This chapter describes the Oracle Web Services Manager (OWSM) predefined policies, organized by category. For more information about the predefined policy categories, see "Policy Categories" in Understanding Oracle Web Services Manager. For more information about attaching policies, see "Attaching Policies".
This chapter includes the following sections:
Notes:
The predefined policies and assertion templates distributed with the current release are read only. You must copy the policy or assertion template before modifying it; you can copy policies in the security and management categories only. You also have the option of configuring the attributes in an assertion after you have added it to a policy. For information about managing the assertion templates and adding them to policies, see "Managing Policy Assertion Templates".
When attaching OWSM 12c predefined policies, if you specify a value of blank (" ") in the Value field, the default value will be in effect. If you have imported 11g policies or any custom policies, ensure that the policy has a valid value in the Default field to achieve the same effect; otherwise, the specified value will be picked up.
Table 17-1 summarize the predefined OWSM addressing policies.
Table 17-1 Predefined OWSM Addressing Policies
| Policy Name | Description |
|---|---|
|
Checks inbound messages for the presence of WS-Addressing headers conforming to the W3C 2005 Final WS-Addressing Policy standard. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS Addressing policy at a higher scope. |
For more information about attaching web services addressing policies, see:
"Configuring Addressing Using Fusion Middleware Control" in Administering Web Services
"Configuring Addressing Using WLST" in Administering Web Services
Display Name: WS Addressing Policy
Category: WS-Addressing
Checks inbound messages for the presence of WS-Addressing headers conforming to the W3C 2005 Final WS-Addressing Policy standard. In addition, it causes the platform to include a WS-Addressing header in outbound SOAP messages.
For more information about configuring WS-Addressing on the web service client, see Web Services Addressing 1.0 - SOAP Binding specification (http://www.w3.org/TR/ws-addr-soap/).
Note:
Please note the following:This policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-3 lists the configuration property that you can override for the addressing policy.
Table 17-2 Configuration Property for oracle/wsaddr_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Addressing Policy
Category: WS-Addressing
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS Addressing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-3 lists the configuration property that you can override for the no behavior policy.
Table 17-3 Configuration Property for oracle/no_addressing_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Table 17-4 summarize the predefined OWSM atomic transaction policies.
Table 17-4 Predefined OWSM Atomic Transaction Policies
| Policy Name | Description |
|---|---|
|
Enables and configures support for atomic transactions. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached atomic transaction web service policy at a higher scope. |
For more information about attaching web services atomic transaction policies, see:
"Configuring Atomic Transactions Using Fusion Middleware Control" in Administering Web Services
"Configuring Atomic Transactions Using WLST" in Administering Web Services
Display Name: Atomic Transaction Policy
Category: Atomic Transactions
Enables and configures support for atomic transactions. For more information about atomic transactions, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This atomic transactions policy cannot be duplicated.
The assertion template associated with this atomic transactions policy is not available for generating new policies.
This atomic transactions policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-5 lists the configuration properties that you can override for atomic transactions.
Table 17-5 Configuration Properties for oracle/atomic_transaction_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Whether the web services atomic transaction coordination context is passed with the transaction flow. Valid values include:
For more information about the valid values, see "Configuring Web Service Atomic Transactions" in Developing Oracle Infrastructure Web Services. |
|
Optional |
|
|
Version of the web services atomic transaction coordination context that is supported. For web service clients, it specifies the version used for outbound messages only. The value specified must be consistent across the entire transaction. Valid values include:
For more information about the valid values, see "Configuring Web Service Atomic Transactions" in Developing Oracle Infrastructure Web Services. |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Atomic Transaction Policy
Category: Atomic Transactions
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached atomic transaction web service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
For more information about atomic transactions, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-6 lists the configuration property that you can override for the no behavior policy.
Table 17-6 Configuration Property for oracle/no_atomic_transaction_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Table 17-7 summarize the predefined OWSM configuration policies.
Note:
Please note the following:Configuration policies cannot be duplicated.
The assertion templates associated with configuration policies are not available for generating new policies.
Configuration policies are not supported for SOA composite or Java EE (WebLogic) web services.
Table 17-7 Predefined OWSM Configuration Policies
| Policy Name | Description |
|---|---|
|
Enables and configures an asynchronous web service. |
|
|
Enables and configures support for binary caching of content. |
|
|
Enables and configures Fast Infoset on the web service client. |
|
|
Enables Fast Infoset on the web service. |
|
|
Configures the maximum size, in bytes, of the request message that can be sent to the web service. |
|
|
Enables the exchange of web service metadata. |
|
|
Enables the creation of MTOM-enabled SOAP fault messages when MTOM is enabled. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached asynchronous web service policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached binary caching policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset client policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset service policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached maximum request size policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached web service metadata exchange policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP fault MTOM encoding policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached persistence policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Plain Old XML (POX) policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached request processing policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached schema validation policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP request processing policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached test page processing policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached logging policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WSDL request processing policy at a higher scope. |
|
|
Configures the secure conversation persistence mechanism for the web service. |
|
|
Enables an endpoint to receive non-SOAP XML messages that are processed by a user defined |
|
|
Enables the web service endpoint to process incoming requests. |
|
|
Enables the validation of request messages against the schema. |
|
|
Enables the processing of SOAP requests on the web service endpoint. |
|
|
Enables the Web Service Test Client, as described in "Using the Web Services Test Client" in Administering Web Services. |
|
|
Sets the logging level for diagnostic logs for the web service endpoint. |
|
|
Enables access to the WSDL for the web service. |
For more information about attaching configuration policies, see:
"Configuring Web Services Using Fusion Middleware Control" in Administering Web Services
"Configuring Web Services Using WLST" in Administering Web Services
Display Name: Async Web Service Policy
Category: Configuration
Enables and configures an asynchronous web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-10 lists the configuration properties that you can override for asynchronous web services.
Table 17-8 Configuration Property for oracle/async_web_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
The user that is authorized to use the JMS queues. Note: For most users, the OracleSystemUser is sufficient. However, if you need to change this user to another user in your security realm, you can do so using the instructions provided in "Changing the JMS System User for Asynchronous Web Services Using Fusion Middleware Control" in Administering Web Services. |
|
Optional |
|
|
Name of the connection factory for the JMS request queue. |
|
Optional |
|
|
Name of the request queue. |
|
Optional |
|
|
Name of the connection factory for the JMS response queue. |
|
Optional |
|
|
Name of the request queue. |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: Cache Binary Content Policy
Category: Configuration
Enables and configures support for binary caching of content.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-9 lists the configuration properties that you can override for binary caching.
Table 17-9 Configuration Properties for oracle/cache_binary_content_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Value that specifies the runtime requirements of XTI scalable DOM in OraSAAJ. Valid values include:
|
|
Optional |
|
|
Boolean value that defines one of the following values:
|
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: Fast Infoset Client Policy
Category: Configuration
Enables and configures Fast Infoset on the web service client.
For more information about Fast Infoset, see:
JAX-WS Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing JAX-WS Web Services for Oracle WebLogic Server.
Oracle Infrastructure Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-10 lists the configuration properties that you can override for Fast Infoset clients.
Table 17-10 Configuration Properties for oracle/fastinfoset_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Value that specifies the Fast Infoset content negotiation setting. Valid values include:
|
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: Fast Infoset Service Policy
Category: Configuration
Enables Fast Infoset on the web service.
For more information about Fast Infoset, see:
JAX-WS Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing JAX-WS Web Services for Oracle WebLogic Server.
Oracle Infrastructure Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-11 lists the configuration properties that you can override for Fast Infoset web services.
Table 17-11 Configuration Properties for oracle/fastinfoset_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Max Request Size Policy
Category: Configuration
Configures the maximum size, in bytes, of the request message that can be sent to the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-12 lists the configuration properties that you can override when enabling maximum request size on the web service.
Table 17-12 Configuration Properties for oracle/max_request_size_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Maximum size of the request message, in bytes. A value of |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: MEX Request Processing Service Policy
Category: Configuration
Enables the exchange of web service metadata.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-13 lists the configuration properties that you can override when enabling the exchange of web service metadata.
Table 17-13 Configuration Properties for oracle/mex_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: MTOM Encode Fault Service Policy
Category: Configuration
Enables the creation of MTOM-enabled SOAP fault messages when MTOM is enabled.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration properties that you can override when enabling MTOM encoding for SOAP faults.
