This chapter describes the Oracle Web Services Manager (OWSM) predefined policies, organized by category. For more information about the predefined policy categories, see "Policy Categories" in Understanding Oracle Web Services Manager. For more information about attaching policies, see "Attaching Policies to Manage and Secure Web Services".
This chapter includes the following sections:
Notes:
The predefined policies and assertion templates distributed with the current release are read only. You must copy the policy or assertion template before modifying it; you can copy policies in the security and management categories only. You also have the option of configuring the attributes in an assertion after you have added it to a policy. For information about managing the assertion templates and adding them to policies, see "Managing Policy Assertion Templates".
When attaching OWSM 12c predefined policies, if you specify a value of blank (" ") in the Value field, the default value will be in effect. If you have imported 11g policies or any custom policies, ensure that the policy has a valid value in the Default field to achieve the same effect; otherwise, the specified value will be picked up.
Table 17-1 summarize the predefined OWSM addressing policies.
Table 17-1 Predefined OWSM Addressing Policies
Policy Name | Description |
---|---|
Checks inbound messages for the presence of WS-Addressing headers conforming to the W3C 2005 Final WS-Addressing Policy standard. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS Addressing policy at a higher scope. |
For more information about attaching web services addressing policies, see:
"Configuring Addressing Using Fusion Middleware Control" in Administering Web Services
"Configuring Addressing Using WLST" in Administering Web Services
Display Name: WS Addressing Policy
Category: WS-Addressing
Checks inbound messages for the presence of WS-Addressing headers conforming to the W3C 2005 Final WS-Addressing Policy standard. In addition, it causes the platform to include a WS-Addressing header in outbound SOAP messages.
For more information about configuring WS-Addressing on the web service client, see Web Services Addressing 1.0 - SOAP Binding specification (http://www.w3.org/TR/ws-addr-soap/
).
Note:
Please note the following:This policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-3 lists the configuration property that you can override for the addressing policy.
Table 17-2 Configuration Property for oracle/wsaddr_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Addressing Policy
Category: WS-Addressing
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS Addressing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-3 lists the configuration property that you can override for the no behavior policy.
Table 17-3 Configuration Property for oracle/no_addressing_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Table 17-4 summarize the predefined OWSM atomic transaction policies.
Table 17-4 Predefined OWSM Atomic Transaction Policies
Policy Name | Description |
---|---|
Enables and configures support for atomic transactions. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached atomic transaction web service policy at a higher scope. |
For more information about attaching web services atomic transaction policies, see:
"Configuring Atomic Transactions Using Fusion Middleware Control" in Administering Web Services
"Configuring Atomic Transactions Using WLST" in Administering Web Services
Display Name: Atomic Transaction Policy
Category: Atomic Transactions
Enables and configures support for atomic transactions. For more information about atomic transactions, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This atomic transactions policy cannot be duplicated.
The assertion template associated with this atomic transactions policy is not available for generating new policies.
This atomic transactions policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-5 lists the configuration properties that you can override for atomic transactions.
Table 17-5 Configuration Properties for oracle/atomic_transaction_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Whether the web services atomic transaction coordination context is passed with the transaction flow. Valid values include:
For more information about the valid values, see "Configuring Web Service Atomic Transactions" in Developing Oracle Infrastructure Web Services. |
|
Optional |
|
Version of the web services atomic transaction coordination context that is supported. For web service clients, it specifies the version used for outbound messages only. The value specified must be consistent across the entire transaction. Valid values include:
For more information about the valid values, see "Configuring Web Service Atomic Transactions" in Developing Oracle Infrastructure Web Services. |
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: No Atomic Transaction Policy
Category: Atomic Transactions
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached atomic transaction web service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
For more information about atomic transactions, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-6 lists the configuration property that you can override for the no behavior policy.
Table 17-6 Configuration Property for oracle/no_atomic_transaction_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Table 17-7 summarize the predefined OWSM configuration policies.
Note:
Please note the following:Configuration policies cannot be duplicated.
The assertion templates associated with configuration policies are not available for generating new policies.
Configuration policies are not supported for SOA composite or Java EE (WebLogic) web services.
Table 17-7 Predefined OWSM Configuration Policies
Policy Name | Description |
---|---|
Enables and configures an asynchronous web service. |
|
Enables and configures support for binary caching of content. |
|
Enables and configures Fast Infoset on the web service client. |
|
Enables Fast Infoset on the web service. |
|
Configures the maximum size, in bytes, of the request message that can be sent to the web service. |
|
Enables the exchange of web service metadata. |
|
Enables the creation of MTOM-enabled SOAP fault messages when MTOM is enabled. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached asynchronous web service policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached binary caching policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset client policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset service policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached maximum request size policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached web service metadata exchange policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP fault MTOM encoding policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached persistence policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Plain Old XML (POX) policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached request processing policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached schema validation policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP request processing policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached test page processing policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached logging policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WSDL request processing policy at a higher scope. |
|
Configures the secure conversation persistence mechanism for the web service. |
|
Enables an endpoint to receive non-SOAP XML messages that are processed by a user defined |
|
Enables the web service endpoint to process incoming requests. |
|
Enables the validation of request messages against the schema. |
|
Enables the processing of SOAP requests on the web service endpoint. |
|
Enables the Web Service Test Client, as described in "Using the Web Services Test Client" in Administering Web Services. |
|
Sets the logging level for diagnostic logs for the web service endpoint. |
|
Enables access to the WSDL for the web service. |
For more information about attaching configuration policies, see:
"Configuring Web Services Using Fusion Middleware Control" in Administering Web Services
"Configuring Web Services Using WLST" in Administering Web Services
Display Name: Async Web Service Policy
Category: Configuration
Enables and configures an asynchronous web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-10 lists the configuration properties that you can override for asynchronous web services.
Table 17-8 Configuration Property for oracle/async_web_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
The user that is authorized to use the JMS queues. Note: For most users, the OracleSystemUser is sufficient. However, if you need to change this user to another user in your security realm, you can do so using the instructions provided in "Changing the JMS System User for Asynchronous Web Services Using Fusion Middleware Control" in Administering Web Services. |
|
Optional |
|
Name of the connection factory for the JMS request queue. |
|
Optional |
|
Name of the request queue. |
|
Optional |
|
Name of the connection factory for the JMS response queue. |
|
Optional |
|
Name of the request queue. |
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: Cache Binary Content Policy
Category: Configuration
Enables and configures support for binary caching of content.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-9 lists the configuration properties that you can override for binary caching.
Table 17-9 Configuration Properties for oracle/cache_binary_content_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Value that specifies the runtime requirements of XTI scalable DOM in OraSAAJ. Valid values include:
|
|
Optional |
|
Boolean value that defines one of the following values:
|
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: Fast Infoset Client Policy
Category: Configuration
Enables and configures Fast Infoset on the web service client.
For more information about Fast Infoset, see:
JAX-WS Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing JAX-WS Web Services for Oracle WebLogic Server.
Oracle Infrastructure Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-10 lists the configuration properties that you can override for Fast Infoset clients.
Table 17-10 Configuration Properties for oracle/fastinfoset_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Value that specifies the Fast Infoset content negotiation setting. Valid values include:
|
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: Fast Infoset Service Policy
Category: Configuration
Enables Fast Infoset on the web service.
For more information about Fast Infoset, see:
JAX-WS Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing JAX-WS Web Services for Oracle WebLogic Server.
