5 Overriding Policy Configuration Properties

5.4.1 Overriding Configuration Properties at the Domain Level (Defining the Default Value)

To override configuration properties at the domain level, you can change the default value of a configuration override property in a policy. When you attach the policy to a web service or client, any web service to which the policy is attached can use these values, or you can override the value when you attach the policy.

For example, you may want to use domain level configuration overrides for keystore configuration and authorization settings:

• The predefined OWSM message protection policies define a set of server-side override properties such as keystore.sig.csf.key and keystore.enc.csf.key. By default, these properties have a blank value. If you set (or then override) any of the server-side configuration properties, then the new values are used in the attached web service instead of the keystore passwords you configure as part of setting up the keystore for message protection, as described in "Configuring Keystores for Message Protection".

  If you do not set these properties and leave the default values, then the values you configure as part of setting up the keystore for message protection are used instead, as described in "Configuring Keystores for Message Protection".

• The predefined oracle/binding_permission_authorization_policy defines a set of server-side override properties: action and resource. If you set (or then override) these properties, the new values are used in the attached web service instead of the action and resource match patterns you configure as described in "Determining Authorization Permissions".

To set a value for a configuration property in a policy:

1. Navigate to the Web Services Policies page, as described in "Navigating to the WSM Policies Page".

2. From the WSM Policies page, select the cloned policy for which you want to set the default value and click Open.

3. Select the Assertions tab, then click Configuration.

4. In the Configuration page, enter the desired value in the Value field for the property.

5. Click OK.

6. Click Validate to validate the policy.

7. Click Save.

5.4.2 Overriding Configuration Properties for Directly Attached Service Policies Using Fusion Middleware Control

To override configuration properties for directly attached policies, attach the policy to the endpoint in the application, and then override the value for the desired property in the attached policy. Note that you do not have to clone a predefined policy to configure policy overrides at the application level because you are not changing the policy.

To override a configuration property for a directly attached policy using Fusion Middleware Control:

1. Attach the policy to the endpoint as described in "Attaching Policies Directly Using Fusion Middleware Control".

2. In the Directly Attached Policies table, select the policy that contains the property to be overwritten and click Override Policy Configuration.

3. Select Override Policy Configuration.

   The Security Configuration Details window is displayed, as shown in Figure 5-1. This figure shows the overridable properties for the oracle/wss10_message_protection_service_policy.

   Figure 5-1 Overriding a Policy Configuration Property

   
   Description of ''Figure 5-1 Overriding a Policy Configuration Property''
   
   

4. Enter the override value in the Value field for the property and click Apply.

   The property is overridden on a per-attachment basis.

For example, assume that you have not changed the value of the keystore.sig.csf.key property for the oracle/wss10_message_protection_service_policy and that it is still blank. If web service A attaches the oracle/wss10_message_protection_service_policy and overrides the keystore.sig.csf.key property to be "sigkey," the keystore.sig.csf.key property has a value of "sigkey" only for the oracle/wss10_message_protection_service_policy attached to web service A.

For all other policies, keystore.sig.csf.key uses the value you configure as part of setting up the keystore for message protection, as described in "Configuring Keystores for Message Protection".

5.4.3 Overriding Configuration Properties at the Web Service Client Application Level Using Fusion Middleware Control

To override a client configuration property using Fusion Middleware Control:

1. Attach a policy to a web service client, as described in "Attaching Policies Directly to Web Service Clients Using Fusion Middleware Control".

2. In the Directly Attached Policies table on the client endpoint page, select the policy and click Override Policy Configuration.

3. Enter the override value in the Value field for the property and click Apply.

   The property is overridden on a per-attachment basis.

5.4.4 Overriding Configuration Properties for Globally Attached Policies Using Fusion Middleware Control

If a policy referenced in a policy set contains overridable properties, you can override the existing value of the property for that policy set using Fusion Middleware Control. Because global policy attachments can be scoped at a higher level than direct policy attachments, such as application or domain level, configuration overrides configured in the policy set also apply at the higher scope.

To override a configuration property in a policy referenced in a policy set:

1. Go to the WSM Policy Set Summary page as described in "Navigating to the WSM Policy Set Summary Page Using Fusion Middleware Control".

2. From the WSM Policy Set Summary page, select the policy set containing the policy for which you want to configure overrides.

3. Select Override Policy Configuration.

   The Override Policy Configuration page is displayed, as shown in Figure 5-2.