Table 17-14 Configuration Properties for oracle/mtom_encode_fault_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Async Web Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached asynchronous web service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-15 lists the configuration property that you can override for the no behavior policy.
Table 17-15 Configuration Property for oracle/no_async_web_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Cache Binary Content Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached binary caching policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-16 lists the configuration property that you can override for the no behavior policy.
Table 17-16 Configuration Property for oracle/no_cache_binary_content_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Fast Infoset Client Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset client policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-17 lists the configuration property that you can override for the no behavior policy.
Table 17-17 Configuration Property for oracle/no_fast_infoset_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Fast Infoset Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-18 lists the configuration property that you can override for the no behavior policy.
Table 17-18 Configuration Property for oracle/no_fast_infoset_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Max Request Size Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached maximum request size policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-19 lists the configuration property that you can override for the no behavior policy.
Table 17-19 Configuration Property for oracle/no_max_request_size_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No MEX Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached web service metadata exchange policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-20 lists the configuration property that you can override for the no behavior policy.
Table 17-20 Configuration Property for oracle/no_mex_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No MTOM Encode Fault Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP fault MTOM encoding policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-21 lists the configuration property that you can override for the no behavior policy.
Table 17-21 Configuration Property for oracle/no_mtom_encode_fault_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Persistence Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached persistence policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-22 lists the configuration property that you can override for the no behavior policy.
Table 17-22 Configuration Property for oracle/no_persistence_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Pox Http Binding Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Plain Old XML (POX) policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-23 lists the configuration property that you can override for the no behavior policy.
Table 17-23 Configuration Property for oracle/no_pox_http_binding_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-24 lists the configuration property that you can override for the no behavior policy.
Table 17-24 Configuration Property for oracle/no_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Schema Validation Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached schema validation policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-25 lists the configuration property that you can override for the no behavior policy.
Table 17-25 Configuration Property for oracle/no_schema_validation_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Soap Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-26 lists the configuration property that you can override for the no behavior policy.
Table 17-26 Configuration Property for oracle/no_soap_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Test Page Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached test page processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-27 lists the configuration property that you can override for the no behavior policy.
Table 17-27 Configuration Property for oracle/no_test_page_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Ws Logging Level Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached logging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-28 lists the configuration property that you can override for the no behavior policy.
Table 17-28 Configuration Property for oracle/no_ws_logging_level_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Wsdl Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WSDL request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-29 lists the configuration property that you can override for the no behavior policy.
Table 17-29 Configuration Property for oracle/no_wsdl_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Persistence Policy
Category: Configuration
Configures the secure conversation persistence mechanism for the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-30 lists the configuration properties that you can override when enabling the policy.
Table 17-30 Configuration Properties for oracle/persistence_policy
| Attribute | Description | Default | Required? |
|---|---|---|---|
|
|
Identifies the persistence provider registered in the system. Possible values are:
Note: For J2SE clients, you can configure |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: Pox Http Binding Service Policy
Category: Configuration
Enables an endpoint to receive non-SOAP XML messages that are processed by a user defined javax.xml.ws.Provider<T>.invoke method.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling the policy.
Table 17-31 Configuration Property for oracle/pox_http_binding_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Request Processing Service Policy
Category: Configuration
Enables the web service endpoint to process incoming requests.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-32 Configuration Property for oracle/request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Schema Validation Policy
Category: Configuration
Enables the validation of request messages against the schema.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-33 Configuration Property for oracle/schema_validation_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Soap Request Processing Service Policy
Category: Configuration
Enables the processing of SOAP requests on the web service endpoint.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-34 Configuration Property for oracle/soap_request_processing_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Test Page Processing Service Policy
Category: Configuration
Enables the Web Service Test Client, as described in "Using the Web Services Test Client" in Administering Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-35 Configuration Property for oracle/test_page_processing_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Ws Logging Level Policy
Category: Configuration
Sets the logging level for diagnostic logs for the web service endpoint.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration properties that you can override when enabling this policy.
Table 17-36 Configuration Property for oracle/ws_logging_level_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Defines the logging level. Valid values include: |
None |
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: Wsdl Request Processing Service
Category: Configuration
Enables access to the WSDL for the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-37 Configuration Property for oracle/ws_logging_level_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Table 17-38 summarize the predefined OWSM management policies.
Table 17-38 Predefined OWSM Management Policies
| Policy Name | Description |
|---|---|
|
Causes the request, response, and fault messages to be sent to a message log. |
Display Name: Log Policy
Category: Management
Causes the request, response, and fault messages to be sent to a message log. By default, this policy logs the entire SOAP message for the request and just the SOAP body information for the response.
Messages are logged to the message log for the domain. For information about viewing and filtering message logs, see "Using Message Logs for Web Services" in Administering Web Services.
Note:
This policy is not supported for Java EE (WebLogic) web services.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is not advertised in the WSDL.
Table 17-39 lists the configuration property that you can override for the log policy.
Table 17-39 Configuration Property for oracle/log_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Table 17-40 summarize the predefined OWSM Message Transmission Optimization Mechanism (MTOM) policies.
Table 17-40 Predefined OWSM MTOM Policies
| Policy Name | Description |
|---|---|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS MTOM policy at a higher scope. |
|
|
Rejects inbound messages that are not in MTOM format and verifies that outbound messages are in MTOM format. |
For more information about attaching MTOM policies, see:
"Configuring MTOM Using Fusion Middleware Control" in Administering Web Services
"Configuring MTOM Using WLST" in Administering Web Services
Display Name: No Behavior MTOM Policy
Category: MTOM Attachments
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached MTOM policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-41 lists the configuration property that you can override for the no behavior policy.
Table 17-41 Configuration Property for oracle/no_mtom_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: WS MTOM Policy
Category: MTOM Attachments
Rejects inbound messages that are not in MTOM format and verifies that outbound messages are in MTOM format. MTOM defines a method for optimizing the transmission of XML data of type xs:base64Binary or xs:hexBinary in SOAP messages. For more information about MTOM, see the following specifications for SOAP 1.2 and 1.1., respectively: http://www.w3.org/TR/2005/REC-soap12-mtom-20050125 and http://www.w3.org/Submission/2006/SUBM-soap11mtom10-20060405.
To enable MTOM on the client of the web service, pass the javax.xml.ws.soap.MTOMFeature as a parameter when creating the web service proxy or dispatch, as illustrated in the following example.
package examples.webservices.mtom.client;
import javax.xml.ws.soap.MTOMFeature;
public class Main {
public static void main(String[] args) {
String FOO = "FOO";
MtomService service = new MtomService()
MtomPortType port = service.getMtomPortTypePort(new MTOMFeature());
String result = null;
result = port.echoBinaryAsString(FOO.getBytes());
System.out.println( "Got result: " + result );
}
}
Note:
Please note the following:This MTOM policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-42 lists the configuration property that you can override for the MTOM policy.
Table 17-42 Configuration Property for oracle/wsmtom_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Table 17-38 summarize the predefined OWSM reliable messaging policies.
Table 17-43 Predefined OWSM Reliable Messaging Policies
| Policy Name | Description |
|---|---|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. |
|
|
Configures web services reliable messaging on the web service and client. |
|
|
Configures version 1.0 of the Web Services Reliable Messaging protocol. |
|
|
Configures version 1.1 of the Web Services Reliable Messaging protocol. |
For more information about attaching reliable messaging policies, see:
"Configuring Reliable Messaging Using Fusion Middleware Control" in Administering Web Services
"Configuring Reliable Messaging Using WLST" in Administering Web Services
Display Name: No Reliable Messaging Policy
Category: Reliable Messaging
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
For more information about reliable messaging, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-44 lists the configuration property that you can override for the no behavior policy.
Table 17-44 Configuration Property for oracle/no_reliable_messaging_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior RM Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/no_reliable_messaging policy, as described in "oracle/no_reliable_messaging_policy".When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-45 lists the configuration property that you can override for the no behavior policy.
Table 17-45 Configuration Property for oracle/no_wsrm_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Reliable Messaging Policy
Category: Reliable Messaging
Configures web services reliable messaging on the web service and client. This policy can be attached to any SOAP-based web service and client.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client. When more than one version is enabled, the generated WSDL has policy alternatives for the given versions, which enables the client to select any version. The client must consistently use the selected version of the protocol for all interaction with a given sequence.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence. Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
Example 17-1 illustrates a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle object and a reliable messaging session is opened on it (openSession). After the messages are sent to the service, the session is closed (closeSession).