Oracle Infrastructure Web Services: "Optimizing XML Transmission Using Fast Infoset" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-11 lists the configuration properties that you can override for Fast Infoset web services.
Table 17-11 Configuration Properties for oracle/fastinfoset_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Max Request Size Policy
Category: Configuration
Configures the maximum size, in bytes, of the request message that can be sent to the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-12 lists the configuration properties that you can override when enabling maximum request size on the web service.
Table 17-12 Configuration Properties for oracle/max_request_size_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Maximum size of the request message, in bytes. A value of |
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: MEX Request Processing Service Policy
Category: Configuration
Enables the exchange of web service metadata.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-13 lists the configuration properties that you can override when enabling the exchange of web service metadata.
Table 17-13 Configuration Properties for oracle/mex_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: MTOM Encode Fault Service Policy
Category: Configuration
Enables the creation of MTOM-enabled SOAP fault messages when MTOM is enabled.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration properties that you can override when enabling MTOM encoding for SOAP faults.
Table 17-14 Configuration Properties for oracle/mtom_encode_fault_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Async Web Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached asynchronous web service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-15 lists the configuration property that you can override for the no behavior policy.
Table 17-15 Configuration Property for oracle/no_async_web_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Cache Binary Content Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached binary caching policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-16 lists the configuration property that you can override for the no behavior policy.
Table 17-16 Configuration Property for oracle/no_cache_binary_content_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Fast Infoset Client Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset client policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-17 lists the configuration property that you can override for the no behavior policy.
Table 17-17 Configuration Property for oracle/no_fast_infoset_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Fast Infoset Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Fast Infoset service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-18 lists the configuration property that you can override for the no behavior policy.
Table 17-18 Configuration Property for oracle/no_fast_infoset_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Max Request Size Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached maximum request size policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-19 lists the configuration property that you can override for the no behavior policy.
Table 17-19 Configuration Property for oracle/no_max_request_size_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No MEX Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached web service metadata exchange policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-20 lists the configuration property that you can override for the no behavior policy.
Table 17-20 Configuration Property for oracle/no_mex_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No MTOM Encode Fault Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP fault MTOM encoding policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-21 lists the configuration property that you can override for the no behavior policy.
Table 17-21 Configuration Property for oracle/no_mtom_encode_fault_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Persistence Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached persistence policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-22 lists the configuration property that you can override for the no behavior policy.
Table 17-22 Configuration Property for oracle/no_persistence_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Pox Http Binding Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Plain Old XML (POX) policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-23 lists the configuration property that you can override for the no behavior policy.
Table 17-23 Configuration Property for oracle/no_pox_http_binding_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-24 lists the configuration property that you can override for the no behavior policy.
Table 17-24 Configuration Property for oracle/no_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Schema Validation Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached schema validation policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-25 lists the configuration property that you can override for the no behavior policy.
Table 17-25 Configuration Property for oracle/no_schema_validation_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Soap Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-26 lists the configuration property that you can override for the no behavior policy.
Table 17-26 Configuration Property for oracle/no_soap_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Test Page Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached test page processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-27 lists the configuration property that you can override for the no behavior policy.
Table 17-27 Configuration Property for oracle/no_test_page_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Ws Logging Level Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached logging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-28 lists the configuration property that you can override for the no behavior policy.
Table 17-28 Configuration Property for oracle/no_ws_logging_level_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Wsdl Request Processing Service Policy
Category: Configuration
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WSDL request processing policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no behavior policy is not supported for SOA composite or Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-29 lists the configuration property that you can override for the no behavior policy.
Table 17-29 Configuration Property for oracle/no_wsdl_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Persistence Policy
Category: Configuration
Configures the secure conversation persistence mechanism for the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-30 lists the configuration properties that you can override when enabling the policy.
Table 17-30 Configuration Properties for oracle/persistence_policy
Attribute | Description | Default | Required? |
---|---|---|---|
|
Identifies the persistence provider registered in the system. Possible values are:
Note: For J2SE clients, you can configure |
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: Pox Http Binding Service Policy
Category: Configuration
Enables an endpoint to receive non-SOAP XML messages that are processed by a user defined javax.xml.ws.Provider<T>.invoke
method.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling the policy.
Table 17-31 Configuration Property for oracle/pox_http_binding_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Request Processing Service Policy
Category: Configuration
Enables the web service endpoint to process incoming requests.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-32 Configuration Property for oracle/request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Schema Validation Policy
Category: Configuration
Enables the validation of request messages against the schema.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-33 Configuration Property for oracle/schema_validation_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Soap Request Processing Service Policy
Category: Configuration
Enables the processing of SOAP requests on the web service endpoint.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-34 Configuration Property for oracle/soap_request_processing_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Test Page Processing Service Policy
Category: Configuration
Enables the Web Service Test Client, as described in "Using the Web Services Test Client" in Administering Web Services.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-35 Configuration Property for oracle/test_page_processing_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Ws Logging Level Policy
Category: Configuration
Sets the logging level for diagnostic logs for the web service endpoint.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration properties that you can override when enabling this policy.
Table 17-36 Configuration Property for oracle/ws_logging_level_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Defines the logging level. Valid values include: |
None |
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: Wsdl Request Processing Service
Category: Configuration
Enables access to the WSDL for the web service.
Note:
Please note the following:This configuration policy cannot be duplicated.
The assertion template associated with this configuration policy is not available for generating new policies.
This configuration policy is not supported for SOA composite or Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-14 lists the configuration property that you can override when enabling this policy.
Table 17-37 Configuration Property for oracle/ws_logging_level_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Table 17-38 summarize the predefined OWSM management policies.
Table 17-38 Predefined OWSM Management Policies
Policy Name | Description |
---|---|
Causes the request, response, and fault messages to be sent to a message log. |
Display Name: Log Policy
Category: Management
Causes the request, response, and fault messages to be sent to a message log. By default, this policy logs the entire SOAP message for the request and just the SOAP body information for the response.
Messages are logged to the message log for the domain. For information about viewing and filtering message logs, see "Using Message Logs for Web Services" in Administering Web Services.
Note:
This policy is not supported for Java EE (WebLogic) web services.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is not advertised in the WSDL.
Table 17-39 lists the configuration property that you can override for the log policy.
Table 17-39 Configuration Property for oracle/log_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Table 17-40 summarize the predefined OWSM Message Transmission Optimization Mechanism (MTOM) policies.
Table 17-40 Predefined OWSM MTOM Policies
Policy Name | Description |
---|---|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached WS MTOM policy at a higher scope. |
|
Rejects inbound messages that are not in MTOM format and verifies that outbound messages are in MTOM format. |
For more information about attaching MTOM policies, see:
"Configuring MTOM Using Fusion Middleware Control" in Administering Web Services
"Configuring MTOM Using WLST" in Administering Web Services
Display Name: No Behavior MTOM Policy
Category: MTOM Attachments
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached MTOM policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-41 lists the configuration property that you can override for the no behavior policy.
Table 17-41 Configuration Property for oracle/no_mtom_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: WS MTOM Policy
Category: MTOM Attachments
Rejects inbound messages that are not in MTOM format and verifies that outbound messages are in MTOM format. MTOM defines a method for optimizing the transmission of XML data of type xs:base64Binary
or xs:hexBinary
in SOAP messages. For more information about MTOM, see the following specifications for SOAP 1.2 and 1.1., respectively: http://www.w3.org/TR/2005/REC-soap12-mtom-20050125
and http://www.w3.org/Submission/2006/SUBM-soap11mtom10-20060405
.
