client. This template is used for fine-grained masking on any operation of a web service.
Table 18-89 lists the settings for the binding_oes_masking_template assertion template.
Table 18-90 lists the configuration properties and the default settings for the binding_oes_masking_template assertion template.
Display Name: Component OES Authorization Assertion Template
Category: Security
Type: oes-authorization
The component_oes_authorization_template assertion template does user authorization based on a policy defined in Oracle Entitlements Server (OES). Authorization is based on attributes, the current authenticated subject and the web service action invoked by the client. This template is used for fine-grained authorization on a SCA component.
Table 18-89 lists the settings for the component_oes_authorization_template assertion template.
Table 18-90 lists the configuration properties and the default settings for the component_oes_authorization_template assertion template.
Table 18-91 summarizes the assertion template that is used for PII security.
Table 18-91 Pii Assertion Template
| Template | Description |
|---|---|
|
Provides simple role-based authorization for the request based on the authenticated subject at the SOAP binding level. |
Display Name: PII Security Assertion Template
Category: Security
Type: pii-security
The pii_security_template assertion template secures personally identifiable information (PII) using encryption. PIIs are identified by XPath configuration.
Note:
This assertion template applies to SOA and JCA adapters only.Table 18-92 lists the settings for the pii_security_template assertion template.
Table 18-92 pii_security_template Settings
| Name | Default Value |
|---|---|
|
PII Security |
|
|
|
|
|
pii-security |
|
|
1000 |
|
|
128 |
|
|
|
Table 18-93 lists the configuration properties and the default settings for the pii_security_template assertion template.
Table 18-94 summarizes the WS-Trust assertion templates.
In this release, you can use Fusion Middleware Control to directly edit the assertion template text, but the Settings and Configuration pages are not available.
Table 18-94 WS-Trust Assertion Templates
| Name | Description |
|---|---|
|
STS configuration information assertion template that is used to invoke STS for token exchange. |
|
|
STS configuration information assertion template that is used to invoke STS for token exchange. |
|
|
oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template |
SOAP binding-level client assertion template for issued token SAML authentication (confirmation method bearer), with SSL message protection. |
|
oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template |
SOAP binding-level service assertion template for issued token SAML authentication (confirmation method bearer), with SSL message protection. |
|
oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template |
WS-Security 1.1 issued token SAML HOK token with certificates client assertion template. Provides authentication and message protection using Basic128. |
|
oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template |
WS-Security 1.1 issued token SAML HOK token with certificates service assertion template. Provides authentication and message protection using Basic128. |
|
oracle/wss11_sts_issued_saml_with_message_protection_client_template |
WS-Security 1.1 issued token SAML sender voucher with certificates. Provides authentication and message protection using Basic128. |
Display Name: Trust Configuration Client Assertion Template
Category: Security
Type: sts-trust-config
STS Configuration information, provided on the client side, that is used to invoke STS for token exchange.
Table 18-95 lists the settings for the oracle/sts_trust_config_client_template assertion template.
Table 18-95 oracle/sts_trust_config_client_template Settings
| Name | Default Value |
|---|---|
|
STS Configuration |
|
|
Yes |
|
|
http://host:port/sts?wsdl |
|
|
None |
|
|
Service |
None |
|
Port |
None |
|
target-namespace#wsdl.endpoint(service-name/port-name) |
|
|
None |
|
|
sts-csf-key |
Table 18-96 lists the configuration properties and the default settings for the oracle/sts_trust_config_client_template assertion template.
Display Name: Trust Configuration Service Assertion Template
Category: Security
Type: sts-trust-config
Minimal STS Configuration information, provided on the service side, that is used to obtain all other STS information and invoke STS for token exchange.
Table 18-97 lists the settings for the oracle/sts_trust_config_service_template assertion template.