Example 17-1 Sample Client Code for Web Services Reliable Messaging
public class ClientServlet extends HttpServlet {
public void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException,
IOException {
int num1 = Integer.parseInt(request.getParameter("num1"));
int num2 = Integer.parseInt(request.getParameter("num2"));
String outputStr = null;
TestService service = new TestService();
Test port = service.getTestPort();
try {
((RMSessionLifecycle) port).openSession();
outputStr = port.hello(inputStr);
} catch (Exception e) {
e.printStackTrace();
outputStr = e.getMessage();
} finally {
((RMSessionLifecycle) port).closeSession();
response.getOutputStream().write(outputStr.getBytes());
}
}
}
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-46 lists the configuration properties that you can override when enabling the policy.
Table 17-46 Configuration Properties for oracle/reliable_messaging_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Maximum interval, in milliseconds, in which the destination endpoint must transmit a standalone acknowledgement. The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Reliable messaging version(s) supported. When more than one version is enabled, the generated WSDL will list policy alternatives for the given versions, allowing the client to select the version. The client must use the selected version consistently for all interactions in a given sequence. Valid values include:
|
|
Optional |
|
|
Flag indicating that non-buffered receipt of messages is requested. This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Number of milliseconds which defines an inactivity interval. After this amount of time, if the destination endpoint has not received a message from the source endpoint, the destination endpoint may consider the sequence to have terminated due to inactivity. The same is true for the source endpoint. By default, sequences never timeout. Implementations of RM source and RM destination are free to manage resources associated with the sequence as desired, but there are no guarantees that the sequence will be usable by either party after the inactivity timeout expires. The value specified must be a positive value and conform to the XML schema duration lexical format, Set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Number of times that the JMS queue on the invoked WebLogic Server instance attempts to deliver the message to the web service implementation until the operation is successfully invoked. |
|
Optional |
|
|
Flag that specifies whether reliable messaging is required. This flag enables a service endpoint to support reliable or non-reliable communication with different clients. If optional is set to When used in combination with an operation-level "required" WS-RM policy, operations without an explicit WS-RM policy do not need to be called with the WS-RM protocol, but operations with an explicit WS-RM policy must be called with the WS-RM protocol. |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
|
|
Delivery assurance for reliable messaging. Valid values include:
|
|
Optional |
|
|
Flag that specifies that messages are delivered in the order that they were sent. |
|
Optional |
|
|
Amount of time after which the reliable web service expires and does not accept any new sequence messages. If this limit is reached before the sequence naturally completes, it will be forcibly terminated. The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Flag that specifies that in order to secure messages in a reliable sequence, the runtime will use the |
|
Optional |
|
|
Flag that specifies that in order to secure messages in a reliable sequence, the RM Sequence must be bound to the session(s) of the underlying transport-level protocol used to carry the When present, this assertion must be used in conjunction with the |
|
Optional |
|
|
Backoff algorithm. If a destination endpoint does not acknowledge a sequence of messages for the time interval specified by the base retransmission interval ( Valid values include:
This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Interval of time that must pass before a message will be retransmitted to the RM destination (in the event a prior transmission failed.) This interval can be used in conjunction with the backoff algorithm ( The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
|
Reliable messaging version(s) supported by the RM source. When the service WSDL contains policy alternatives for multiple RM versions, the client can select the version via this attribute. If the WSDL contains multiple RM versions and this attribute is not explicitly set, then either RM 1.2 is used or the highest version in the WSDL, if the WSDL does not contain RM 1.2. Valid values include:
If the WSDL contains only one RM version, this attribute is ignored and the version in the WSDL is used. Other possible values are DEFAULT, WS_RM_1_0, and WS_RM_1_1. |
|
Optional |
|
|
See "reference.priority". |
None |
Optional |
Display Name: WS RM10 Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/reliable_messaging policy, as described in "oracle/reliable_messaging_policy".Configures version 1.0 of the Web Services Reliable Messaging protocol. This policy can be attached to any SOAP-based client or endpoint.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence. Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
Example 17-1 illustrates a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle object and a reliable messaging session is opened on it (openSession). After the messages are sent to the service, the session is closed (closeSession).
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-47 lists the configuration properties that you can override for the reliable messaging policy.
Table 17-47 Configuration Properties for the wsrm10_policy
| Name | Description | Default | Required |
|---|---|---|---|
|
|
Delivery assurance. The following defines the delivery assurance types:
In addition, you can configure whether messages are delivered in the order that they were sent. Valid values include
|
|
Optional |
|
|
Type of message store. Valid values include:
|
|
Optional |
|
|
Name of the message store. |
|
Optional |
|
|
JNDI reference to a JDBC data source. This field is valid only if StoreType is set to JDBC. This value takes precedence over jdbc-connection-url. The username and password will be used if both are present. |
jdbc/MessagesStore |
Optional |
|
|
Number of milliseconds which defines an inactivity interval. After this amount of time, if the destination endpoint has not received a message from the source endpoint, the destination endpoint may consider the sequence to have terminated due to inactivity. The same is true for the source endpoint. By default, sequences never timeout. Implementations of RM source and RM destination are free to manage resources associated with the sequence as desired, but there are no guarantees that the sequence will be usable by either party after the inactivity timeout expires. |
|
Optional |
|
|
Interval of time that must pass before a message will be retransmitted to the RM destination (in the event a prior transmission failed.) |
|
Optional |
Display Name: WS RM11 Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/reliable_messaging policy, as described in "oracle/reliable_messaging_policy".Configures version 1.1 of the Web Services Reliable Messaging protocol. This policy can be attached to any SOAP-based client or endpoint.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
Example 17-1 illustrates a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle object and a reliable messaging session is opened on it (openSession). After the messages are sent to the service, the session is closed (closeSession).
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-47 lists the configuration properties that you can override for this policy
Table 17-48 summarizes the predefined OWSM authentication only security policies.
Note:
There are no predefined policies for two authentication only scenarios: Kerberos over SSL and SPNEGO. To use these scenarios, create your own policies that use the Kerberos over SSL and SPNEGO assertion templates described in "Predefined Assertion Templates".Table 17-48 Predefined OWSM Authentication Only Policies
| Policy Name | Description |
|---|---|
|
Includes credentials in the HTTP header for outbound client requests and verifies that the transport protocol is HTTPS. |
|
|
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store and verifies that the transport protocol is HTTPS. |
|
|
Verifies that the OAM agent has authenticated the user and has established an identity. |
|
|
Includes a SAML Bearer V2.0 token in the HTTP header. |
|
|
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header. |
|
|
Includes a SAML Bearer v2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically, and verifies that the transport protocol provides SSL message protection. |
|
|
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header, and verifies that the transport protocol provides SSL message protection. |
|
|
Enforces one of the following authentication policies, based on the token sent by the client:
|
|
|
Enforces one of the following authentication policies, based on the token sent by the client:
|
|
|
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. |
|
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. |
|
|
Includes credentials in the HTTP header for outbound client requests. |
|
|
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store. |
|
|
Includes credentials in the WS-Security UsernameToken header for all outbound SOAP request messages. |
|
|
Uses the credentials in the UsernameToken WS-Security SOAP header to authenticate users. |
|
|
Includes SAML tokens in outbound SOAP request messages. |
|
|
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. |
|
|
Includes SAML tokens in outbound SOAP request messages. |
|
|
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. |
|
|
Includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
|
Extracts the Kerberos token from the SOAP header and authenticates the user. |
Display Name: HTTP Basic Auth Over SSL Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-34, "wss_http_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way, as described in "Configuring SSL on WebLogic Server (One-Way)"
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed using the Administration Console, as described in "Configuring an Authentication Provider in WebLogic Server".
Display Name: HTTP Basic Auth Over SSL Service Policy
Category: Security
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based endpoint.
Note:
This policy functions similarly to oracle/wss_http_token_over_ssl_service_policy. The difference is thatoracle/wss_http_token_over_ssl_service_policy enables the include-timestamp attribute in the require-tls element to prevent replay attacks, a feature that is not applicable to RESTful services. For more information about the require-tls element, see "orasp:require-tls".This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when the associated policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-35, "wss_http_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed using the Administration Console, as described in "Configuring an Authentication Provider in WebLogic Server".