To enable MTOM on the client of the web service, pass the javax.xml.ws.soap.MTOMFeature
as a parameter when creating the web service proxy or dispatch, as illustrated in the following example.
package examples.webservices.mtom.client; import javax.xml.ws.soap.MTOMFeature; public class Main { public static void main(String[] args) { String FOO = "FOO"; MtomService service = new MtomService() MtomPortType port = service.getMtomPortTypePort(new MTOMFeature()); String result = null; result = port.echoBinaryAsString(FOO.getBytes()); System.out.println( "Got result: " + result ); } }
Note:
Please note the following:This MTOM policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-42 lists the configuration property that you can override for the MTOM policy.
Table 17-42 Configuration Property for oracle/wsmtom_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Table 17-38 summarize the predefined OWSM reliable messaging policies.
Table 17-43 Predefined OWSM Reliable Messaging Policies
Policy Name | Description |
---|---|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. |
|
Configures web services reliable messaging on the web service and client. |
|
Configures version 1.0 of the Web Services Reliable Messaging protocol. |
|
Configures version 1.1 of the Web Services Reliable Messaging protocol. |
For more information about attaching reliable messaging policies, see:
"Configuring Reliable Messaging Using Fusion Middleware Control" in Administering Web Services
"Configuring Reliable Messaging Using WLST" in Administering Web Services
Display Name: No Reliable Messaging Policy
Category: Reliable Messaging
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
For more information about reliable messaging, see "Using Web Services Atomic Transactions" in Developing Oracle Infrastructure Web Services.
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-44 lists the configuration property that you can override for the no behavior policy.
Table 17-44 Configuration Property for oracle/no_reliable_messaging_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior RM Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/no_reliable_messaging
policy, as described in "oracle/no_reliable_messaging_policy".When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached Web Services Reliable Messaging policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-45 lists the configuration property that you can override for the no behavior policy.
Table 17-45 Configuration Property for oracle/no_wsrm_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Reliable Messaging Policy
Category: Reliable Messaging
Configures web services reliable messaging on the web service and client. This policy can be attached to any SOAP-based web service and client.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client. When more than one version is enabled, the generated WSDL has policy alternatives for the given versions, which enables the client to select any version. The client must consistently use the selected version of the protocol for all interaction with a given sequence.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence. Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle
interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
The following example shows sample client code for web services reliable messaging for a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle
object and a reliable messaging session is opened on it (openSession
). After the messages are sent to the service, the session is closed (closeSession
).
public class ClientServlet extends HttpServlet { public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { int num1 = Integer.parseInt(request.getParameter("num1")); int num2 = Integer.parseInt(request.getParameter("num2")); String outputStr = null; TestService service = new TestService(); Test port = service.getTestPort(); try { ((RMSessionLifecycle) port).openSession(); outputStr = port.hello(inputStr); } catch (Exception e) { e.printStackTrace(); outputStr = e.getMessage(); } finally { ((RMSessionLifecycle) port).closeSession(); response.getOutputStream().write(outputStr.getBytes()); } } }
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-46 lists the configuration properties that you can override when enabling the policy.
Table 17-46 Configuration Properties for oracle/reliable_messaging_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Maximum interval, in milliseconds, in which the destination endpoint must transmit a standalone acknowledgement. The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
Reliable messaging version(s) supported. When more than one version is enabled, the generated WSDL will list policy alternatives for the given versions, allowing the client to select the version. The client must use the selected version consistently for all interactions in a given sequence. Valid values include:
|
|
Optional |
|
Flag indicating that non-buffered receipt of messages is requested. This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
Number of milliseconds which defines an inactivity interval. After this amount of time, if the destination endpoint has not received a message from the source endpoint, the destination endpoint may consider the sequence to have terminated due to inactivity. The same is true for the source endpoint. By default, sequences never timeout. Implementations of RM source and RM destination are free to manage resources associated with the sequence as desired, but there are no guarantees that the sequence will be usable by either party after the inactivity timeout expires. The value specified must be a positive value and conform to the XML schema duration lexical format, Set at sequence creation time, and cannot be reset. |
|
Optional |
|
Number of times that the JMS queue on the invoked WebLogic Server instance attempts to deliver the message to the web service implementation until the operation is successfully invoked. |
|
Optional |
|
Flag that specifies whether reliable messaging is required. This flag enables a service endpoint to support reliable or non-reliable communication with different clients. If optional is set to When used in combination with an operation-level "required" WS-RM policy, operations without an explicit WS-RM policy do not need to be called with the WS-RM protocol, but operations with an explicit WS-RM policy must be called with the WS-RM protocol. |
|
Optional |
|
See "reference.priority". |
None |
Optional |
|
Delivery assurance for reliable messaging. Valid values include:
|
|
Optional |
|
Flag that specifies that messages are delivered in the order that they were sent. |
|
Optional |
|
Amount of time after which the reliable web service expires and does not accept any new sequence messages. If this limit is reached before the sequence naturally completes, it will be forcibly terminated. The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
Flag that specifies that in order to secure messages in a reliable sequence, the runtime will use the |
|
Optional |
|
Flag that specifies that in order to secure messages in a reliable sequence, the RM Sequence must be bound to the session(s) of the underlying transport-level protocol used to carry the When present, this assertion must be used in conjunction with the |
|
Optional |
|
Backoff algorithm. If a destination endpoint does not acknowledge a sequence of messages for the time interval specified by the base retransmission interval ( Valid values include:
This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
Interval of time that must pass before a message will be retransmitted to the RM destination (in the event a prior transmission failed.) This interval can be used in conjunction with the backoff algorithm ( The value specified must be a positive value and conform to the XML schema duration lexical format, This value is set at sequence creation time, and cannot be reset. |
|
Optional |
|
Reliable messaging version(s) supported by the RM source. When the service WSDL contains policy alternatives for multiple RM versions, the client can select the version via this attribute. If the WSDL contains multiple RM versions and this attribute is not explicitly set, then either RM 1.2 is used or the highest version in the WSDL, if the WSDL does not contain RM 1.2. Valid values include:
If the WSDL contains only one RM version, this attribute is ignored and the version in the WSDL is used. Other possible values are DEFAULT, WS_RM_1_0, and WS_RM_1_1. |
|
Optional |
|
See "reference.priority". |
None |
Optional |
Display Name: WS RM10 Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/reliable_messaging
policy, as described in "oracle/reliable_messaging_policy".Configures version 1.0 of the Web Services Reliable Messaging protocol. This policy can be attached to any SOAP-based client or endpoint.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence. Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle
interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
Example 17-0 illustrates a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle
object and a reliable messaging session is opened on it (openSession
). After the messages are sent to the service, the session is closed (closeSession
).
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-47 lists the configuration properties that you can override for the reliable messaging policy.
