3 Interoperability with Oracle Containers for Java EE (OC4J) 10g Security Environments

This chapter describes the most common Oracle Containers for Java EE (OC4J) 10g interoperability scenarios based on the following security requirements: authentication, message protection, and transport.

This chapter includes the following sections:

3.1 Overview of Interoperability with OC4J 10g Security Environments

In OC4J 10g, you configure your security environment, as described in the following documents.

With OWSM 12c, you attach policies to web service endpoints. Each policy consists of one or more assertions, defined at the domain-level, that define the security requirements. A set of predefined policies and assertions are provided out-of-the-box.

For more information about:

Table 3-2 and Table 3-2 summarize the most common OC4J 10g interoperability scenarios based on the following security requirements: authentication, message protection, and transport.

Note:

In the following scenarios, ensure that you are using a keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

Table 3-1 OWSM 12c Service Policy and Oracle OC4J 10g Client Policy Interoperability

Identity Token WS-Security Version Message Protection Transport Security Service Policy Client Policy

Anonymous

1.0

Yes

No

oracle/wss10_message_protection_service_policy

See 0, "Configuring the OC4J 10g Client"

Username

1.0

Yes

No

oracle/wss10_username_token_with_message_protection_service_policy

See Table 3-10, "Configuring the OC4J 10g Client"

SAML

1.0

Yes

No

oracle/wss10_saml_token_with_message_protection_service_policy

See Table 3-16, "Configuring the OC4J 10g Client"

Mutual Authentication

1.0

Yes

No

oracle/wss10_x509_token_with_message_protection_service_policy

See Table 3-22, "Configuring the OC4J 10g Client"

Username over SSL

1.0 and 1.1

No

Yes

oracle/wss_username_token_over_ssl_service_policy

OR

oracle/wss_saml_or_username_token_over_ssl_service_policy

See Table 3-28, "Configuring the OC4J 10g Client"

SAML over SSL

1.0 and 1.1

No

Yes

oracle/wss_saml_token_over_ssl_service_policy

OR

oracle/wss_saml_or_username_token_over_ssl_service_policy

See Table 3-34, "Configuring the OC4J 10g Client"

Table 3-2 Oracle OC4J 10g Service Policy and OWSM 12c Client Policy Interoperability

Identity Token WS-Security Version Message Protection Transport Security Service Policy Client Policy

Anonymous

1.0

Yes

No

See Table 3-6, "Configuring the OC4J 10g Web Service"

oracle/wss10_message_protection_client_policy

Username

1.0

Yes

No

See Table 3-12, "Configuring the OC4J 10g Web Service"

oracle/wss10_username_token_with_message_protection_client_policy

SAML

1.0

Yes

No

See Table 3-18, "Configuring the OC4J 10g Web Service"

oracle/wss10_saml_token_with_message_protection_client_policy

Mutual Authentication

1.0

Yes

No

See Table 3-24, "Configuring the OC4J 10g Web Service"

oracle/wss10_x509_token_with_message_protection_client_policy

Username over SSL

1.0 and 1.1

No

Yes

See Table 3-30, "Configuring the OC4J 10g Web Service"

oracle/wss_username_token_over_ssl_client_policy

SAML over SSL

1.0 and 1.1

No

Yes

See Table 3-36, "Configuring the OC4J 10g Web Service"

oracle/wss_saml_token_over_ssl_client_policy

3.2 Anonymous Authentication with Message Protection (WS-Security 1.0)

This section tells how to implement anonymous authentication with message protection that conforms to the WS-Security 1.0 standard, in the following interoperability scenarios:

3.2.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OWSM 10g client to implement anonymous authentication with message protection that conforms to the WS-Security 1.0 standard:

Table 3-3 Configuring the OWSM 12c Web Service

Task Description More Information

1

Create a web service application.

  

2

Attach the following policy to the entry point of the web service: oracle/wss10_message_protection_service_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-4 Configuring the OC4J 10g Client

Task Description More Information

1

Create a client proxy for the web service (discussed in Table 3-3) using Oracle JDeveloper.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

2

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

3

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select No Authentication.

--

4

Click Inbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Verify Inbound Signed Request Body.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

  • Select all options under Acceptable Signature Algorithms.