   Figure 5-2 Policy Set Override Policy Configuration Page

   
   Description of ''Figure 5-2 Policy Set Override Policy Configuration Page''
   
   

4. In the Policy References table, select the policy for which you want to override the configuration property. If the policy contains overridable properties, the Override Policy Configuration button is displayed.

5. Select Override Policy Configuration. The Security Configuration Details page is displayed, containing a list of the configuration properties that can be overridden in the selected policy.

6. Enter the override value in the Value field for the property and click Apply.

   The property will be overridden for all endpoints to which the policy set applies.

5.5.1 Overriding Configuration Properties for Directly Attached Service Policies Using WLST

When you attach a policy that has an overridable property, you can override the existing value using the setWSMPolicyOverride command.

1. Attach the policy to the service or client as described in "Attaching Policies Directly Using WLST".

2. Within a session, use the setWSMPolicyOverride command to override policy properties.

   setWSMPolicyOverride(policyURI,property, value)
   

   For example, to override the keystore.sig.csf.key property in the oracle/wss10_message_protection_service_policy policy, use the following command:

   wls:/wls-domain/serverConfig>setWSMPolicyOverride("oracle/wss10_message_protection_service_policy","keystore.sig.csf.key","sigkey")   
   
   The configuration override property "keystore.sig.csf.key" having value "sigkey" has been added to the reference to policy with URI "oracle/wss10_message_protection_service_policy".
   

   Notes:

   If the policy that you specify is not attached to the port, an error message is displayed and/or an exception is thrown.

   If you set the properties argument to None, then all policy overrides are removed.

   The local.policy.reference.source property is for informational purposes only, to identify the source of the direct policy attachment, and should not be overridden. For more information, see "Determining the Source of Policy Attachments".

For more information about this WLST command and its arguments, see "Web Services Custom WLST Commands" in WLST Command Reference for Infrastructure Components.

5.5.2 Overriding Configuration Properties at the Web Service Client Application Using WLST

When you attach a client policy that has an overridable property, you can override the existing value using the setWebServiceClientStubProperty or setWebServiceClientStubProperties commands.

To override a client configuration property using WLST:

1. Attach the policy to the web service client, as described in "Attaching Policies Directly to RESTful and Oracle Infrastructure Web Services and Clients Using WLST".

2. Use the setWebServiceClientStubProperty or setWebServiceClientStubProperties command to override policy properties.

   setWebServiceClientStubProperty(application, moduleOrCompName, moduleType, serviceRefName,portInfoName,propName,[propValue])
   
   
   setWebServiceClientStubProperties(application, moduleOrCompName,
    moduleType, serviceRefName, portInfoName, properties)
   

   For example, to set or override multiple properties:

   wls:soainfra/serverConfig>
   setWebServiceClientStubProperties('/base_domain/soa_server1/adf_dc_to_bc',
    'ADF_BC', 'wsconn', 'AppModuleService', 'AppModuleServiceSoapHttpPort',
   [("csf-key","HCM_APPID"),('keystore.recipient.alias','orakey')])
   

For more information about this WLST command and its arguments, see "Web Services Custom WLST Commands" in WLST Command Reference for Infrastructure Components.

5.5.3 Overriding Configuration Properties for Globally Attached Policies Using WLST

You can specify a configuration override in a policy referenced in a policy set using the setWSMPolicyOverride command. This command can be used only during the creation or modification of a policy set within the context of a session. The following procedure describes how to specify a configuration override while editing an existing policy set, but you can also use this command in a session while creating a new policy set or creating a policy set from an existing policy set.

1. Begin a session using the beginWSMSession command.

   For example:

   wls:/jrfserver_domain/serverConfig> beginWSMSession()
   
   Session started for modification.
   

2. Use the selectWSMPolicySet command to select an existing policy set to edit.

   selectWSMPolicySet(name)
   

   The latest version of the named policy set will be loaded into the current session. For example, enter the following command:

   wls:/jrfServer_domain/serverConfig> selectWSMPolicySet ('default-domain-ws-domain_gpa')
    
   The policy set is ready for modification in the session.
   