Table 17-47 Configuration Properties for the wsrm10_policy
Name | Description | Default | Required |
---|---|---|---|
|
Delivery assurance. The following defines the delivery assurance types:
In addition, you can configure whether messages are delivered in the order that they were sent. Valid values include
|
|
Optional |
|
Type of message store. Valid values include:
|
|
Optional |
|
Name of the message store. |
|
Optional |
|
JNDI reference to a JDBC data source. This field is valid only if StoreType is set to JDBC. This value takes precedence over jdbc-connection-url. The username and password will be used if both are present. |
jdbc/MessagesStore |
Optional |
|
Number of milliseconds which defines an inactivity interval. After this amount of time, if the destination endpoint has not received a message from the source endpoint, the destination endpoint may consider the sequence to have terminated due to inactivity. The same is true for the source endpoint. By default, sequences never timeout. Implementations of RM source and RM destination are free to manage resources associated with the sequence as desired, but there are no guarantees that the sequence will be usable by either party after the inactivity timeout expires. |
|
Optional |
|
Interval of time that must pass before a message will be retransmitted to the RM destination (in the event a prior transmission failed.) |
|
Optional |
Display Name: WS RM11 Policy
Category: Reliable Messaging
Note:
This policy has been deprecated. Oracle recommends that you use theoracle/reliable_messaging
policy, as described in "oracle/reliable_messaging_policy".Configures version 1.1 of the Web Services Reliable Messaging protocol. This policy can be attached to any SOAP-based client or endpoint.
The web service client will automatically detect the WSDL policy assertions at run time and use them to enable the advertised version of reliable messaging on the client.
For multi-message sequences, the client code must include explicit invocations of methods for delimiting sequence boundaries. Otherwise, every message is wrapped in its own sequence Edit the client to enable a reliable messaging session for the messages sent to the service. The oracle.webservices.rm.client.RMSessionLifecycle
interface provides the client with a mechanism for demarcating reliable messaging sequence boundaries.
Example 17-0 illustrates a servlet client. In this example, a new TestService is created. The TestPort, through which the client will communicate with the service, is retrieved. The port object is cast to a RMSessionLifecycle
object and a reliable messaging session is opened on it (openSession
). After the messages are sent to the service, the session is closed (closeSession
).
Note:
Please note the following:This reliable messaging policy cannot be duplicated.
The assertion template associated with this policy is not available for generating new policies.
This policy is not supported for Java EE (WebLogic) web services.
An assertion template is not provided for creating this policy. For that reason, it is important that you do not delete this policy. To recreate it you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-47 lists the configuration properties that you can override for this policy
Table 17-48 summarizes the predefined OWSM authentication only security policies.
Note:
There are no predefined policies for two authentication only scenarios: Kerberos over SSL and SPNEGO. To use these scenarios, create your own policies that use the Kerberos over SSL and SPNEGO assertion templates described in "Oracle Web Services Manager Predefined Assertion Templates".Table 17-48 Predefined OWSM Authentication Only Policies
Policy Name | Description |
---|---|
Includes credentials in the HTTP header for outbound client requests and verifies that the transport protocol is HTTPS. |
|
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store and verifies that the transport protocol is HTTPS. |
|
Verifies that the OAM agent has authenticated the user and has established an identity. |
|
Includes a SAML Bearer V2.0 token in the HTTP header. |
|
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header. |
|
Includes a SAML Bearer v2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically, and verifies that the transport protocol provides SSL message protection. |
|
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header, and verifies that the transport protocol provides SSL message protection. |
|
Enforces one of the following authentication policies, based on the token sent by the client:
|
|
Enforces one of the following authentication policies, based on the token sent by the client:
|
|
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. |
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. |
|
Includes credentials in the HTTP header for outbound client requests. |
|
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store. |
|
Includes credentials in the WS-Security UsernameToken header for all outbound SOAP request messages. |
|
Uses the credentials in the UsernameToken WS-Security SOAP header to authenticate users. |
|
Includes SAML tokens in outbound SOAP request messages. |
|
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. |
|
Includes SAML tokens in outbound SOAP request messages. |
|
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. |
|
Includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
|
Extracts the Kerberos token from the SOAP header and authenticates the user. |
Display Name: HTTP Basic Auth Over SSL Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-45, "wss_http_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way, as described in "Configuring One-Way SSL on WebLogic Server"
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed using the Administration Console, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: HTTP Basic Auth Over SSL Service Policy
Category: Security
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based endpoint.
Note:
This policy functions similarly to oracle/wss_http_token_over_ssl_service_policy. The difference is thatoracle/wss_http_token_over_ssl_service_policy
enables the include-timestamp
attribute in the require-tls
element to prevent replay attacks, a feature that is not applicable to RESTful services. For more information about the require-tls
element, see "orasp:require-tls Element".This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when the associated policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-46, "wss_http_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring One-Way SSL on WebLogic Server".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed using the Administration Console, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: HTTP OAM Service Policy
Category: Security
Verifies that the OAM agent has authenticated the user and has established an identity. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when the associated policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-3, "http_oam_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To enforce HTTP OAM security, configure OAM WebGate to intercept the request, authenticate the user, and set the OAM_REMOTE_USER HTTP
header. OWSM verifies that the OAM_REMOTE_USER_HTTP
header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: HTTP Saml Bearer V2.0 Token Client Policy
Category: Security
Includes a SAML Bearer V2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically. This policy can be enforced on any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
To configure the policy, override the configuration properties defined in Table 18-5, "http_saml20_token_bearer_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML for the web service client at design time, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: HTTP Saml Bearer V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header. The credentials in the SAML token are authenticated against a SAML v2.0 login module. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Display Name: HTTP Saml Bearer V2.0 Token Over SSL Client Policy
Category: Security
Includes a SAML Bearer v2.0 token in the HTTP header. The SAML token with confirmation method Bearer is created automatically, and verifies that the transport protocol provides SSL message protection. This policy can be attached to any HTTP-based client endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-5, "http_saml20_token_bearer_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring One-Way SSL for a Web Service Client".
Configure SAML for the web service client at design time, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: HTTP Saml Bearer V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in the SAML v2.0 token with confirmation method Bearer in the HTTP header, and verifies that the transport protocol provides SSL message protection. The credentials in the SAML token are authenticated against a SAML v2.0 login module. This policy can be enforced on any HTTP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
The assertion is advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Configure one-way SSL, as described in "Configuring One-Way SSL on WebLogic Server".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Display Name: Multi Token RESTful Service Policy
Category: Security
Enforces one of the following authentication policies, based on the token sent by the client:
HTTP Basic—Extracts username and password credentials from the HTTP header.
SAML v2.0 Bearer token in the HTTP header—Extracts SAML 2.0 Bearer assertion in the HTTP header.
HTTP OAM security—Verifies that the OAM agent has authenticated user and establishes identity.
SPNEGO over HTTP security—Extracts Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token from the HTTP header.
This policy contains assertions that are based on the following assertion templates as an OR group—meaning any one of the tokens can be sent by the client:
oracle/http_oam_token_service_template. (Provides OAM protection on the server-side only.)
The oracle/http_saml20_token_bearer_client_template
and oracle/http_spengo_token_service_template
policy assertions are advertised.
The wss_http_token_client_template
and oracle/http_oam_token_service_template
assertions are not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in one of the following sections, based on the token sent by the client. For more information, see "Overriding Policy Configuration Properties".
Table 18-46, "wss_http_token_over_ssl_service_template Configuration Properties"
Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties"
Table 18-3, "http_oam_token_service_template Configuration Properties"
Table 18-9, "http_spnego_token_service_template Configuration Properties"
To configure HTTP OAM security:
Configure the OAM service endpoint as anonymous
using the OAM Console.
Configure OAM WebGate to intercept a client request, authenticate the user, and set the OAM_REMOTE_USER HTTP
header. OWSM verifies that the OAM_REMOTE_USER_HTTP
header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: Multi Token Over SSL RESTful Service Policy
Category: Configuration
Enforces one of the following authentication policies, based on the token sent by the client:
HTTP Basic over SSL—Extracts username and password credentials from the HTTP header.
