13 Web Services Security

In the product the Inbound Web Services capability, based upon a JAX-WS/JAX-RS implementation, allows for support for WS-Security and WS-Policy support on individual Inbound Web Services from several perspectives.

Note:

Refer to the Web Services Best Practices for Oracle Utilities Application Framework (KB704711) document for additional implementation advice for web services security.

Note:

This section applies to REST and SOAP based services defined as Inbound Web Services.

Annotation Security

It is possible to implement custom WS-Policy support using inbuilt annotation support on individual Inbound Web Service definitions. This allows the policies to be implemented within the product and allows for backward compatibility for sites using XML Application Integration (XAI).

The product supports custom WS-Policy files using the following method:

• The WS-Policy formatted XML file containing the policy definition is installed in the $SPLEBASE/splapp/iws/resources/policies directory (or %SPLEBASE%\splapp\iws\resources\policies directory on Windows).
• A Web Service Annotation of type F1POLICY is defined using the Web Service Annotation maintenance function. In that Annotation entry the following should be configured:
  • uri: The name of the policy XML file located in the policies directory in the format "policy:<policyname>" where <policyname> is the name of the file containing the policy. For example: "policy:UsernameToken.xml".
  • attachToWsdl: Whether the WS-Policy file is attached to the WSDL (for SOAP Web Services only).
  • direction: Specifies when to apply the policy as per weblogic.jws.Policy.Direction. For example: Direction.both
• The annotation is attached to the relevant Inbound Web Services to implement the policy using the Inbound Web Services maintenance function.

  Note:

  Multiple policies can be added as documented in Support for Multiple Policies.

Oracle WebLogic WS-Policy Support

Note:

Customers wishing to use Oracle WebLogic policies should NOT configure policies via the annotations on the same web service. Use of Oracle WebLogic policies and annotations are mutually exclusive and can cause unintentional security violations.

Oracle WebLogic has inbuilt WS-Policy Message-Level and Transport-Level support with predefined policies that can be used with Inbound Web Services at the container level. These policies can be attached within the container on individual services using the Oracle WebLogic console using Attach a WS-Policy to a Web Service using the policy type of WebLogic Web Service Policy.

Note:

Message level policy support is restricted to the whole message not within parts of the message.

Multiple policies can be supported directly by specifying additional policies in the Chosen Inbound Message Policies.

Oracle Web Services Manager Support

Note:

Customers using annotations can also use Oracle Web Services Manager policies by specifying the F1-OWSM Policy type as an annotation.

Note:

Customers wanting to use Oracle Web Services Manager within the product domain should use the Full JRF Profile not the Restricted JRF Profile as recommended as a minimum for the product installation.

Oracle Web Services Manager can be used to secure individual Inbound Web Services providing additional WS-Policies and access control support. As with Oracle WebLogic WS-Policy support, configuration is performed using the Oracle WebLogic console by specifying individual policies on individual Inbound Web Services by using the policy type of Oracle Web Services Manager (OWSM).

Refer to Using Oracle Web Service Manager Security Policies for additional information about Oracle Web Services Manager.

Access Control Support

Note:

By default, all Inbound Web Services are accessible by all valid users.

Oracle Web Services Manager allows for access controls to be configured for Inbound Web Services to provide additional security access controls. This facility allows for multiple rules to be configured implementing access rules across the following areas:

• Basic Policies: Policies relating to identity, group, role, environment mode and generic global rules.
• Date and Time Policies: Policies relating to specific dates and times including periods of access.
• Context Element Policies: Policies relating to data within the service itself.

Policies can be individually specified per service operation or combined to implement complex access requirements.

Refer to Security Policy Conditions for more information about specific policies and how to enable policies on services.

Support for Multiple Policies

Within each policy regime (annotation, Oracle WebLogic or Oracle Web Services Manager) it is possible to configure multiple policies where web service clients must conform to at least one policy specified. The following methods are supported:

• Annotations: On the Inbound Web Service each policy can be added as an individual annotation with the sequence number designating the order they are checked. It is also possible to delegate Oracle Web Services Manager for policies as part of an annotation using the F1-OWSM annotation type.
• Oracle WebLogic/Oracle Web Services Manager: In the web service deployment, it is possible to designate multiple policies in the Chosen Policies column of the individual web service WS-Policy configuration. The order of the policies is dictated by the position in the list of Chosen Policies.

Importing Certificates for Inbound Web Services

If your implementation uses certificates for security, the certificate must be deployed with the Inbound Web Services deployment.

To perform this activity:

• Ensure the certificate is valid and is installed on the Oracle WebLogic servers used for deployment of the Inbound Web Services.
• Logon to the machine you have made the changes upon as the product administrator.
• If you have not already done so, use the splenviron utility to set the environment variables for the product environment.
• Execute the initialSetup[.sh] -i [<host>:<port>] where to import the certificate into the Inbound Web Service deployment.