3. Optionally, view the configuration of the policy set using the displayWSMPolicySet command.

   For example:

   wls:/jrfserver_domain/serverConfig>displayWSMPolicySet() 
   
   Policy Set Details:
   -------------------
   Display Name : default-domain-ws-domain_gpa
   Type of Resources:   SOAP Web Service
   Scope of Resources:  DOMAIN('base_domain')
   Description:         Global policy attachments for Web Service Endpoint resources.
   Enabled:             true
   Policy Reference:    URI=oracle/wss11_saml_or_username_token_with_message_protection_service_policy, category=security, enabled=true, index=1
                        URI=oracle/log_policy, category=management, enabled=false, index=2
   

4. Specify the configuration override for the policy reference using the setWSMPolicyOverride command.

   For example, to specify a configuration override for the reference.priority property for oracle/wss11_saml_or_username_token_with_message_protection_service_policy, enter the following command:

   wls:/jrfserver_domain/serverConfig>setWSMPolicyOverride('oracle/wss11_saml_or_username_token_with_message_protection_service_policy', 'reference.priority','1')
   
   The configuration override property "reference.priority" having value "1" has
   been added to the reference to policy with URI "oracle/wss11_saml_or_username_token_with_message_protection_service_policy".
   

5. Optionally, view the configuration of the policy set.

   For example:

   wls:/jrfserver_domain/serverConfig>displayWSMPolicySet() 
   
   Policy Set Details:
   -------------------
   Display Name : default-domain-ws-domain_gpa
   Type of Resources:   SOAP Web Service
   Scope of Resources:  DOMAIN('base_domain')
   Description:         Global policy attachments for Web Service Endpoint resources.
   Enabled:             true
   Policy Reference:    URI=oracle/wss11_saml_or_username_token_with_message_protection_service_policy, category=security, enabled=true, index=1
                        reference.priority=1
   

   Note that the reference.priority configuration override is now shown in the output (in bold in the above example.)

6. Validate the policy set using the validateWSMPolicySet command.

   For example:

   wls:/jrfServer_domain/serverConfig> validateWSMPolicySet()
    
   The global policy set default-domain-ws-domain_gpa is valid.
   

7. To write the contents of the current session to the repository, use the commitWSMSession command.

   wls:/jrfServer_domain/serverConfig> commitWSMSession()
    
   The policy set default-domain-ws-domain_gpa is valid.
   Updating policy set default-domain-ws-domain_gpa in repository.
    
   Session committed successfully.
   

5.6.1 Scope of User-Defined Configuration Properties

As with the predefined configuration properties, the scope for user-defined configuration properties in a policy differs for clients and web services. Consider the following:

• The scope for a client-side configuration property value is the client. There can be multiple policies that are attached to the same client that use the same property.

• The scope for a server-side configuration property value is limited to the specific policy. That is, you can have two policies with the same server-side configuration property name, say P1, attached to the same web service endpoint, and the two P1 properties can have different values.

5.6.2 Adding a User-Defined Configuration Property

You can edit a cloned copy of a predefined policy, or a custom policy, to add a user-defined configuration property.

To add a user-defined configuration property:

1. Navigate to the WSM Policies page, as described in "Navigating to the WSM Policies Page".

2. From the WSM Policies page, select the policy for which you want to add the property and click Open.

3. Select the Assertions tab, and then click Configuration.

4. In the Configuration page, click Add to add the new property.

5. In the table, provide a name and a value for the new property. The Name field is required and must be unique for the policy.

6. From the Type menu, select constant, optional, or required. You can subsequently override only properties of type optional and required.

7. Click OK.

8. Click Validate to validate the policy.

9. Click Save.

5.6.3 Editing a User-Defined Configuration Property

You can edit a user-defined configuration property, if required, as follows:

1. Navigate to the WSM Policies page, as described in "Navigating to the WSM Policies Page".

2. From the WSM Policies page, select the policy for which you want to edit the property and click Open.

3. Select the Assertions tab, and then click Configuration.

4. In the Configuration page, edit the property as required and click OK.

5. Click Validate to validate the policy.

6. Click Save.

5.6.4 Deleting a User-Defined Configuration Property

You can delete a user-defined configuration property if you no longer need it as follows:

1. Navigate to the WSM Policies page, as described in "Navigating to the WSM Policies Page".

2. From the WSM Policies page, select the policy for which you want to edit the property and click Open.

3. Select the Assertions tab, and then click Configuration.

4. In the Configuration page, select the user-defined property to be deleted and click Delete.

5. Click OK.

6. Click Validate to validate the policy.

7. Click Save.

5.6.5 Overriding the User-Defined Configuration Properties

You override a user-defined configuration property using the same methods that you use for predefined or custom policies. For more information, see the following topics:

• "Overriding Policy Configuration Properties Using Fusion Middleware Control"

• "Overriding Policy Configuration Properties Using WLST"