SAML 2.0 Bearer token in the HTTP header over SSL—Extracts SAML 2.0 Bearer assertion in the HTTP header.
HTTP OAM security (non-SSL)—Verifies that the OAM agent has authenticated user and establishes identity.
SPNEGO over HTTP security (non-SSL)—Extracts SPNEGO token information from the HTTP header.
This policy contains assertions that are based on the following assertion templates as an OR group—meaning any one of the tokens can be sent by the client:
The oracle/wss_http_token_over_ssl_client_template
, oracle/http_samle20_token_bearer_service_template
, and oracle/http_spengo_token_service_template
assertions are advertised in the WSDL.
The oracle/http_oam_token_service_template
assertions are not advertised in the WSDL.
Note:
Advertisement of policy assertions in a WADL file is not supported. The Advertised option has no effect when this policy is attached to a RESTful web service.To configure the policy:
Override the configuration properties defined in one of the following sections, based on the token sent by the client. For more information, see "Overriding Policy Configuration Properties".
Table 18-46, "wss_http_token_over_ssl_service_template Configuration Properties"
Table 18-6, "http_saml20_token_bearer_service_template Configuration Properties"
Table 18-3, "http_oam_token_service_template Configuration Properties"
Table 18-9, "http_spnego_token_service_template Configuration Properties"
To configure HTTP OAM security:
Configure the OAM service endpoint as anonymous
using the OAM Console.
Configure OAM WebGate to intercept the request, authenticate the user, and set the OAM_REMOTE_USER HTTP
header. OWSM verifies that the OAM_REMOTE_USER_HTTP
header is present before allowing the request.
For more information, see:
"Installing and Configuring Oracle HTTP Server 11g WebGate for OAM" in Installing WebGates for Oracle Access Manager.
Administrator's Guide for Oracle Access Manager with Oracle Security Token Service
Display Name: No Behavior Authentication Client Policy
Category: Security
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authentication assertion, those assertions are disabled as well. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-49 lists the configuration property that you can override for the no behavior policy.
Table 17-49 Configuration Property for oracle/no_authentication_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Authentication Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authentication policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authentication assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-50 lists the configuration property that you can override for the no behavior policy.
Table 17-50 Configuration Property for oracle/no_authentication_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Wss HTTP Token Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests. The client must pass the credentials in the HTTP header. This policy can be enforced on any HTTP-based client.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised.
To configure the policy:
Override the configuration properties defined in Table 18-11, "wss_http_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
The client must pass the credentials in the HTTP header.
Uses the credentials in the HTTP header to authenticate users against the OPSS identity store. This policy can be enforced on any HTTP-based endpoint.
The web service must authenticate the supplied username and password credentials against the configured authentication source.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-12, "wss_http_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
The web service must authenticate the supplied username and password credentials against the configured authentication source. Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: Wss Username Token Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header for all outbound SOAP request messages. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy supports plain text passwords. This client policy is analogous to the oracle/wss_username_token_service_policy
service endpoint policy.
Note:
This policy transmits the password in clear text. You should use this policy in low security situations only, or when you know that the transport is protected using some other mechanism.Alternatively, consider:
Copying the policy and setting the password type to digest, as described in "Creating and Editing Web Service Policies".
Using the SSL version of this policy, "oracle/wss_username_token_over_ssl_client_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-14, "wss_username_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>
) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Service Policy
Category: Security
Uses the credentials in the UsernameToken WS-Security SOAP header to authenticate users. This policy supports plain text passwords.
Note:
This policy transmits the password in clear text. You should use this policy in low security situations only, or when you know that the transport is protected using some other mechanism.Alternatively, consider:
Copying the policy and setting the password type to digest, as described in "Creating and Editing Web Service Policies".
Using the SSL version of this policy, "oracle/wss_username_token_over_ssl_client_policy".
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-15, "wss_username_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: Wss10 SAML Token Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The policy can be enforced on any SOAP-based client.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-17, "wss10_saml_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "Configuring SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>
) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches.
Display Name: Wss10 SAML Token Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-18, "wss10_saml_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Display Name: Wss10 SAML V2.0 Token Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The policy can be enforced on any SOAP-based client.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-20, "wss10_saml20_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "Configuring SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>
) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches.
Display Name: Wss10 SAML V2.0 Token Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
Note:
This policy is not secure and is provided for demonstration purposes only. Although the SAML issuer name is present, the SAML token is not endorsed. Therefore, it is possible to spoof the message.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-21, "wss10_saml20_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML and set up OPSS, as described in "Configuring SAML".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Display Name: Wss11 Kerberos Token Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with MIT and Active Directory KDCs. This policy can be enforced on any SOAP-based client.
Service principal names (SPN) are a key component in Kerberos authentication. SPNs are unique identifiers for services running on servers. Every service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. If an SPN is not set for a service, clients have no way of locating that service and Kerberos authentication is not possible.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-23, "wss11_kerberos_token_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Kerberos, as described in "Configuring Kerberos Tokens".
The web service client that is enforcing Kerberos client side policies needs to know the service principal name of the service it is trying to access. You can specify a value for service.principal.name
, as described in "Overriding Policy Configuration Properties". The default value (place holder) is HOST/localhost@oracle.com
.
At design time:
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Set the service principal name (service.principal.name
). The service principal name specifies the name of the service principal for which the client requests a ticket from the KDC. For more information, see "Overriding Policy Configuration Properties".
If the Kerberos authentication is successful, then send the obtained Kerberos ticket and authenticator to the web service enclosed in a BinarySecurityToken
element in the SOAP Security header.
Display Name: Wss11 Kerberos Token Service Policy
Category: Security
Extracts the Kerberos token from the SOAP header and authenticates the user. This policy is enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. The container must have the Kerberos infrastructure configured through OPSS. This policy is compatible with MIT and Active Directory KDCs. This policy can be attached to any SOAP-based endpoint.
Service principal names (SPN) are a key component in Kerberos authentication. SPNs are unique identifiers for services running on servers. Every service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. If an SPN is not set for a service, clients have no way of locating that service and Kerberos authentication is not possible.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-24, "wss11_kerberos_token_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule
login module, as described in "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: Http Oauth2 Token Client Policy
Category: Security
This policy includes the OAuth2 access token in the HTTP header. The access token (AT) is obtained from the Mobile & Social OAuth2 Server. You can attach this policy to any HTTP-based client.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_client_template.
See "oracle/http_oauth2_token_client_template" for more information about the assertion.
This policy includes the OAuth2 access token in the HTTP header. The access token (AT) is obtained from the Mobile & Social OAuth2 Server. You can attach this policy to any HTTP-based SOAP or REST client.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_client_template" for information about the assertion attributes that you can configure.
You attach this policy and the oracle/oauth2_config_client_policy to the client application.
The required token.uri
property of the oracle/oauth2_config_client_policy policy specifies the OAuth2 server token endpoint.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the access token.
oracle/http_jwt_token_service_policy
oracle/multi_token_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
By default, the oracle/http_oauth2_token_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication" orawsp:name="Http OAuth2"> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2Config"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> <orawsp:DefaultValue>www.oracle.com</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-25.
See Table 18-26.
Display Name: Http Jwt Token Service Policy
Category: Security
This policy authenticates users using the username provided in the JWT token in the HTTP header.
This policy can be applied to any HTTP-based endpoint.