Table 18-97 oracle/sts_trust_config_service_template Settings
| Name | Default Value |
|---|---|
|
STS Configuration |
|
|
Yes |
|
|
|
|
|
|
Table 18-98 lists the configuration properties and the default settings for the oracle/sts_trust_config_service_template assertion template.
Display Name: Wss Issued Saml Bearer Token with Message Protection Client Assertion Template
Category: Security
Type: wss-sts-issued-token-over-ssl
SOAP binding level policy for Issued Token SAML authentication (confirmation method as bearer) with SSL Message Protection.
Table 18-99 lists the settings for the oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template assertion template.
Table 18-99 oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template Settings
| Name | Default Value |
|---|---|
|
Issued Token |
|
|
|
|
|
|
|
|
None |
|
|
Disabled |
|
|
Transport Layer Security |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
|
|
|
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Disabled |
|
|
Enabled |
Table 18-100 lists the configuration properties and the default settings for the oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template assertion template.
Table 18-100 oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Required |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
Display Name: Wss Issued Saml Bearer Token with Message Protection Service Assertion Template
Category: Security
Type: wss-sts-issued-token-over-ssl
SOAP binding level policy for Issued Token SAML authentication (confirmation method as bearer) With SSL Message Protection.
The settings for the oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template are identical to the client version of the assertion template. See Table 18-99 for information about the settings.
Table 18-101 lists the configuration properties and the default settings for the oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template assertion template.
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Client Assertion Template
Category: Security
Type: wss11-sts-issued-token-with-certificates
WS-Security 1.1 Issued Token SAML HOK with Certificates. Provides Authenticates and Message Protection using Basic128.
Table 18-102 lists the settings for the wss11_sts_issued_saml_hok_with_message_protection_client_template assertion template.
Table 18-102 oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
Issued Token |
|
|
|
|
|
|
|
|
|
|
|
Disabled |
|
|
X509 Token |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-103 lists the configuration properties and the default settings for the wss11_sts_issued_saml_hok_with_message_protection_client_template assertion template.
Table 18-103 oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
enc-csf-key |
Optional |
|
|
|
Required |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
|
Required |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Service Assertion Template
Category: Security
Type: wss11-sts-issued-token-with-certificates
WS-Security 1.1 Issued Token SAML HOK with Certificates. Provides Authenticates and Message Protection using Basic128.
Table 18-102 lists the settings for the wss11_sts_issued_saml_hok_with_message_protection_service_template assertion template.
Table 18-104 lists the configuration properties and the default settings for the wss11_sts_issued_saml_hok_with_message_protection_service_template assertion template.
Display Name: Wss11 Issued Token Saml Sender Voucher with Message Protection Client Assertion Template
Category: Security
Type: wss11-sts-issued-token-with-certificates
WS-Security 1.1 Issued Token SAML Sender Voucher with Certificates. Provides Authenticates and Message Protection using Basic128.
Table 18-105 lists the settings for the wss11_sts_issued_saml_with_message_protection_client_template assertion template.
Table 18-105 wss11_sts_issued_saml_with_message_protection_client_template Settings
| Name | Default Value |
|---|---|
|
Issued Token |
|
|
|
|
|
None |
|
|
|
|
|
Disabled |
|
|
X509 Token |
|
|
|
|
|
|
|
|
Enabled |
|
|
Disabled |
|
|
Disabled |
|
|
Secure Conversation |
|
|
Disabled |
|
|
1.3 or 1.4. OWSM WS-SC supports both Secure Conversation version 1.3 and 1.4. Although the policy displays the 1.3 version number, you use this policy for 1.4 as well. |
|
|
Disabled |
|
|
Enabled |
|
|
Enabled |
|
|
Enabled |
|
|
Inherit from Application Setting |
|
|
Message Security |
|
|
|
|
|
Enabled |
|
|
Enabled |
|
|
Disabled |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
|
|
See Table 18-117, "Request, Response, and Fault Message Signing and Encryption Settings" |
Table 18-106 lists the configuration properties and the default settings for the wss11_sts_issued_saml_with_message_protection_client_template assertion template.