--

5

Click Outbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Sign Outbound Messages.

  • Select Add Timestamp to Outbound Messages and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

--

6

Click Inbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Decrypt Inbound Message Content.

  • Select all options under Acceptable Signature Algorithms.

--

7

Click Outbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Encrypt Outbound Messages.

  • Set the Algorithm to AES-128.

--

8

Click Keystore Options in the Proxy Editor navigation bar and configure the keystore properties, as required.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

--

9

Click OK to close the wizard.

--

10

In the Structure pane, click <appname>Binding_Stub.xml and edit the file as described in next section.

--

11

Invoke the web service method from the client.

--

Table 3-5 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-
utility-1.0.xsd" local-part="Timestamp" />
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify the key transport algorithm, as follows:

<outbound><encrypt>
<keytransport-method>RSA-OAEP-MGF1P</keytransport-method>
...

3.2.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement anonymous authentication with message protection that conforms to the WS-Security 1.0 standard:

Table 3-6 Configuring the OC4J 10g Web Service

Task Description

1

Create and deploy a web service application.

2

Use Application Server Control to secure the deployed web service.

3

Click Authentication tab and ensure that no options are selected.

4

Click Integrity tab of the Inbound Policies page and set the following options:

  • Select Require Message Body to Be Signed.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

5

Click Integrity tab of the Outbound Policies page and set the following options:

  • Select Sign Body Element of Message.

  • Set the Signature Method to RSA-SHA1.

  • Select Add Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

6

Click Confidentiality tab of the Inbound Policies page and set the following options:

  • Select Require Encryption of Message Body.

7

Click Confidentiality tab of the Outbound Policies page and set the following options:

  • Select Encrypt Body Element of Message.

  • Set the Encryption Method to AES-128.

  • Set the public key to encrypt.

8

Configure the keystore properties and identity certificates.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

9

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-8, "Editing the wsmgmt.xml File".

Table 3-7 Configuring the OWSM 12c Client

Task Description More Information

1

Create a client proxy for the OC4J 10g web service.

--

2

Attach the following policy: oracle/wss10_message_protection_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

3

Configure the policy.

"oracle/wss10_username_token_with_message_protection_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Invoke the web service method from the client.

--

Table 3-8 Editing the wsmgmt.xml File

Task Description More Information

1

Locate the wsmgmt.xml File under ORACLE_HOME/j2ee/oc4j_instance/config.

The wsmgmt.xml file is an instance-level configuration file, which holds the entire security configuration for the web services deployed in an OC4J instance.

"Understanding the Web Services Management Schema" in Oracle® Application Server Advanced Web Services Developer's Guide

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

--

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

--

4

In the outbound encryption, specify the key transport algorithm, as follows:

<outbound><encrypt>
<keytransport-method>RSA-OAEP-MGF1P</keytransport-method>
...

--

3.3 Username Token with Message Protection (WS-Security 1.0)

This section tells how to implement username token with message protection that conforms to the WS-Security 1.0 standard:

3.3.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OC4J 10g client to implement username token with message protection that conforms to the WS-Security 1.0 standard:

Table 3-9 Configuring the OWSM 12c Web Service

Task Description More Information

1

Create an OWSM 12c web service.

--

2

Attach the following policy to the web service: oracle/wss10_username_token_with_message_protection_service_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-10 Configuring the OC4J 10g Client

Task Description More Information

1

Create a client proxy for the web service (above) using Oracle JDeveloper.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

2

Specify the username and password in the client proxy, as follows:

port.setUsername(<username>)
port.setPassword(<password>)

--

3

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

4

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select Use Username to Authenticate.

  • Deselect Add Nonce and Add Creation Time.

--

5

Click Inbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Verify Inbound Signed Request Body.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

  • Select all options under Acceptable Signature Algorithms.

--

6

Click Outbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Sign Outbound Messages.

  • Select Add Timestamp to Outbound Messages and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

--

7

Click Inbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Decrypt Inbound Message Content.

  • Select all options under Acceptable Signature Algorithms.

--

8

Click Outbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Encrypt Outbound Messages.

  • Set the Algorithm to AES-128.

--

9

Click Keystore Options in the Proxy Editor navigation bar and configure the keystore properties, as required.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

--

10

Click OK to close the wizard.