Display Name: HTTP OAM Service Policy
Category: Security
Verifies that the OAM agent has authenticated the user and has established an identity. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when the associated policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-3, "http_oam_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To enforce HTTP OAM security, configure OAM WebGate to intercept the request, authenticate the user, and set the OAM_REMOTE_USER HTTP header. OWSM verifies that the OAM_REMOTE_USER_HTTP header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: HTTP Saml Bearer V2.0 Token Client Policy
Category: Security
Includes a SAML Bearer V2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically. This policy can be enforced on any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
To configure the policy, override the configuration properties defined in Table 18-5, "http_saml20_token_bearer_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML for the web service client at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: HTTP Saml Bearer V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header. The credentials in the SAML token are authenticated against a SAML v2.0 login module. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Display Name: HTTP Saml Bearer V2.0 Token Over SSL Client Policy
Category: Security
Includes a SAML Bearer v2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically, and verifies that the transport protocol provides SSL message protection. This policy can be attached to any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-5, "http_saml20_token_bearer_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring SSL for a Web Service Client".
Configure SAML for the web service client at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: HTTP Saml Bearer V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header, and verifies that the transport protocol provides SSL message protection. The credentials in the SAML token are authenticated against a SAML v2.0 login module. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Configure one-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Display Name: Multi Token RESTful Service Policy
Category: Security
Enforces one of the following authentication policies, based on the token sent by the client:
HTTP Basic—Extracts username and password credentials from the HTTP header.
SAML v2.0 Bearer token in the HTTP header—Extracts SAML 2.0 Bearer assertion in the HTTP header.
HTTP OAM security—Verifies that the OAM agent has authenticated user and establishes identity.
SPNEGO over HTTP security—Extracts Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token from the HTTP header.
This policy contains assertions that are based on the following assertion templates as an OR group—meaning any one of the tokens can be sent by the client:
oracle/http_oam_token_service_template. (Provides OAM protection on the server-side only.)
The oracle/http_saml20_token_bearer_client_template and oracle/http_spengo_token_service_template policy assertions are advertised.
The wss_http_token_client_template and oracle/http_oam_token_service_template assertions are not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in one of the following sections, based on the token sent by the client. For more information, see "Overriding Policy Configuration Properties".
Table 18-35, "wss_http_token_over_ssl_service_template Configuration Properties"
Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties"
Table 18-3, "http_oam_token_service_template Configuration Properties"
Table 18-9, "http_spnego_token_service_template Configuration Properties"
To configure HTTP OAM security:
Configure the OAM service endpoint as anonymous using the OAM Console.
Configure OAM WebGate to intercept a client request, authenticate the user, and set the OAM_REMOTE_USER HTTP header. OWSM verifies that the OAM_REMOTE_USER_HTTP header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: Multi Token Over SSL RESTful Service Policy
Category: Configuration
Enforces one of the following authentication policies, based on the token sent by the client:
HTTP Basic over SSL—Extracts username and password credentials from the HTTP header.
SAML 2.0 Bearer token in the HTTP header over SSL—Extracts SAML 2.0 Bearer assertion in the HTTP header.
HTTP OAM security (non-SSL)—Verifies that the OAM agent has authenticated user and establishes identity.
SPNEGO over HTTP security (non-SSL)—Extracts SPNEGO token information from the HTTP header.
This policy contains assertions that are based on the following assertion templates as an OR group—meaning any one of the tokens can be sent by the client:
The oracle/wss_http_token_over_ssl_client_template, oracle/http_samle20_token_bearer_service_template, and oracle/http_spengo_token_service_template assertions are advertised in the WSDL.
The oracle/http_oam_token_service_template assertions are not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in one of the following sections, based on the token sent by the client. For more information, see "Overriding Policy Configuration Properties".
Table 18-35, "wss_http_token_over_ssl_service_template Configuration Properties"
Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties"
Table 18-3, "http_oam_token_service_template Configuration Properties"
Table 18-9, "http_spnego_token_service_template Configuration Properties"
To configure HTTP OAM security:
Configure the OAM service endpoint as anonymous using the OAM Console.
Configure OAM WebGate to intercept the request, authenticate the user, and set the OAM_REMOTE_USER HTTP header. OWSM verifies that the OAM_REMOTE_USER_HTTP header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: No Behavior Authentication Client Policy
Category: Security
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authentication assertion, those assertions are disabled as well. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-49 lists the configuration property that you can override for the no behavior policy.
Table 17-49 Configuration Property for oracle/no_authentication_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Authentication Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authentication assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-50 lists the configuration property that you can override for the no behavior policy.
Table 17-50 Configuration Property for oracle/no_authentication_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Wss HTTP Token Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests. The client must pass the credentials in the HTTP header. This policy can be enforced on any HTTP-based client.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised.
To configure the policy:
Override the configuration properties defined in Table 18-11, "wss_http_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
The client must pass the credentials in the HTTP header.
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store. This policy can be enforced on any HTTP-based endpoint.
The web service must authenticate the supplied username and password credentials against the configured authentication source.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-12, "wss_http_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
The web service must authenticate the supplied username and password credentials against the configured authentication source. Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Display Name: Wss Username Token Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header for all outbound SOAP request messages. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy supports plain text passwords. This client policy is analogous to the oracle/wss_username_token_service_policy service endpoint policy.
Note:
This policy transmits the password in clear text. You should use this policy in low security situations only, or when you know that the transport is protected using some other mechanism.Alternatively, consider:
Copying the policy and setting the password type to digest, as described in "Creating and Editing Web Service Policies".
Using the SSL version of this policy, "oracle/wss_username_token_over_ssl_client_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-14, "wss_username_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Service Policy
Category: Security
Uses the credentials in the UsernameToken WS-Security SOAP header to authenticate users. This policy supports plain text passwords.
Note:
This policy transmits the password in clear text. You should use this policy in low security situations only, or when you know that the transport is protected using some other mechanism.Alternatively, consider:
Copying the policy and setting the password type to digest, as described in "Creating and Editing Web Service Policies".
Using the SSL version of this policy, "oracle/wss_username_token_over_ssl_client_policy".
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-15, "wss_username_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Display Name: Wss10 SAML Token Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The policy can be enforced on any SOAP-based client.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-17, "wss10_saml_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches.
Display Name: Wss10 SAML Token Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-18, "wss10_saml_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Display Name: Wss10 SAML V2.0 Token Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The policy can be enforced on any SOAP-based client.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-20, "wss10_saml20_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches.
Display Name: Wss10 SAML V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-21, "wss10_saml20_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Display Name: Wss11 Kerberos Token Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with MIT and Active Directory KDCs. This policy can be enforced on any SOAP-based client.
Service principal names (SPN) are a key component in Kerberos authentication. SPNs are unique identifiers for services running on servers. Every service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. If an SPN is not set for a service, clients have no way of locating that service and Kerberos authentication is not possible.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-23, "wss11_kerberos_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Kerberos, as described in "Configuring Kerberos Tokens".
The web service client that is enforcing Kerberos client side policies needs to know the service principal name of the service it is trying to access. You can specify a value for service.principal.name, as described in "Overriding Policy Configuration Properties". The default value (place holder) is HOST/localhost@oracle.com.
At design time:
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Set the service principal name (service.principal.name). The service principal name specifies the name of the service principal for which the client requests a ticket from the KDC. For more information, see "Overriding Policy Configuration Properties".
If the Kerberos authentication is successful, then send the obtained Kerberos ticket and authenticator to the web service enclosed in a BinarySecurityToken element in the SOAP Security header.
Display Name: Wss11 Kerberos Token Service Policy
Category: Security
Extracts the Kerberos token from the SOAP header and authenticates the user. This policy is enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. The container must have the Kerberos infrastructure configured through OPSS. This policy is compatible with MIT and Active Directory KDCs. This policy can be attached to any SOAP-based endpoint.
Service principal names (SPN) are a key component in Kerberos authentication. SPNs are unique identifiers for services running on servers. Every service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. If an SPN is not set for a service, clients have no way of locating that service and Kerberos authentication is not possible.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-24, "wss11_kerberos_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule login module, as described in "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Table 17-51 summarize the predefined OWSM authorization only security policies.