This policy contains the following policy assertion:
oracle/http_jwt_token_service_template
See "oracle/http_jwt_token_service_template" for more information about the assertion.
The http_jwt_token_service_policy authenticates users using the username provided in the JWT token in the HTTP header. By default the policy is configured to expect the JWT token to be signed using the asymmetric signature (algorithm-suite
attribute set to Basic128Sha256Rsa15
).
You can attach this policy to any HTTP-based endpoint.
You must edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_jwt_token_service_template" for information about the assertion attributes that you can configure.
By default, the oracle/http_jwt_token_service_policy assertion content is defined as follows:
<orasp:http-jwt-security orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication" orawsp:name="Http JWT Security"> <orasp:auth-header orasp:algorithm-suite="Basic128Sha256Rsa15" orasp:is-encrypted="false" orasp:is-signed="true" orasp:mechanism="jwt"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpJwtConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:contentType="optional" orawsp:name="trusted.issuers" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="csf.map" orawsp:type="string"/> <orawsp:Property orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="propagate.identity.context" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="reference.priority" orawsp:type="string"/> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-jwt-security>
See Table 18-32.
See Table 18-27.
Display Name: Http Oauth2 Token Identity Switch Over Ssl Client Policy
Category: Security
This policy is similar to the policy oracle/http_oauth2_token_over_ssl_client_policy, with the subject.precedence property set to false by default.
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the Mobile and Social OAuth2 Server.) It also verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused.
This policy performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject. This policy can be attached to any HTTP-based SOAP or REST client.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_over_ssl_client_template
See "oracle/http_oauth2_token_over_ssl_client_template" for more information about the assertion.
This policy is similar to the policy oracle/ http_oauth2_token_over_ssl_client_policy, with the subject.precedence
property set to false by default.
This policy includes the OAuth2 access token in the HTTP header.) The access token is obtained from the Mobile and Social OAuth2 Server.) It also verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused.
This policy performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject. This policy can be attached to any HTTP-based SOAP or REST client.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_over_ssl_client_template" for information about the assertion attributes that you can configure.
You attach this policy and the oracle/oauth2_config_client_policy policy to the client application. The token.uri
property of the required oracle/oauth2_config_client_policy policy specifies the OAuth2 server.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the AT.
oracle/http_jwt_token_over_ssl_service_policy
oracle/multi_token_over_ssl_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
subject.precedence
is set to false
to allow for the use of a client-specified username rather than the authenticated subject. The user name is obtained only from the username property of the csf-key.
If subject.precedence
is set to false and csf-key
and user name are configured, the web service client application must have the oracle.wsm.security.WSIdentityPermission
permission. That is, applications from which Oracle WSM accepts the externally-supplied identity must have the WSIdentityPermission
permission. This is to avoid potentially rogue applications from providing an identity to Oracle WSM.
By default, the oracle/http_oauth2_token_identity_switch_over_ssl_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication, security/msg-protection" orawsp:name="Http OAuth2 Over SSL "> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orasp:require-tls orasp:algorithm-suite="Basic128" orasp:include-timestamp="false" orasp:mutual-auth="false"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2OverSSLConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value>false</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> <orawsp:DefaultValue>www.oracle.com</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-28.
See Table 18-25.
Display Name: HTTP JWT Token Over Ssl Service Policy
Category: Security
This policy authenticates users using the username provided in the JWT token in the HTTP header. This policy also verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused.
This policy can be applied to any HTTP-based endpoint.
This policy contains the following policy assertion:
oracle/http_jwt_token_over_ssl_service_template
See "oracle/http_jwt_token_over_ssl_service_template" for more information about the assertion.
The http_jwt_token_service_policy authenticates users using the username provided in the JWT token in the HTTP header. By default the policy is configured to expect the JWT token to be signed using the asymmetric signature (algorithm-suite
attribute set to Basic128Sha256Rsa15
).
This policy also verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be applied to any HTTP-based endpoint.
You must edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_jwt_token_over_ssl_service_template" for information about the assertion attributes that you can configure.
By default, the oracle/http_jwt_token_over_ssl_service_policy assertion content is defined as follows:
<orasp:http-jwt-security orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication" orawsp:name="Http JWT Security"> <orasp:auth-header orasp:algorithm-suite="Basic128Sha256Rsa15" orasp:is-encrypted="false" orasp:is-signed="true" orasp:mechanism="jwt"/> <orasp:require-tls orasp:include-timestamp="false" orasp:mutual-auth="false"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpJwtConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:contentType="optional" orawsp:name="trusted.issuers" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="csf.map" orawsp:type="string"/> <orawsp:Property orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="propagate.identity.context" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="reference.priority" orawsp:type="string"/> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-jwt-security>
See Table 18-34.
See Table 18-29.
Display Name: HTTP Oaith2 Token Opc Oauth2 Client Policy
Category: Security
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the Mobile & Social OAuth2 Server. The property oracle.oauth2.service is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server. If scope has no value, (the default), the protocol, host and port (if available) are obtained from the service URL and used. This policy can be attached to any HTTP-based, SOAP or REST client.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_client_template.
See "oracle/http_oauth2_token_client_template" for more information about the assertion.
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the OAuth Server in the Oracle Cloud.
The property oracle.oauth2.service
is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server. If scope
is empty (the default), Oracle WSM automatically gets the service URL and uses the address:port portion as the scope.
This policy can be attached to any HTTP-based, SOAP or REST client.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_client_template" for information about the assertion attributes that you can configure.
See "Overriding Policy Configuration Properties" for a description of the configuration settings you can override.
You attach this policy and the oracle/oauth2_config_client_policy to the client application. The required token.uri
property of the oracle/oauth2_config_client_policy policy specifies the OAuth2 server.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the access token.
oracle/http_jwt_token_service_policy
oracle/multi_token_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
By default, the oracle/http_oauth2_token_opc_oauth2_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication" orawsp:name="Http OAuth2"> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2Config"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-25.
See Table 18-26.
Display Name: HTTP Oauth2 Token Over SSL Client Policy
Category: Security
This policy includes the OAuth2 access token in the HTTP header. The access token (AT) is obtained from the Mobile & Social OAuth2 Server. You can attach this policy to any HTTP-based client.
The policy verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_over_ssl_client_template
See "oracle/http_oauth2_token_over_ssl_client_template" for more information about the assertion.
This policy is the same as http_oauth2_token_client_policy, except that the AT is propagated over 1-way SSL to the resource. This policy includes the OAauth2 access token in the HTTP header. The AT is obtained from the Mobile and Social OAuth2 Server.
The policy verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused. You can attach this policy to any HTTP-based client.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_over_ssl_client_template" for information about the assertion attributes that you can configure.
See "Overriding Policy Configuration Properties" for a description of the configuration settings you can override.
You attach this policy and the oracle/oauth2_config_client_policy to the client application. The required token.uri
property of the oracle/oauth2_config_client_policy policy specifies the OAuth2 server.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the AT.
oracle/http_jwt_token_over_ssl_service_policy
oracle/multi_token_over_ssl_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
By default, the oracle/http_oauth2_token_over_ssl_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication, security/msg-protection" orawsp:name="Http OAuth2 Over SSL "> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orasp:require-tls orasp:algorithm-suite="Basic128" orasp:include-timestamp="false" orasp:mutual-auth="false"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2OverSSLConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> <orawsp:DefaultValue>www.oracle.com</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security> <oralgp:Logging orawsp:Silent="true" orawsp:name="Log Message2" orawsp:Enforced="false" orawsp:category="security/logging"> <oralgp:msg-log> <oralgp:request>all</oralgp:request> <oralgp:response>all</oralgp:response> <oralgp:fault>all</oralgp:fault> </oralgp:msg-log> <orawsp:bindings> <orawsp:Config orawsp:name="Log Message2_properties"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"/> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-28.