--

11

In the Structure pane, click <appname>Binding_Stub.xml and edit the file, as described in Table 3-11, "Editing the <appname>Binding_Stub.xml File".

--

12

Invoke the web service.

--

Table 3-11 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp" />
...

3

In the outbound signature, specify that the timestamp and UsernameToken should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-
utility-1.0.xsd" local-part="Timestamp"/>
 <tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-secext-1.0.xsd" local-part="UsernameToken"/>
...

4

In the outbound encryption, specify the key transport algorithm, as follows:

<outbound><encrypt>
<keytransport-method>RSA-OAEP-MGF1P</keytransport-method>
...

5

In the outbound encryption, specify that the UsernameToken should be encrypted, as follows:

<outbound>/<encrypt>/<tbe-elements>
<tbe-element local-part="UsernameToken"
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-secext-1.0.xsd" mode="CONTENT"/>
...

3.3.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement username token with message protection that conforms to the WS-Security 1.0 standard:

Table 3-12 Configuring the OC4J 10g Web Service

Task Description

1

Create and deploy a JAX-RPC web service on OC4J.

2

Use Application Server Control to secure the deployed web service.

3

Click Authentication tab and set the following options:

  • Select Use Username/Password Authentication.

  • Set Password to Plain Text.

4

Click Integrity tab in Inbound Policies page and set the following options:

  • Select Require Message Body to Be Signed.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

5

Click Integrity tab in Outbound Policies page and set the following options:

  • Select Sign Body Element of Message.

  • Set the Signature Method to RSA-SHA1.

  • Select Add Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

6

Click Confidentiality tab in the Inbound Policies page and set the following options:

  • Select Require Encryption of Message Body.

7

Click Confidentiality tab in the Outbound Policies page and set the following options:

  • Select Encrypt Body Element of Message.

  • Set the Encryption Method to AES-128.

  • Set the public key to encrypt.

8

Configure the keystore properties and identity certificates.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

9

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-14, "Editing the wsmgmt.xml File".

Table 3-13 Configuring the OWSM 02c Client

Task Description More Information

1

Create a client proxy for the OC4J 10g web service.

--

2

Attach the following policy: oracle/wss10_username_token_with_message_protection_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

3

Configure the policy.

"oracle/wss10_username_token_with_message_protection_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Invoke the web service method from the client.

--

Table 3-14 Editing the wsmgmt.xml File

Task Description

1

Find the wsmgmt.xml file under ORACLE_HOME/j2ee/oc4j_instance/config/.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify that the UsernameToken should be encrypted, as follows:

<outbound>/<encrypt>/<tbe-elements>
<tbe-element local-part="UsernameToken"
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-secext-1.0.xsd" mode="CONTENT"/>
...

3.4 SAML Token (Sender Vouches) with Message Protection (WS-Security 1.0)

This section tells how to implement SAML token sender vouches with message protection that conforms to the WS-Security 1.0 standard, the following interoperability scenarios:

3.4.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OC4J 10g client to implement SAML token sender vouches with message protection that conforms to the WS-Security 1.0 standard:

Table 3-15 Configuring the OWSM 12c Web Service

Task Description More Information

1

Create an OWSM 12c web service.

--

2

Attach the following policy to the web service: oracle/wss10_saml_token__with_message_protection_service_policy

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-16 Configuring the OC4J 10g Client

Task Description More Information

1

Create a client proxy for the web service (above) using Oracle JDeveloper.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

2

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

3

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select Use SAML Token.

  • Click SAML Details.

  • Select Sender Vouches Confirmation and Use Signature.

  • Enter the username that needs to be propagated as the Default Subject Name.

  • Enter www.oracle.com as the Default Issuer Name.

--

4

Click Inbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Verify Inbound Signed Request Body.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

  • Select all options under Acceptable Signature Algorithms.

--

5

Click Outbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Sign Outbound Messages.

  • Select Add Timestamp to Outbound Messages and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

--

6

Click Inbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Decrypt Inbound Message Content.

  • Select all options under Acceptable Signature Algorithms.

--

7

Click Outbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Encrypt Outbound Messages.

  • Set the Algorithm to AES-128.

--

8

Click Keystore Options in the Proxy Editor navigation bar and configure the keystore properties, as required.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

--

9

Click OK to close the wizard.