Table 17-51 Predefined OWSM Authorization Only Policies
| Policy Name | Description |
|---|---|
|
Provides a simple role-based authorization policy based on the authenticated subject at the SOAP binding level. |
|
|
Provides a simple role-based authorization for the request based on the authenticated Subject at the SOAP binding level. |
|
|
Provides a permission-based authorization policy based on the authenticated subject. |
|
|
Provides a simple role-based authorization policy based on the authenticated subject. |
|
|
Provides a simple role-based authorization policy based on the authenticated subject. |
|
|
Provides a permission-based authorization policy based on the authenticated Subject. |
|
|
When directly attached to a SOA component or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. |
|
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy". |
|
|
Accepts requests only if one of the following conditions is true:
|
Display Name: Binding Authorization DenyAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated Subject at the SOAP binding level. This policy denies all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-109, "binding_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Binding Authorization PermitAll Policy
Category: Security
Provides a simple role-based authorization for the request based on the authenticated Subject at the SOAP binding level. This policy permits all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-109, "binding_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Binding Permission Based Authorization Policy
Category: Security
Provides a permission-based authorization policy based on the authenticated subject. This policy should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy ensures that the subject has permission to perform the operation. To do this, the Authorization Policy executor leverages OPSS to check if the authenticated subject has been granted oracle.wsm.security.WSFunctionPermission (or whatever permission class is specified in Permission Check Class) using the Resource Pattern and Action Pattern as parameters. For more information, see "Determining Authorization Permissions".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-111, "binding_permission_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Use Fusion Middleware Control to grant the WSFunctionPermission (or other) permission to the user, group, or application that will attempt to authenticate to the web service.
Optionally, change the permission_class configuration property for the policy, which identifies the permission class as per JAAS standards. The class must be available in the server classpath. The custom permission class must extend the abstract Permission class and implement the Serializable interface. See the Javadoc at http://docs.oracle.com/javase/7/docs/api/java/security/Permission.html. The default is oracle.wsm.security.WSFunctionPermission.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Authorization DenyAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated subject. This policy denies all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-113, "component_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Authorization PermitAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated subject. This policy permits all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-113, "component_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Permission Based Authorization Policy
Category: Security
Provides a permission-based authorization policy based on the authenticated Subject. This policy should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy ensures that the subject has permission to perform the operation. To do this, the Authorization Policy executor leverages OPSS to check if the authenticated subject has been granted oracle.wsm.security.WSFunctionPermission (or whatever permission class is specified in Permission Check Class) using the Resource Pattern and Action Pattern as parameters. Resource Pattern and Action Pattern are used to identify if the authorization assertion is to be enforced for this particular request. Access is allowed if the authenticated subject has been granted WSFunctionPermission. For more information, see "Determining Authorization Permissions".
You can grant the WSFunctionPermission permission to a user, a group, or an application role. If you grant WSFunctionPermission to a user or group it will apply to all applications that are deployed in the domain.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-115, "component_permission_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Use Fusion Middleware Control to grant the WSFunctionPermission permission to the user, group, or application that will attempt to authenticate to the web service.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: No Behavior Authorization Component Policy
Category: Security
When directly attached to a SOA component or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled as well. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-52 lists the configuration property that you can override for the no behavior policy.
Table 17-52 Configuration Property for oracle/no_authorization_component_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Authorization Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-53 lists the configuration property that you can override for the no behavior policy.
Table 17-53 Configuration Property for oracle/no_authorization_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Constraints Based Authorization Policy
Category: Security
This policy is a special case of role based authorization policy. This policy can be attached to any SOAP-based endpoint.
Accepts requests only if one of the following conditions is true:
The authenticated token is SAML Sender Vouches.
The user is in a particular role (the default is trustedEnterpriseRole, that establishes the user as a trusted entity
The request is coming from within a private network.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
To successfully invoke a service that has the whitelist_authorization_policy attached, you must do one of the following:
If the service accepts SAML sender vouches for authentication (for example, a SAML token service policy is attached to the service), you must attach the corresponding SAML token client policy to the client.
If the service accepts username/password for authentication (for example, a username token service policy is attached to the service), you must attach the corresponding username token client policy to the client and make sure that the client is in a trusted role as defined in the policy. (By default, the role defined in the predefined policy is trustedEnterpriseRole. You need to modify this role in the predefined policy.)
If the service is invoked using Oracle HTTP Server, and it is configured to indicate that the request came from a private internal network (see "Configuring the Oracle HTTP Server to Specify the Request Origin"), then a client on the internal network only has to attach the corresponding username token client policy at the client side.
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. You use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
You must configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
The Constraint Pattern property setting contains a requestOrigin field that specifies whether the request originated from an internal or external network. This property is valid only when using Oracle HTTP Server and the Oracle HTTP Server administrator has added a custom VIRTUAL_HOST_TYPE header to the request. To configure the Oracle HTTP Server, see "Configuring the Oracle HTTP Server to Specify the Request Origin".
Table 17-54 summarize the predefined OWSM message protection only security policies.
Table 17-54 Predefined Message Protection Only Security Policies
| Policy Name | Description |
|---|---|
|
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. |
|
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. |
|
|
Provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
|
Enforces message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
|
Provides message integrity and confidentiality for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
|
Enforces message integrity and confidentiality for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
Display Name: No Behavior Message Protection Client Policy
Category: Security
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the message protection assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-55 lists the configuration property that you can override for the no behavior policy.
Table 17-55 Configuration Property for oracle/no_messageprotection_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Message Protection Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the message protection assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
This policy is not supported for Java EE (WebLogic) web services.All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-56 lists the configuration property that you can override for the no behavior policy.
Table 17-56 Configuration Property for oracle/no_messageprotection_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: Wss10 Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-27, "wss10_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To configure OPSS, set up the OWSM keystore and the web service client keystore, as described in "Configuring Keystores for Message Protection". The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
You can include signature and encryption elements in the Security header in conformance with the WS-Security 1.0 standards.
Example 17-2 shows the typical structure of a signature included in the Security header. In this example, the body element of the SOAP message is signed.
Example 17-2 WS-Security 1.0 Message Integrity of SOAP Message
<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<dsig:SignedInfo>
<dsig:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<dsig:Reference URI="#Timestamp-...">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<dsig:DigestValue>...</dsig:DigestValue>
</dsig:Reference>
<dsig:Reference URI="#Body-...">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<dsig:DigestValue>...</dsig:DigestValue>
</dsig:Reference>
<dsig:Reference URI="#KeyInfo-...">
<dsig:Transforms>
<dsig:Transform
Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
<TransformationParameters xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns="http://www.w3.org/2000/09/xmldsig#"/>
</TransformationParameters>
</dsig:Transform>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<dsig:DigestValue>...</dsig:DigestValue>
</dsig:Reference>
</dsig:SignedInfo>
<dsig:SignatureValue>....</dsig:SignatureValue>
<dsig:KeyInfo Id="KeyInfo-...">
<wsse:SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier"
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">
...</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
</dsig:Signature>
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Example 17-3 WS-Security 1.0 Message Confidentiality of SOAP Message
<env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-JA9fsCRnqbFJ0ocBAMKb7g22">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content" Id="...">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<xenc:CipherData>
<xenc:CipherValue>...</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</env:Body>
Display Name: Wss10 Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The messages are protected using WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-28, "wss10_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. You also need to store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Message Protection Client Policy
Category: Security
Provides message integrity and confidentiality for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
Symmetric key technology is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-30, "wss11_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore and the web service client keystore, as described in "Configuring Keystores for Message Protection". The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-4 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Example 17-4 WS-Security 1.1 Message Confidentiality of SOAP Message
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="EK-...">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" />
</xenc:EncryptionMethod>
<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1"
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">...</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>...</xenc:CipherValue>
</xenc:CipherData>
<xenc:ReferenceList>
<xenc:DataReference URI="#_..." />
</xenc:ReferenceList>
</xenc:EncryptedKey>
<env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-...">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content" Id="...">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Reference URI="#EK-..." ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" />
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>...</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</env:Body>
Display Name: Wss11 Message Protection Service Policy
Category: Security
Enforces message integrity and confidentiality for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-31, "wss11_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. You also need to store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Table 17-57 summarize the predefined OWSM message protection and authentication security policies.
