Understanding WS-Security Processing using Username Tokens

This section provides overviews of:

Inbound WS-Security processing using Username tokens.
Outbound WS-Security processing using Username tokens.

Inbound WS-Security Processing using Username Tokens

The inbound processing of service operations that are WS-Security-compliant using Username tokens occurs on the integration gateway.

This diagram illustrates inbound WS-Security processing in PeopleSoft Integration Broker when it is implemented. The diagram shows all possible security processing for an inbound integration to show where in the processing flow WS-Security processing occurs. WS-Security processing is highlighted in the foreground of the diagram. The diagram illustrates the steps in WS-Security processing, including validation that the service operation contains a WS-Security SOAP header with a username token, validation of a digital signature if implemented, decryption of the username token if encrypted, and passing the external user ID and password to the application server.

Inbound WS-Security Processing using Username Tokens

When any transaction arrives at the integration gateway, the PeopleSoft system checks for the existence of a WS-Security SOAP header. If it exists, the integration gateway validates the digital signature if it exists, and decrypts the UsernameToken and optional password to restore the user ID information to clear text format.

The integration gateway then passes the user ID information, and UsernameToken password if provided by the sender, to the application server, where additional security processing is performed.

Outbound WS-Security Processing using Username Tokens

This section discusses outbound WS-Security processing using username tokens by PeopleSoft Integration Broker on outbound integrations.

WS-Security processing occurs on the integration gateway.

This diagram illustrates outbound WS-Security processing using username tokens when it is implemented. The diagram shows all possible security processing for an outbound integration to show where in the processing flow WS-Security processing occurs. WS-Security processing is highlighted in the foreground of the diagram. The diagram illustrates the steps of WS-Security processing using username tokens, including validating the external user ID/password or default user ID from the node definition, the setting of the username token type, the encryption of the token if specified, and the digital signing of the token if specified.

When WS-Security is implemented for an outbound service operation, the integration gateway adds a WS-Security SOAP header to the service operation that contains UsernameToken credentials defined in the node definition for the node. The UsernameToken credentials can be comprised of any of the following from the node definition: External User ID, External Password, or Default User ID. Additionally, you can choose to encrypt and digitally sign the UsernameToken credentials.

See Implementing WS-Security for Outbound Integrations (Username and SAML Tokens), Describing WS-Security Configuration Options for Outbound Integrations (Username Tokens).