Table 18-106 oracle/wss11_sts_issued_saml_with_message_protection_client_template Properties
| Name | Default Value | Type |
|---|---|---|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Required |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
|
|
|
Optional |
|
|
None |
Optional |
Table 18-107 summarizes assertion templates that are used for authorization. Each authorization assertion template must follow an authentication assertion template.
Table 18-107 Authorization Assertion Templates
| Service Template | Description |
|---|---|
|
Provides simple role-based authorization for the request based on the authenticated subject at the SOAP binding level. |
|
|
Provides simple permission-based authorization for the request based on the authenticated subject at the SOAP binding level. |
|
|
Provides simple role-based authorization for the request based on the authenticated subject at the SOA component level. |
|
|
Provides simple permission-based authorization for the request based on the authenticated subject at the SOA component level. |
Display Name: Binding Authorization Assertion Template
Category: Security
Type: binding-authorization
The binding_authorization_template assertion template provides simple role-based authorization for the request based on the authenticated subject at the SOAP binding level. It should follow an authentication assertion template.
Table 18-108 lists the settings for the binding_authorization_template assertion template.
Table 18-108 binding_authorization_template Settings
| Name | Default Value |
|---|---|
|
Authorization Permission |
|
|
Permissions—Action Match |
None |
|
Permissions—Constraint Match |
None |
|
Authorization Permission |
|
|
Guard (see Permissions) |
|
|
None |
|
|
None |
|
|
None |
|
|
Not Set |
Table 18-109 lists the configuration properties and the default settings for the binding_authorization_template assertion template.
Display Name: Binding Permission Based Authorization Assertion Template
Category: Security
Type: binding-permission-authorization
The binding_permission_authorization_template assertion provides simple permission-based authorization for the request based on the authenticated subject at the SOAP binding level. It should follow an authentication assertion.
Table 18-110 lists the settings for the binding_permission_authorization_template assertion template.
Table 18-110 binding_permission_authorization_template Settings
| Name | Default Value |
|---|---|
|
Authorization Permission |
|
|
Guard (see Permissions) |
|
|
* |
|
|
None |
|
|
* |
|
|
Check Permission |
|
|
None |
Table 18-111 lists the configuration properties and the default settings for the binding_permission_authorization_template assertion template.
Display Name: Component Authorization Assertion Template
Category: Security
Type: sca-component-authorization
The component_authorization_template assertion provides simple role-based authorization for the request based on the authenticated subject at the SOA component level. It should follow an authentication assertion.
Table 18-112 lists the settings for the component_authorization_template assertion template.
Table 18-112 component_authorization_template Settings
| Name | Default Value |
|---|---|
|
Authorization Permission |
|
|
Guard (see Permissions) |
|
|
None |
|
|
None |
|
|
None |
|
|
Not Set |
Table 18-113 lists the configuration properties and the default settings for the component_authorization_template assertion template.
Display Name: Component Permission Based Authorization Assertion Template
Category: Security
Type: sca-component-permission-authorization
The component_permission_authorization_template assertion template provides simple permission-based authorization for the request based on the authenticated subject at the SOA component level. It should follow an authentication assertion.
Note:
You should be careful when using permission-based policies with EJBs as the security permissions specified in system-jazn-data.xml will be relaxed beyond a single invocation of the service operation.Table 18-114 lists the settings for the component_permission_authorization_template assertion template.
Table 18-114 component_permission_authorization_template Settings
| Name | Default Value |
|---|---|
|
Authorization Permission |
|
|
Guard (see Permissions) |
|
|
* |
|
|
None |
|
|
None |
|
|
None |
Table 18-115 lists the configuration properties and the default settings for the component_permission_authorization_template assertion template.
Table 18-116 lists the algorithm suites that are supported for message protection. The algorithm suites enable you to control the cryptographic characteristics of the algorithms that are used when securing messages.