Table 17-57 Predefined OWSM Message Protection and Authentication Policies
| Policy Name | Description |
|---|---|
|
Encrypts the PII data you want to protect. |
|
|
Specifies the STS client configuration information that is used to invoke the STS for token exchange. |
|
|
Specifies the STS configuration information that is used to invoke the STS for token exchange. |
|
|
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
|
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
|
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
|
Includes SAML tokens in outbound SOAP request messages. |
|
|
Includes SAML tokens in outbound SOAP request messages. |
|
|
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. |
|
|
Includes credentials in the HTTP header for outbound client requests, authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. |
|
|
Extracts the credentials in the HTTP header and authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. |
|
|
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type. |
|
|
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
|
Includes SAML tokens in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
|
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header, and verifies that the transport protocol provides SSL message protection. |
|
|
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
|
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
|
oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_policy |
Inserts a SAML bearer assertion issued by a trusted STS. |
|
oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_policy |
Authenticates a SAML bearer assertion issued by a trusted STS. |
|
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
|
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. |
|
|
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
|
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. |
|
|
oracle/wss10_saml_hok_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and SAML holder of key based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_hok_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML holder of key based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_integrity_client_policy |
Provides message-level integrity and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_integrity_service_policy |
Enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_protection_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_protection_ski_basic256_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml_token_with_message_protection_ski_basic256_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml20_token_with_message_protection_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_saml20_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_username_id_propagation_with_msg_protection_client_policy |
Provides message protection (integrity and confidentiality) and identity propagation for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_username_id_propagation_with_msg_protection_service_policy |
Enforces message level protection (i.e., integrity and confidentiality) and identity propagation for inbound SOAP requests using mechanisms described in WS-Security 1.0. |
|
oracle/wss10_username_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_username_token_with_message_protection_service_policy |
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_username_token_with_message_protection_ski_basic256_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_username_token_with_message_protection_ski_basic256_service_policy |
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_x509_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and certificate credential population for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss10_x509_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
oracle/wss11_kerberos_token_with_message_protection_client_policy |
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
oracle/wss11_kerberos_token_with_message_protection_service_policy |
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy |
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy |
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
oracle/wss11_saml_or_username_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML, username, or HTTP token, respectively:
|
|
oracle/wss11_saml_token_identity_switch_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml_token_with_message_protection_wssc_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml_token_with_message_protection_wssc_reauthn_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml_token_with_message_protection_wssc_reauthn_service_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml20_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
|
oracle/wss11_saml20_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_sts_issued_saml_hok_with_message_protection_client_policy |
Inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS. |
|
oracle/wss11_sts_issued_saml_hok_with_message_protection_service_policy |
Authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). |
|
oracle/wss11_username_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client. |
|
oracle/wss11_username_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_username_token_with_message_protection_wssc_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_username_token_with_message_protection_wssc_service_policy |
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_x509_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_x509_token_with_message_protection_service_policy |
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_x509_token_with_message_protection_wssc_client_policy |
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
oracle/wss11_x509_token_with_message_protection_wssc_service_policy |
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
Display Name: PII Security Policy
Category: Security
Encrypts the Personally Identifiable Information (PII) data you want to protect.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
Override the configuration properties defined in Table 18-93, "pii_security_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Display Name: STS Trust Configuration Client Policy
Category: Security
Specifies the STS client configuration information that is used to invoke the STS for token exchange.
Use this policy only if you are not using Automatic (Client STS) Policy Configuration, as described in "Setting Up Automatic Policy Configuration for STS"
If you attach multiple instances of oracle/sts_trust_config_client_policy, no error is generated. However, only one instance is enforced, and you cannot control which instance that is.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised.
To configure the policy:
Override the configuration properties defined in Table 18-96, "oracle/sts_trust_config_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the STS configuration policy from the web service, as described in "Setting Up Automatic Policy Configuration for STS".
However, if you did not configure the STS configuration policy from the web service, or if you are using the SAML sender vouches confirmation method, then you must configure it from the web service client. For more information, see "Manually Configuring the STS Config Policy From the Web Service Client: Main Steps".
At design time, you can set up and attach the oracle/sts_trust_config_client_policy policy programmatically, as shown in Example 17-5 and Example 17-6.
Example 17-5 Sample JSE Proxy Client
URL endpointUrl = new URL(getWebConnectionString() + "/jaxws-test-service/jaxws-test-port");
ServiceDelegateImpl client = new ServiceDelegateImpl(
new URL(endpointUrl.toString() + "?WSDL"),
new QName("http://jaxws.example.com/targetNamespace/JaxwsService", "JaxwsService"),
OracleService.class);
JaxwsService port = client.getPort(
new QName("http://jaxws.example.com/targetNamespace/JaxwsService", "JaxwsServicePort"),
test.jaxws.client.JaxwsService.class);
((BindingProvider)port).getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY,endpointUrl.toExternalForm());
((BindingProvider)port).getRequestContext().put(ClientConstants.CLIENT_CONFIG,
fileToElement(new File("./jaxws/client/dat/oracle-webservice-client.xml")));
The related oracle-webservice-client.xml file with the STS config policy and STS issue policy is shown in Example 17-6.
Example 17-6 Sample oracle-webservice-client.xml
<?xml version="1.0" encoding="UTF-8"?>
<oracle-webservice-clients>
<webservice-client>
<port-info>
<policy-references>
<policy-reference uri="oracle/sts_trust_config_client_policy" category="security"/>
<policy-reference uri="oracle/wss11_sts_issue_saml_hok_with_message_protection_client_policy " category="security"/>
</policy-references>
</port-info>
</webservice-client>
</oracle-webservice-clients>
Display Name: STS Trust Configuration Service Policy
Category: Security
Specifies the STS configuration information that is used to invoke the STS for token exchange.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-98, "oracle/sts_trust_config_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration for STS".
Display Name: WSSecurity SAML Token Bearer or WSSecurity UserName Token
Category: Security
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the bearer confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains the following assertions as an OR group—meaning either type of policy can be enforced by a client:
The assertions are advertised in the WSDL.
Display Name: Wss SAML Token or Wss Username Token Service Policy
Category: Security
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion templates, as an OR group—meaning either one of the tokens can be sent by the client:
The assertions are advertised in the WSDL.
For information about configuring this policy, refer to the following policy descriptions:
Display Name: Wss SAML Token or Wss Username Token Over SSL Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion templates as an OR group—meaning either one of the tokens can be sent by the client:
The assertions are advertised in the WSDL.
For information about configuring this policy, refer to the following policy descriptions:
Display Name: Wss SAML Token (confirmation method as bearer) Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-41, "wss_saml_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss SAML Token (confirmation method as bearer) Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically. The policy also verifies that the transport protocol provides SSL message protection. This policy can be attached to any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-41, "wss_saml_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss SAML Token (confirmation method as bearer) Over SSL Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. The policy verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-42, "wss_saml_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss HTTP Token Over SSL Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests, authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. The client must pass the credentials in the HTTP header.
Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based client.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-34, "wss_http_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring SSL for a Web Service Client".
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
The client must pass the credentials in the HTTP header.
Display Name: Wss HTTP Token Over SSL Service Policy
Category: Security
Extracts the credentials in the HTTP header and authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based endpoint.
Notes:
This policy functions similarly to oracle/http_basic_auth_over_ssl_service_policy. The only difference is thatoracle/wss_http_token_over_ssl_service_policy enables the include-timestamp attribute in the require-tls element to prevent replay attacks, which is not applicable to RESTful services. For more information about the require-tls element, see "orasp:require-tls".
Currently only HTTP basic authentication is supported.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-35, "wss_http_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring SSL for a Web Service Client".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Display Name: Wss SAML Token Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type. The policy verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-47, "wss_saml_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss SAML Token Over SSL Service Policy
Category: Security
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. The SAML token is mapped to a user in the configured identity store. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-48, "wss_saml_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss SAML V2.0 Token (confirmation method as bearer) Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. The SAML token with confirmation method Bearer is created automatically. This policy can be attached to any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-44, "wss_saml20_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context on the Configurations page, or override it on a per-client basis using the Security Configuration Details control when you attach the policy. The propagate.identity.context property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss SAML V2.0 Token (confirmation method as bearer) Over SSL Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header, and verifies that the transport protocol provides SSL message protection. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-45, "wss_saml20_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss SAML V2.0 Token Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-50, "wss_saml20_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss SAML V2.0 Token Over SSL Service Policy
Category: Security
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. The SAML token is mapped to a user in the configured identity store. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-45, "wss_saml20_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss Issued Token with Saml Bearer Over SSL Client Policy
Category: Security
Inserts a SAML bearer assertion issued by a trusted STS. Messages are protected using SSL.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-100, "oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template Properties". For more information, see "Overriding Policy Configuration Properties". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "How to Configure SAML Web Service Client at Design Time".
Display Name: Wss Issued Token with Saml Bearer Over SSL Service Policy
Category: Security
Authenticates a SAML bearer assertion issued by a trusted STS. Messages are protected using SSL.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
See also "WS-Trust Assertion Templates" for more information about the assertion.