See Table 18-25.
Display Name: HTTP Jwt Token Over SSL Service Policy
Category: Security
This policy authenticates users using the username provided in the JWT token in the HTTP header. This policy also verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused.
This policy can be applied to any HTTP-based endpoint.
This policy contains the following policy assertion: oracle/http_jwt_token_over_ssl_service_template. See "oracle/http_jwt_token_over_ssl_service_template" for more information about the assertion.
For information about configuring the policy, see "oracle/http_jwt_token_client_policy".
Display Name: Oauth2 Config Client Policy
Category: Security
This policy provides OAuth2 information on the client side. This information is used to invoke the Mobile and Social OAuth2 server for token exchange.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/oauth2_config_client_template
See "oracle/oauth2_config_client_template" for more information about the assertion.
This policy provides OAuth2 information on the client side. This information is used to invoke the Mobile and Social OAuth2 server for token exchange.
This policy is enforced only when an OAuth2 token client policy is also attached. Otherwise, it is ignored. This policy is typically attached globally, and the OAuth2 token client policy locally.
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/oauth2_config_client_template" for information about the assertion attributes that you can configure.
You must set or override the token.uri
property. See "Overriding Policy Configuration Properties" for a description of the configuration settings you can override.
By default, the oracle/oauth2_config_client_policy assertion content is defined as follows:
<orasp:oauth2-config xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orasp:token-uri="http://host:port/tokens" orawsp:Enforced="true" orawsp:Silent="true" orawsp:category="security/oauth2-config" orawsp:name="OAuth2 Configuration"> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="OAuth2Config"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:name="role" orawsp:type="string" orawsp:contentType="constant"> <orawsp:Value/> <orawsp:DefaultValue>ultimateReceiver</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:name="token.uri" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value/> <orawsp:DefaultValue>http://host:port/tokens</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="required" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>basic.client.credentials</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"/> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:oauth2-config>
See Table 18-30.
See Table 18-31.
Display Name: HTTP JWT Token Client Policy
Category: Security
This policy includes a JWT token in the HTTP header. The JWT token is created automatically. The issuer name and subject name are provided either programmatically or declaratively through the policy. You can specify the audience restriction condition for this policy.
This policy can be enforced on any HTTP-based client endpoint.
This policy contains the following policy assertion:
oracle/http_jwt_token_client_template
See "oracle/http_jwt_token_client_template" for more information about the assertion.
The http_jwt_token_client_policy includes a JWT token in the HTTP header. The JWT token is created automatically. The issuer name and subject name are provided either programmatically or declaratively through the policy. You can specify the audience restriction condition for this policy.
This policy can be applied to any HTTP-based client endpoint.
You must edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_jwt_token_client_template" for information about the assertion attributes that you can configure.
By default, the oracle/http_jwt_token_client_policy assertion content is defined as follows:
<orasp:http-jwt-security orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication" orawsp:name="Http JWT Security"> <orasp:auth-header orasp:algorithm-suite="Basic128Sha256Rsa15" orasp:is-encrypted="false" orasp:is-signed="true" orasp:mechanism="jwt"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpJwtTokenConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:contentType="optional" orawsp:name="user.attributes" orawsp:type="string"/> <orawsp:Property orawsp:contentType="optional" orawsp:name="issuer.name" orawsp:type="string"> <orawsp:Value>www.oracle.com</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="user.roles.include" orawsp:type="string"> <orawsp:Value>false</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="csf.map" orawsp:type="string"/> <orawsp:Property orawsp:contentType="optional" orawsp:name="csf-key" orawsp:type="string"> <orawsp:Value>basic.credentials</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="subject.precedence" orawsp:type="string"> <orawsp:Value>true</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="audience.uri" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="propagate.identity.context" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="user.tenant.name" orawsp:type="string"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:contentType="optional" orawsp:name="reference.priority" orawsp:type="string"/> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-jwt-security>
See Table 18-32.
See Table 18-33.
Dsiplay Name: HTTP JWT Token Over SSL Client Policy
Category: Security
This policy includes a JWT token in the HTTP header. The JWT token is created automatically. The issuer name and subject name are provided either programmatically or declaratively through the policy. You can specify the audience restriction condition for this policy.
This policy also verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused.
This policy can be enforced on any HTTP-based client endpoint.
This policy contains the following policy assertion: oracle/http_jwt_token_over_ssl_client_template. See "oracle/http_jwt_token_over_ssl_client_template" for more information about the assertion.
For information about configuring the policy, see "oracle/http_jwt_token_client_policy".
Display Name: HTTP OAuth2 Token Identity Switch Opc OAuth2 Over SSL Client Policy
Category: Security
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the OAuth Server. It also verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused. This policy can be attached to any HTTP-based SOAP or REST client, invoking the service over SSL.
This policy also performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject.
The subject.precedence property set to false by default. The oracle.oauth2.service property is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_over_ssl_client_template
See "oracle/http_oauth2_token_over_ssl_client_template" for more information about the assertion.
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the OAuth Server in the Oracle Cloud.
The property oracle.oauth2.service
is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server. If scope
is empty (the default), Oracle WSM automatically gets the service URL and uses the address:port portion as the scope.
It also verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused. This policy can be attached to any HTTP-based SOAP or REST client, invoking the service over SSL.
This policy also performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_over_ssl_client_template" for information about the assertion attributes that you can configure.
You attach this policy and the oracle/oauth2_config_client_policy policy to the client application. The token.uri
property of the required oracle/oauth2_config_client_policy policy specifies the OAuth2 server.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the AT.
oracle/http_jwt_token_over_ssl_service_policy
oracle/multi_token_over_ssl_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
subject.precedence
is set to false
to allow for the use of a client-specified username rather than the authenticated subject. The user name is obtained only from the username property of the csf-key
.
If subject.precedence
is set to false and csf-key
and user name are configured, the web service client application must have the oracle.wsm.security.WSIdentityPermission
permission. That is, applications from which Oracle WSM accepts the externally-supplied identity must have the WSIdentityPermission
permission. This is to avoid potentially rogue applications from providing an identity to Oracle WSM. See granting WSIdentityPermission
permission, as described in "Setting the WSIdentityPermission Permission".
By default, the oracle/http_oauth2_token_identity_switch_opc_oauth2_over_ssl_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication, security/msg-protection" orawsp:name="Http OAuth2 Over SSL "> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orasp:require-tls orasp:algorithm-suite="Basic128" orasp:include-timestamp="false" orasp:mutual-auth="false"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2OverSSLConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value>false</orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-28.
See Table 18-25.
Display Name: HTTP OAuth2 Token Opc OAuth2 Over SSL Client Policy
Category: Security
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the Mobile & Social OAuth2 Server. The property oracle.oauth2.service is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server. If scope has no value, (the default), the protocol, host and port (if available) are obtained from the service URL and used.
The policy verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused. You can attach this policy to any HTTP-based client.