--

10

In the Structure pane, click <appname>Binding_Stub.xml and edit the file, as described in Table 3-17, "Editing the <appname>Binding_Stub.xml File".

--

11

Invoke the web service method.

--

Table 3-17 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp" />
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify the key transport algorithm, as follows:

<outbound><encrypt>
<keytransport-method>RSA-OAEP-MGF1P</keytransport-method>
...

3.4.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement SAML token sender vouches with message protection that conforms to the WS-Security 1.0 standard:

Table 3-18 Configuring the OC4J 10g Web Service

Task Description

1

Create and deploy a JAX-RPC web service on OC4J.

2

Use the Application Server Control to secure the deployed web service.

3

Click Authentication in navigation bar and set the following options:

  • Select Use SAML Authentication.

  • Select Accept Sender Vouches.

  • Deselect Verify Signature.

4

Click Inbound Integrity in the navigation bar and set the following option:

  • Select Require Message Body To Be Signed.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

5

Click Outbound Integrity in the navigation bar and select the following options:

  • Select Sign Body Element of Message.

  • Set the Signature Method to RSA-SHA1.

  • Select Add Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

6

Click Inbound Confidentiality in the navigation bar and set the following option:

  • Deselect Require Encryption of Message Body.

7

Click Outbound Confidentiality in the navigation bar and set the following option:

  • Select Encrypt Body Element of Message.

  • Set the Encryption Method to AES-128.

  • Set the public key to encrypt.

8

Configure the keystore properties and identity certificates.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

9

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-20, "Editing the wsmgmt.xml File".

10

Invoke the web service.

Table 3-19 Configuring the OWSM 12c Client

Task Description More Information

1

Create a client proxy for the OC4J 10g web service.

--

2

Attach the following policy: oracle/wss10_saml_token_with_message_protection_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

3

Configure the policy.

"oracle/wss10_saml_token_with_message_protection_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Invoke the web service method from the client.

--

Table 3-20 Editing the wsmgmt.xml File

Task Description

1

Find the wsmgmt.xml file in ORACLE_HOME/j2ee/oc4j_instance/config.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify that the UsernameToken should be encrypted, as follows:

<outbound>/<encrypt>/<tbe-elements>
<tbe-element local-part="UsernameToken"
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-secext-1.0.xsd" mode="CONTENT"/>
...

3.5 Mutual Authentication with Message Protection (WS-Security 1.0)

This section tells how to implement mutual authentication with message protection that conforms to the WS-Security 1.0 standard, the following interoperability scenarios:

3.5.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OC4J 10g client to implement mutual authentication with message protection that conforms to the WS-Security 1.0 standard:

Table 3-21 Configuring the OWSM 12c Web Service

Task Description More Information

1

Create a web service application.

--

2

Attach the following policy to the web service: oracle/wss10_x509_token_with_message_protection_service_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-22 Configuring the OC4J 10g Client

Task Description More Information

1

Create a client proxy for the web service (above) using Oracle JDeveloper.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

2

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

3

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select Use X509 To Authenticate.

--

4

Click Inbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Verify Inbound Signed Request Body.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

  • Select all options under Acceptable Signature Algorithms.

--

5

Click Outbound Integrity in the Proxy Editor navigation bar and set the following options:

  • Select Sign Outbound Messages.

  • Select Add Timestamp to Outbound Messages and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

--

6

Click Inbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Decrypt Inbound Message Content.

  • Select all options under Acceptable Signature Algorithms.

--

7

Click Outbound Confidentiality in the Proxy Editor navigation bar and set the following options:

  • Select Encrypt Outbound Messages.

  • Set the Algorithm to AES-128.

--

8

Click Keystore Options in the Proxy Editor navigation bar and configure the keystore properties, as required.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

--

9

Click OK to close the wizard.

--

10

In the Structure pane, click <appname>Binding_Stub.xml and edit the file, as describe in Table 3-23, "Editing the <appname>Binding_Stub.xml File".

--

11

Invoke the web service.

--

Table 3-23 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp" />
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify the key transport algorithm, as follows:

<outbound><encrypt>
<keytransport-method>RSA-OAEP-MGF1P</keytransport-method>
...