To configure the policy:
Override the configuration properties defined in Table 18-101, "oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template Properties". For more information, see "Overriding Policy Configuration Properties". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss Username Token Over SSL Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-53, "wss_username_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Over SSL Service Policy
Category: Security
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-54, "wss_username_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
The username and password must exist and be valid.
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss Username Token Over SSL with secure conversation enabled Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy has secure conversation enabled. For more information, see Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-53, "wss_username_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure secure conversation, as describe in Chapter 12, "Configuring Secure Conversation".
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. See "Adding Keys and User Credentials to the Credential Store" for information about how to add the key to the credential store.
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Over SSL with secure conversation enabled Service Policy
Category: Security
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy has secure conversation enabled. For more information, see Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-54, "wss_username_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
The username and password must exist and be valid.
Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss10 SAML Holder-Of-Key Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and SAML holder of key based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. A SAML token, included in the SOAP message, is used in SAML-based authentication with holder of key confirmation.
The policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-56, "wss10_saml_hok_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. See "Adding an Additional SAML Assertion Issuer Name" for additional considerations.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Override the saml.assertion.filename property to point to the file that has the holder-of-key assertion, as described in "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Override the saml.assertion.filename property to point to the file that has the holder-of-key assertion. For more information, see "Overriding Client Policy Configuration Properties at Design Time".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Holder-Of-Key Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML holder of key based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-57, "wss10_saml_hok_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Note:
ACertificateExpiredException is returned if an expired certificate is present in the keystore, regardless of whether this certificate is being referenced. To resolve this exception, remove the expired certificate from the keystore.Configure one-way or two-way SSL, as described in "Configuring SSL on WebLogic Server (One-Way)" or "Configuring Two-Way SSL for a Web Service Client", respectively.
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Store the trusted certificate of the SAML authority in the keystore.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Display Name: Wss10 SAML Token With Message Integrity Client Policy
Category: Security
Provides message-level integrity and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. A SAML token, included in the SOAP message, is used in SAML-based authentication with sender vouches confirmation.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies and SHA-1 hashing algorithm for message integrity. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-59, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure SAML, as described in "Configuring SAML".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the client for SAML at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Integrity Service Policy
Category: Security
Enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. It extracts the SAML token from the WS-Security binary security token or the current Java Authentication and Authorization Service (JAAS) subject, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies and SHA-1 hashing algorithm for message integrity. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-60, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Display Name: Wss10 SAML Token With Message Protection Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-59, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure SAML, as described in "Configuring SAML".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the client for SAML at design time, as described in "How to Configure SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-60, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Store the trusted certificate of the SAML authority in the keystore.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Display Name: Wss10 SAML Token With Message Protection SKI Basic 256 Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-59, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Configure SAML, as described in "Configuring SAML".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Protection SKI Basic 256 Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites"
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-60, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Specify a value for propagate.identity.context, as described in "Overriding Policy Configuration Properties". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
This policy requires you to set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Display Name: Wss10 SAML V2.0 Token With Message Protection Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-62, "wss10_saml20_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include, as described in "Configuring Keystores for Message Protection".
Specify a value for propagate.identity.context, as described in "Configuring Keystores for Message Protection". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML V2.0 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-63, "wss10_saml20_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml2.loginmodule login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
This policy requires you to set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Display Name: Wss10 Username Id Propagation With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and identity propagation for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Credentials (only username) are included in outbound SOAP request messages via a WS-Security UsernameToken header. No password is included.This policy can be enforced on any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
Message protection is provided using WS-Security's Basic128 suite of asymmetric key technologies. Specifically RSA key mechanisms for confidentiality, SHA-1 hashing algorithm for integrity and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-65, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>) in the SOAP request message. The client provides a username and password for authentication.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Id Propagation With Message Protection Service Policy
Category: Security
Enforces message level protection (i.e., integrity and confidentiality) and identity propagation for inbound SOAP requests using mechanisms described in WS-Security 1.0. This policy can be enforced on any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
Message protection is provided using WS-Security 1.0's Basic128 suite of asymmetric key technologies. Specifically RSA key mechanisms for confidentiality, SHA-1 hashing algorithm for integrity and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-66, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 Username Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-65, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For more information about the how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Token With Message Protection Service Policy
Category: Security
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-66, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 Username Token With Message Protection SKI Basic 256 Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-65, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for csf-key, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For more information about the how to add the key to the credential store, see "Adding Keys and User Credentials to the Credential Store".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Token With Message Protection SKI Basic 256 Service Policy
Category: Security
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-66, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 X509 Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate credential population for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-68, "wss10_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-2 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 X509 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-68, "wss10_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure an Authentication provider, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.sig.csf.key and keystore.enc.csf.key server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Kerberos Token With Message Protection Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard.
This policy can be enforced on any SOAP-based client.
This policy is compatible with MIT Kerberos KDC and with newer versions of Active Directory KDC. It is not compatible with versions of Active Directory earlier than 2008 because it uses Triple DES encryption. With these earlier versions, use "oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-71, "wss11_kerberos_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Configure Kerberos tokens, as described in "Configuring Kerberos Tokens".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-4 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Kerberos Token With Message Protection Service Policy
Category: Security
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. It extracts the Kerberos token from the SOAP header and authenticates the user, and it enforces message integrity and confidentiality using Kerberos keys. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
This policy can be enforced on any SOAP-based endpoint.
This policy is compatible with MIT Kerberos KDC and with newer versions of Active Directory KDC. It is not compatible with versions of Active Directory earlier than 2008 because it uses Triple DES encryption. With these earlier versions, use "oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-71, "wss11_kerberos_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule login module. See "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Display Name: Wss11 Kerberos Token With Message Protection Basic 128 Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with Active Directory KDCs. This policy can be enforced on any SOAP-based client.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-74, "wss11_kerberos_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Configure Kerberos tokens, as described in "Configuring Kerberos Tokens".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Kerberos Token With Message Protection Basic 128 Service Policy
Category: Security
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with Active Directory KDCs. This policy can be attached to any SOAP-based endpoint.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy extracts the Kerberos token from the SOAP header and authenticates the user, and it enforces message integrity and confidentiality using Kerberos keys. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
To configure the policy:
Override the configuration properties defined in Table 18-75, "wss11_kerberos_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule login module. See "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token or Wss11 Username Token With Message Protection or Wss SAML Token(Confirmation Method As Bearer) Over SSL or Wss Username Token Over SSL or Http Basic Auth Over SSL Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML, username, or HTTP token, respectively:
SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
Username token authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
SAML-based authentication using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. Verifies that the transport protocol provides SSL message protection.
Username token authentication using the credentials in the UsernameToken WS-Security SOAP header to authenticate users against the configured identity store. Verifies that the transport protocol provides SSL message protection.
HTTP authentication using credentials extracted from the HTTP header to authenticate users against the configured identity store. Verifies that the transport protocol is HTTPS.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains the following assertions, as an OR group—meaning any one of the tokens can be sent by the client:
oracle/wss11_saml_token_with_message_protection_service_template
oracle/wss11_username_token_with_message_protection_service_template
The assertions are advertised in the WSDL.
Display Name: Wss11 Saml Token Identity Switch With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
subject.precedence is set to false to allow for the use of a client-specified username rather than the authenticated subject. (If subject.precedence is false, the user name to create the SAML assertion is obtained only from the csf-key username property.) The wss11_saml_token_identity_switch_with_message_protection_client_policy policy requires that an application to which the policy is attached must have the WSIdentityPermission permission. That is, applications from which OWSM accepts the externally-supplied identity must have the WSIdentityPermission permission. This is to avoid potentially rogue applications from providing an identity to OWSM.
For information about configuring this policy, see "Configuring SAML Web Service Clients for Identity Switching". In particular, you need to set the javax.xml.ws.security.auth.username property, as described in "Set the javax.xml.ws.security.auth.username Property", and the WSIdentityPermission permission, as descried in "Set the WSIdentityPermission Permission".