Note:
FIPS compliant algorithm suites are marked with an asterisk (*). See "Enabling FIPS Mode" in Administering Security for Oracle WebLogic Server for FIPS information.Table 18-116 Supported Algorithm Suites
| Algorithm Suite | Digest | Encryption | Symmetric Key Wrap | Asymmetric Key Wrap | Encrypted Key Derivation | Signature Key Derivation | Minimum Signature Key Length |
|---|---|---|---|---|---|---|---|
|
Basic256 |
Sha1 |
Aes256 |
KwAes256 |
KwRsaOaep |
PSha1L256 |
PSha1L192 |
256 |
|
Basic192 |
Sha1 |
Aes192 |
KwAes192 |
KwRsaOaep |
PSha1L192 |
PSha1L192 |
192 |
|
Basic128 |
Sha1 |
Aes128 |
KwAes128 |
KwRsaOaep |
PSha1L128 |
PSha1L128 |
128 |
|
TripleDes |
Sha1 |
TripleDes |
KwTripleDes |
KwRsaOaep |
PSha1L192 |
PSha1L192 |
192 |
|
Basic256Rsa15* |
Sha1 |
Aes256 |
KwAes256 |
KwRsa15 |
PSha1L256 |
PSha1L192 |
256 |
|
Basic192Rsa15* |
Sha1 |
Aes192 |
KwAes192 |
KwRsa15 |
PSha1L192 |
PSha1L192 |
192 |
|
Basic128Rsa15* |
Sha1 |
Aes128 |
KwAes128 |
KwRsa15 |
PSha1L128 |
PSha1L128 |
128 |
|
TripleDesRsa15* |
Sha1 |
TripleDes |
KwTripleDes |
KwRsa15 |
PSha1L192 |
PSha1L192 |
192 |
|
Basic256Sha256 |
Sha256 |
Aes256 |
KwAes256 |
KwRsaOaep |
PSha1L256 |
PSha1L192 |
256 |
|
Basic192Sha256 |
Sha256 |
Aes192 |
KwAes192 |
KwRsaOaep |
PSha1L192 |
PSha1L192 |
192 |
|
Basic128Sha256 |
Sha256 |
Aes128 |
KwAes128 |
KwRsaOaep |
PSha1L128 |
PSha1L128 |
128 |
|
TripleDesSha256 |
Sha256 |
TripleDes |
KwTripleDes |
KwRsaOaep |
PSha1L192 |
PSha1L192 |
192 |
|
Basic256Sha256Rsa15* |
Sha256 |
Aes256 |
KwAes256 |
KwRsa15 |
PSha1L256 |
PSha1L192 |
256 |
|
Basic192Sha256Rsa15* |
Sha256 |
Aes192 |
KwAes192 |
KwRsa15 |
PSha1L192 |
PSha1L192 |
192 |
|
Basic128Sha256Rsa15* |
Sha256 |
Aes128 |
KwAes128 |
KwRsa15 |
PSha1L128 |
PSha1L128 |
128 |
|
TripleDesSha256Rsa15* |
Sha256 |
TripleDes |
KwTripleDes |
KwRsa15 |
PSha1L192 |
PSha1L192 |
192 |
Table 18-117 lists the settings for the Request, Response, and Fault messages. You configure these settings for message signing and encryption.
Table 18-118 summarizes the management assertion templates.
Table 18-118 Management Assertion Templates
| Name | Description |
|---|---|
|
Provides a logging assertion template that can be attached to any binding or component. |
Display Name: Security Log Assertion Template
Category: Security
Type: Logging
The security_log_template assertion template provides a logging assertion template that can be attached to any binding or component.
Note:
It is recommended that the logging assertion be used for debugging and auditing purposes only.Table 18-119 lists the settings for the security_log_template assertion template.
Table 18-120 lists the configuration properties and the default settings for the security_log_template assertion template.