3.5.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement mutual authentication with message protection that conforms to the WS-Security 1.0 standard:

Table 3-24 Configuring the OC4J 10g Web Service

Task Description

1

Create and deploy a JAX-RPC web service on OC4J.

2

Use the Application Server Control to secure the deployed web service.

3

Click Authentication tab and set the following options:

  • Select Use X509 Certificate Authentication.

4

Click Integrity tab of the Inbound Policies page and set the following options:

  • Select Require Message Body to Be Signed.

  • Select Verify Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

5

Click Integrity tab of the Outbound Policies page and set the following options:

  • Select Sign Body Element of Message.

  • Set the Signature Method to RSA-SHA1.

  • Select Add Timestamp and Creation Time Required in Timestamp.

  • Enter the Expiration Time (in seconds).

6

Click Confidentiality tab of the Inbound Policies page and set the following options:

  • Select Require Encryption of Message Body.

7

Click Confidentiality tab of the Outbound Policies page and set the following options:

  • Select Encrypt Body Element of Message.

  • Set the Encryption Method to AES-128.

  • Set the public key to encrypt.

8

Configure the keystore properties and identity certificates.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

9

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-26, "Editing the wsmgmt.xml File".

Table 3-25 Configuring the OWSM 12c Client

Task Description More Information

1

Create a client proxy to the OC4J 10g web service.

--

2

Attach the following policy: oracle/wss10_x509_token_with_message_protection_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

3

Configure the policy.

"oracle/wss10_x509_token_with_message_protection_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Invoke the web service.

--

Table 3-26 Editing the wsmgmt.xml File

Task Description

1

Find the wsmgmt.xml file under ORACLE_HOME/j2ee/oc4j_instance/config/.

2

In the inbound signature, specify the following:

<inbound><verify-signature><tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

3

In the outbound signature, specify that the timestamp should be signed, as follows:

<outbound>/<signature>/<tbs-elements>
<tbs-element
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-utility-1.0.xsd" local-part="Timestamp"/>
...

4

In the outbound encryption, specify that the UsernameToken should be encrypted, as follows:

<outbound>/<encrypt>/<tbe-elements>
<tbe-element local-part="UsernameToken"
name-space="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
-secext-1.0.xsd" mode="CONTENT"/>
...

3.6 Username Token Over SSL

This section tells how to implement username token over SSL, in the following interoperability scenarios:

For information about:

3.6.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OC4J 10g client to implement username token over SSL:

Table 3-27 Configuring the OWSM 12c Web Service

Task Description More Information

1

Configure the server for SSL.

"Configuring Transport-Level Security (SSL)" in Securing Web Services and Managing Policies with Oracle Web Services Manager

2

Attach one of the following policies to the web service:

oracle/wss_username_token_over_ssl_service_policy

oracle/wss_username_or_saml_token_over_ssl_service_policy

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-28 Configuring the OC4J 10g Client

Task Description More Information

1

Create a client proxy for the web service (above) using Oracle JDeveloper.

Ensure that the web service endpoint references the URL with HTTPS and SSL port configured on Oracle WebLogic Server.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

2

Add the following code excerpt to initialize two-way SSL (at the beginning of the client proxy code):

HostnameVerifier hv = new HostnameVerifier()
httpsURLConnection.setDefaultHostnameVerifier(hv);
System.setProperty("javax.net.ssl.trustStore","<trust_store>");
System.setProperty("javax.net.ssl.trustStorePassword","<trust_store
_password>");
System.setProperty("javax.net.ssl.keyStore","<key_store>");
System.setProperty("javax.net.ssl.keyStorePassword","<key_store_password>");
System.setProperty("javax.net.ssl.keyStoreType","JKS");

--

3

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

4

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select Use Username to Authenticate.

  • Deselect Add Nonce and Add Creation Time.

--

5

Click Inbound Integrity in the Proxy Editor navigation bar and deselect all options.

--

6

Click Outbound Integrity in the Proxy Editor navigation bar and deselect all options.

--

7

Click Inbound Confidentiality in the Proxy Editor navigation bar and deselect all options.

--

8

Click Outbound Confidentiality in the Proxy Editor navigation bar and deselect all options.

--

9

Click Keystore Options in the Proxy Editor navigation bar and configure the keystore properties, as required.