For additional SAML considerations, see "How to Configure SAML Web Service Client at Design Time".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for saml.issuer.uri, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Configuring Keystores for Message Protection". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection Service Policy
Category: Security
This policy enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-78, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Configuring Keystores for Message Protection". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection with secure conversation enabled Service Policy
Category: Security
This policy enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-78, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token With Message Protection with secure conversation and re-authenticate mode enabled Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Configuring Keystores for Message Protection". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection with secure conversation and re-authenticate mode enabled Service Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-78, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml V2.0 Token With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-80, "wss11_saml20_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name, as described in "Overriding Policy Configuration Properties". The saml.issuer.name property defaults to a value of www.oracle.com. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context, as described in "Configuring Keystores for Message Protection". The propagate.identity.context property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "How to Configure SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml V2.0 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-81, "wss11_saml20_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
Configure the saml.loginmodule login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Client Policy
Category: Security
Inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-103, "oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Note:
When using Oracle STS, the asymmetric proof key (HoK) use-case works only when a client cert csf key is configured in the policy using thests.auth.x509.csf.key configuration override.
This value is used for signing the WS-Trust request sent to the STS and by Oracle STS as the proof key. The public key in the SAML assertion also corresponds to this keypair.
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Service Policy
Category: Security
Authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using WS-Security's Basic 128 suite of symmetric key technologies.
You also have the option to override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-104, "oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Client Policy
Category: Security
This policy inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-103, "oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Service Policy
Category: Security
This policy authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using WS-Security's Basic 128 suite of symmetric key technologies.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-104, "oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Issued Token with Saml Sender Vouches with Message Protection Client Policy
Category: Security
This policy inserts a SAML sender vouches assertion issued by a trusted STS (Security Token Service). Messages are protected using the client's private key.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-106, "oracle/wss11_sts_issued_saml_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Username Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-83, "wss11_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key and keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Username Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-84, "wss11_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Username Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-83, "wss11_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-3 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Username Token With Message Protection with secure conversation enabled Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-84, "wss11_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 X509 Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-86, "wss11_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.enc.csf.key, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-4 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 X509 Token With Message Protection Service Policy
Category: Security
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-87, "wss11_x509_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the Authentication provider, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 X509 Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-86, "wss11_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation".
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-4 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 X509 Token With Message Protection with secure conversation enabled Service Policy
Category: Security
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-87, "wss11_x509_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the Authentication provider, as described in "Configuring an Authentication Provider in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to the Credential Store". Use keystore.enc.csf.key as the key name.
Override the keystore.enc.csf.key server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Table 17-58 summarize the predefined OWSM Oracle Entitlements Server (OES) security policies.
Table 17-58 Predefined OWSM Oracle Entitlements Server Security Policies
| Policy Name | Description |
|---|---|
|
Sets user authorization based on the policy defined in Oracle Entitlements Server. |
|
|
Does response masking based on the policy defined in Oracle Entitlements Server. |
|
|
Sets user authorization based on the policy defined in Oracle Entitlements Server. |
Display Name: Fine-grained authorization using Oracle Entitlements Server
Category: Security
This policy sets authorization based on the policy defined in Oracle Entitlements Server (OES). Authorization is based on attributes, the current authenticated subject, and the web service action invoked by the client. This policy is used for fine-grained authorization on any operation on the web service.
This policy should follow an authentication policy where the subject is established. You can attach this policy to any SOAP endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-90, "binding_oes_authorization_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Display Name: Response masking using Oracle Entitlements Server
Category: Security
This policy does response masking based on the policy defined in OES. Masking is based on attributes, the current authenticated subject, and the web service action invoked by the client. This template is used for fine-grained masking on any operation of a web service.
This policy should follow an authentication policy where the subject is established. You can attach this policy to any SOAP endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-90, "binding_oes_authorization_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Table 17-59 summarize the predefined OWSM SOAP Over JMS Transport policies.
Table 17-59 Predefined OWSM SOAP Over JMS Transport Policies
| Policy Name | Description |
|---|---|
|
Enables and configures support for SOAP over JMS transport for web service clients. |
|
|
Enables and configures support for SOAP over JMS transport for web services. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport client policy at a higher scope. |
|
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport service policy at a higher scope. |
For more information about attaching SOAP over JMS transport policies, see:
"Configuring SOAP Over JMS Transport Using Fusion Middleware Control" in Administering Web Services
"Configuring SOAP Over JMS Transport Using WLST" in Administering Web Services
Display Name: JMS Transport Client Policy
Category: SOAP Over JMS Transport
Enables and configures support for SOAP over JMS transport for web service clients.
Note:
This policy cannot be duplicated, and the assertion template associated with this template is not available for generating new policies.This policy is not supported for Java EE (WebLogic) web services.
Table 17-60 lists the configuration properties that you can override for SOAP over JMS transport clients.
Table 17-60 Configuration Properties for oracle/jms_transport_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
JNDI name of the destination queue or topic. |
|
Required |
|
|
Destination type. Valid values include: |
|
Required |
|
|
JMS header properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
|
JMS message properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
|
JNDI name of the connection factory that is used to establish a JMS connection. |
|
Required |
|
|
JNDI properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: The properties are added to the |
None |
Optional |
|
|
Name of the initial context factory class used for JNDI lookup. This value maps to the |
|
Required |
|
|
JNDI provider URL. This value maps to the |
|
Required |
|
|
Message type to use with the request message. Valid values are For more information, see "Configuring the JMS Message Type" in Developing JAX-WS Web Services for Oracle WebLogic Server. |
|
Required |
|
|
JMS priority associated with the request and response message. Specify this value as a positive Integer from 0, the lowest priority, to 9, the highest priority. The default value is |
|
Required |
|
|
JNDI name of the JMS destination to which the response message is sent. For a two-way operation, a temporary response queue is generated by default. Using the default temporary response queue minimizes the configuration that is required. However, in the event of a server failure, the response message may be lost. This property enables the client to use a previously defined, "permanent" queue or topic rather than use the default temporary queue or topic, for receiving replies. For more information about configuring the JMS response queue, see "Configuring the Response Queue" in Developing JAX-WS Web Services for Oracle WebLogic Server. The value maps to the |
None |
Optional |
|
|
Port component name of the web service. This value is used by the service implementation to dispatch the service request. If not specified, the service name from the WSDL or This value maps to the |
None |
Optional |
|
|
Lifetime, in milliseconds, of the request message. A value of 0 indicates an infinite lifetime. On the service side, |
|
Required |
|
|
See "reference.priority". |
None |
Optional |
Display Name: JMS Transport Service Policy
Category: SOAP Over JMS Transport
Note:
This policy cannot be duplicated, and the assertion template associated with this template is not available for generating new policies.This policy is not supported for Java EE (WebLogic) web services.
Table 17-61 lists the configuration properties that you can override for SOAP over JMS transport for web services.
Table 17-61 Configuration Properties for oracle/jms_transport_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
Version of the SOAP JMS binding. This value must be set to This value maps to the |
|
Required |
|
|
Delivery mode indicating whether the request message is persistent. Valid values are |
|
Required |
|
|
Boolean flag that specifies whether to publish the WSDL through HTTP. |
|
Optional |
|
|
Principal used to run the listening MDB. |
None |
Optional |
|
|
Role used to run the listening MDB. |
None |
Optional |
|
|
Boolean flag that specifies whether to create one listening message-driven bean (MDB) for each requested destination. If set to |
|
Optional |
|
|
Activation configuration properties passed to the JMS provider. Each property is specified using name-value pairs, separated by semicolons (;). For example: For a list of activation configuration properties that are supported by this property, see "Summary of JMS Transport Configuration Properties" in Developing JAX-WS Web Services for Oracle WebLogic Server. |
None |
Optional |
|
|
JNDI name of the destination queue or topic. |
|
Required |
|
|
Destination type. Valid values include: |
|
Required |
|
|
JMS header properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
|
JMS message properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
|
JNDI name of the connection factory that is used to establish a JMS connection. |
|
Required |
|
|
JNDI properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: The properties are added to the |
None |
Optional |
|
|
Name of the initial context factory class used for JNDI lookup. This value maps to the |
|
Required |
|
|
JNDI provider URL. This value maps to the |
|
Required |
Display Name: No Jms Transport Client Policy
Category: SOAP Over JMS Transport
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport client policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-62 lists the configuration property that you can override for the no behavior policy.
Table 17-62 Configuration Property for oracle/no_jms_transport_client_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |
Display Name: No Jms Transport Client Policy
Category: SOAP Over JMS Transport
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-63 lists the configuration property that you can override for the no behavior policy.
Table 17-63 Configuration Property for oracle/no_jms_transport_service_policy
| Name | Description | Default | Required? |
|---|---|---|---|
|
|
See "reference.priority". |
None |
Optional |