Ensure that you are using keystore with v3 certificates. By default, the JDK 1.5 keytool generates keystores with v1 certificates.

--

10

Click OK to close the wizard.

--

11

In the Structure pane, click <appname>Binding_Stub.xml and edit the file. as described in. Table 3-29, "Editing the <appname>Binding_Stub.xml File"

--

12

Invoke the web service.

--

Table 3-29 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the outbound signature, specify that the timestamp should be signed, as follows (and remove all other tags):

<outbound>
   <signature>
      <add-timestamp created="true" expiry="<Expiry_Time>"/> 
   </signature>
...

3.6.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement username token over SSL:

Table 3-30 Configuring the OC4J 10g Web Service

Task Description More Information

1

Configure the server for SSL.

http://download.oracle.com/docs/cd/B14099_19/web.1012/b14013/configssl.htm

2

Use the Application Server Control to secure the deployed web service.

--

3

Click Authentication tab and set the following options:

  • Select Use Username/Password Authentication.

--

4

Click Integrity tab of the Inbound Policies page and deselect all options.

--

5

Click Integrity tab of the Outbound Policies page and deselect all options.

--

6

Click Confidentiality tab of the Inbound Policies page and deselect all options.

--

7

Click Confidentiality tab of the Outbound Policies page and deselect all options.

--

8

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-32, "Editing the wsmgmt.xml File".

--

Table 3-31 Configuring the OWSM 12c Client

Task Description More Information

1

Create a client proxy to the OC4J 10g web service using clientgen.

Ensure that the web service endpoint references the URL with HTTPS and SSL port configured on Oracle WebLogic Server.

--

2

Add the following code excerpt to initialize two-way SSL (at the beginning of the client proxy code):

HostnameVerifier hv = new HostnameVerifier()
httpsURLConnection.setDefaultHostnameVerifier(hv);
System.setProperty("javax.net.ssl.trustStore","<trust_store>");
System.setProperty("javax.net.ssl.trustStorePassword","<trust_store
_password>");
System.setProperty("javax.net.ssl.keyStore","<key_store>");
System.setProperty("javax.net.ssl.keyStorePassword","<key_store_password>");
System.setProperty("javax.net.ssl.keyStoreType","JKS");

--

3

Attach the following policy: oracle/wss_username_token_over_ssl_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Configure the policy.

"oracle/wss_username_token_over_ssl_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

5

Invoke the web service.

--

Table 3-32 Editing the wsmgmt.xml File

Task Description

1

Find the wsmgmt.xml file under ORACLE_HOME/j2ee/oc4j_instance/config/.

2

In the outbound signature, specify that the timestamp should be signed, as follows (and remove all other tags):

<outbound>
   <signature>
      <add-timestamp created="true" expiry="<Expiry_Time>"/> 
   </signature>
...

3.7 SAML Token (Sender Vouches) Over SSL (WS-Security 1.0)

This section tells how to implement SAML token (sender vouches) over SSL that conforms to the WS-Security 1.0 standard, in the following interoperability scenarios:

For information about:

3.7.1 Configuring an OWSM 12c Web Service and an OC4J 10g Client

The following instructions tell how to configure an OWSM 12c web service and an OC4J 10g client to implement SAML token (sender vouches) over SSL that conforms to the WS-Security 1.0 standard:

Table 3-33 Configuring the OWSM 12c Web Service

Task Description More Information

1

Configure the server for two-way SSL.

"Configuring SSL on WebLogic Server (Two-Way)" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

2

Attach the following policy to the web service:

oracle/wss_saml_token_over_ssl_service_policy

oracle/wss_username_or_saml_token_over_ssl_service_policy

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

Table 3-34 Configuring the OC4J 10g Client

Task Description More Information

1

Configure the server for two-way SSL.

http://download.oracle.com/docs/cd/B14099_19/web.1012/b14013/configssl.htm

2

Create a client proxy for the web service (above) using Oracle JDeveloper.

Ensure that the web service endpoint references the URL with HTTPS and SSL port configured on Oracle WebLogic Server.

"Developing and Securing Web Services" in Developing Applications with Oracle JDeveloper.

3

Add the following code excerpt to initialize two-way SSL (at the beginning of the client proxy code):

HostnameVerifier hv = new HostnameVerifier()
httpsURLConnection.setDefaultHostnameVerifier(hv);
System.setProperty("javax.net.ssl.trustStore","<trust_store>");
System.setProperty("javax.net.ssl.trustStorePassword","<trust_store
_password>");
System.setProperty("javax.net.ssl.keyStore","<key_store>");
System.setProperty("javax.net.ssl.keyStorePassword","<key_store_password>");
System.setProperty("javax.net.ssl.keyStoreType","JKS");

--

4

Use the Oracle JDeveloper wizard to secure the proxy by right-clicking on the proxy project and selecting Secure Proxy.

--

5

Click Authentication in the Proxy Editor navigation bar and set the following options:

  • Select Use SAML Token.

  • Click SAML Details.

  • Select Sender Vouches Confirmation.

  • Enter a valid username as the Default Subject Name.

--

6

Click Inbound Integrity in the Proxy Editor navigation bar and set the following option:

  • Deselect Verify Inbound Signed Message Body.

--

7

Click Outbound Integrity in the Proxy Editor navigation bar and deselect all options.

--

8

Click Inbound Confidentiality in the Proxy Editor navigation bar and set the following option:

  • Deselect Decrypt Inbound Message Content.

--

9

Click Outbound Confidentiality in the Proxy Editor navigation bar and set the following option:

  • Deselect Encrypt Outbound Message.

--

10

Provide required information for the keystore to be used.

--

11

Click OK to close the wizard.

--

12

In the Structure pane, click <appname>Binding_Stub.xml and edit the file, as described in Table 3-35, "Editing the <appname>Binding_Stub.xml File".

--

13

Invoke the web service.

--

Table 3-35 Editing the <appname>Binding_Stub.xml File

Task Description

1

Provide the keystore password and sign and encryption key passwords.

2

In the outbound signature, specify that the timestamp should be signed, as follows (and remove all other tags):

<outbound>
   <signature>
      <add-timestamp created="true" expiry="<Expiry_Time>"/> 
   </signature>
...

3.7.2 Configuring an OC4J 10g Web Service and an OWSM 12c Client

The following instructions tell how to configure an OC4J 10g web service and an OWSM 12c client to implement SAML token (sender vouches) over SSL that conforms to the WS-Security 1.0 standard:

Table 3-36 Configuring the OC4J 10g Web Service

Task Description More Information

1

Configure the server for two-way SSL.

http://download.oracle.com/docs/cd/B14099_19/web.1012/b14013/configssl.htm

2

Use the Application Server Control to secure the deployed web service.

--

3

Click Authentication in navigation bar and set the following options:

  • Select Use SAML Authentication.

  • Select Accept Sender Vouches.

  • Deselect Verify Signature.

--

4

Click Integrity tab of the Inbound Policies page and deselect all options.

--

5

Click Integrity tab of the Outbound Policies page and deselect all options.

--

6

Click Confidentiality tab of the Inbound Policies page and deselect all options.

--

7

Click Confidentiality tab of the Outbound Policies page and deselect all options.

--

7

Edit the wsmgmt.xml deployment descriptor file, as described in Table 3-38, "Edit the wsmgmt.xml File".

--

Table 3-37 Configuring the OWSM 12c Client

Task Description More Information

1

Configure the server for two-way SSL.

"Configuring SSL on WebLogic Server (Two-Way)" in Securing Web Services and Managing Policies with Oracle Web Services Manager

2

Create a client proxy to the OC4J 10g web service.

Ensure that the web service endpoint references the URL with HTTPS and SSL port configured on Oracle WebLogic Server.

--

3

Attach the following policy: oracle/wss_saml_token_over_ssl_client_policy.

"Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

4

Configure the policy.

"oracle/wss_saml_token_over_ssl_client_policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager

5

Invoke the web service.

--

Table 3-38 Edit the wsmgmt.xml File

Task Description

1

Find the wsmgmt.xml file under ORACLE_HOME/j2ee/oc4j_instance/config/,.

2

In the outbound signature, specify that the timestamp should be signed, as follows (and remove all other tags):

<outbound>
   <signature>
      <add-timestamp created="true" expiry="<Expiry_Time>"/> 
   </signature>
...