This policy contains the following assertion template, which defines the settings and configuration properties for the policy assertion:
oracle/http_oauth2_token_over_ssl_client_template
See "oracle/http_oauth2_token_over_ssl_client_template" for more information about the assertion.
This policy includes the OAuth2 access token in the HTTP header. The access token is obtained from the OAuth2 Server in the Oracle Cloud.
The property oracle.oauth2.service
is set to true by default, which ensures that the client ID is used as the issuer for the user and client JWT tokens for the OAuth2 server. If scope
is empty (the default), Oracle WSM automatically gets the service URL and uses the address:port portion as the scope.
The policy verifies that the outbound transport protocol is HTTPS. If a non-HTTPS transport protocol is used, the request is refused. You can attach this policy to any HTTP-based SOAP or REST client.
You can override the following properties when you attach the policy:
For OAuth2 token request:
scope
authz.code (Not used in this release.)
redirect.uri (Not used in this release.)
For local token creation:
subject.precedence
csf.map
csf-key
oauth2.client.csf.key
federated.client.token
user.attributes
issuer.name
oracle.oauth2.service
user.roles.include
keystore.sig.csf.key
propagate.identity.context
user.tenant.name
include.certificate
General:
audience.uri
reference.priority
time.in.millis
You must use WLST or edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_oauth2_token_over_ssl_client_template" for information about the assertion attributes that you can configure.
See "Overriding Policy Configuration Properties" for a description of the configuration settings you can override.
You attach this policy and the oracle/oauth2_config_client_policy to the client application. The required token.uri
property of the oracle/oauth2_config_client_policy policy specifies the OAuth2 server.
You also attach any of the following Oracle WSM JWT service policies to the web service. The Oracle WSM server-side agent validates the AT.
oracle/http_jwt_token_over_ssl_service_policy
oracle/multi_token_over_ssl_rest_service_policy (REST)
oracle/wss11_saml_or_username_token_with_message_protection_service_policy (SOAP)
By default, the oracle/http_oauth2_token_opc_oauth2_over_ssl_client_policy assertion content is defined as follows:
<orasp:http-oauth2-security xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" orawsp:Enforced="true" orawsp:Silent="false" orawsp:category="security/authentication, security/msg-protection" orawsp:name="Http OAuth2 Over SSL "> <orasp:auth-header orasp:is-encrypted="false" orasp:is-signed="false" orasp:mechanism="oauth2"/> <orasp:require-tls orasp:algorithm-suite="Basic128" orasp:include-timestamp="false" orasp:mutual-auth="false"/> <orawsp:bindings> <orawsp:Config orawsp:configType="declarative" orawsp:name="HttpOAuth2OverSSLConfig"> <orawsp:PropertySet orawsp:name="standard-security-properties"> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="subject.precedence"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf.map"/> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="csf-key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="oauth2.client.csf.key"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="federated.client.token"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="scope"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="authz.code"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="redirect.uri"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.attributes"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="issuer.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="oracle.oauth2.service"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="user.roles.include"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="keystore.sig.csf.key"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="reference.priority"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:name="propagate.identity.context" orawsp:type="string" orawsp:contentType="optional"> <orawsp:Value></orawsp:Value> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="user.tenant.name"> <orawsp:Value/> </orawsp:Property> <orawsp:Property orawsp:type="string" orawsp:contentType="optional" orawsp:name="audience.uri"> <orawsp:Value/> <orawsp:DefaultValue>NONE</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="include.certificate"> <orawsp:Value/> <orawsp:DefaultValue>false</orawsp:DefaultValue> </orawsp:Property> <orawsp:Property orawsp:type="boolean" orawsp:contentType="optional" orawsp:name="time.in.millis"> <orawsp:Value/> <orawsp:DefaultValue>true</orawsp:DefaultValue> </orawsp:Property> </orawsp:PropertySet> </orawsp:Config> </orawsp:bindings> </orasp:http-oauth2-security>
See Table 18-28.
See Table 18-25.
Display Name: HTTP JWT Token Identity Switch Client Policy
Category: Security
Performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject. This policy includes a JSON Web Token (JWT) in the HTTP header. The JWT token is created automatically. The issuer name and subject name are provided either programmatically or declaratively through the policy. You can specify the audience restriction condition for this policy.
This policy can be enforced on any HTTP-based, SOAP, or REST client endpoint.
This policy contains the following policy assertion:
oracle/http_jwt_token_client_template
See "oracle/http_jwt_token_client_template" for more information about the assertion.
Performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject. This policy includes a JWT token in the HTTP header. When the policy is used by the client, the JWT token is automatically created by Oracle WSM. The issuer name and subject name are provided either programmatically or declaratively through the policy. You can specify the audience restriction condition for this policy.
This policy can be enforced on any HTTP-based, SOAP, or REST client endpoint.
You must edit the policy file manually; you cannot edit the policy using Fusion Middleware Control. See "oracle/http_jwt_token_client_template" for information about the assertion attributes that you can configure.
By default, the oracle/http_jwt_token_identity_switch_client_policy assertion content is the same as the "oracle/http_jwt_token_client_template", except that the subject.precedence
property is set to false
as follows:
<orawsp:Property orawsp:contentType="optional" orawsp:name="subject.precedence" orawsp:type="string"> <orawsp:Value>true</orawsp:Value> </orawsp:Property>
See Table 18-32.
See Table 18-33.
Table 17-51 summarize the predefined OWSM authorization only security policies.
Table 17-51 Predefined OWSM Authorization Only Policies
Policy Name | Description |
---|---|
Provides a simple role-based authorization policy based on the authenticated subject at the SOAP binding level. |
|
Provides a simple role-based authorization for the request based on the authenticated Subject at the SOAP binding level. |
|
Provides a permission-based authorization policy based on the authenticated subject. |
|
Provides a simple role-based authorization policy based on the authenticated subject. |
|
Provides a simple role-based authorization policy based on the authenticated subject. |
|
Provides a permission-based authorization policy based on the authenticated Subject. |
|
When directly attached to a SOA component or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. |
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy". |
|
Accepts requests only if one of the following conditions is true:
|
Display Name: Binding Authorization DenyAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated Subject at the SOAP binding level. This policy denies all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-120, "binding_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Binding Authorization PermitAll Policy
Category: Security
Provides a simple role-based authorization for the request based on the authenticated Subject at the SOAP binding level. This policy permits all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-120, "binding_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Binding Permission Based Authorization Policy
Category: Security
Provides a permission-based authorization policy based on the authenticated subject. This policy should follow an authentication policy where the Subject is established and can be attached to any SOAP-based endpoint.
This policy ensures that the subject has permission to perform the operation. To do this, the Authorization Policy executor leverages OPSS to check if the authenticated subject has been granted oracle.wsm.security.WSFunctionPermission
(or whatever permission class is specified in Permission Check Class
) using the Resource Pattern
and Action Pattern
as parameters. For more information, see "Determining Authorization Permissions".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-122, "binding_permission_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Use Fusion Middleware Control to grant the WSFunctionPermission
(or other) permission to the user, group, or application that will attempt to authenticate to the web service.
Optionally, change the permission_class
configuration property for the policy, which identifies the permission class as per JAAS standards. The class must be available in the server classpath. The custom permission class must extend the abstract Permission
class and implement the Serializable
interface. See the Javadoc at http://docs.oracle.com/javase/7/docs/api/java/security/Permission.html
. The default is oracle.wsm.security.WSFunctionPermission
.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Authorization DenyAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated subject. This policy denies all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-124, "component_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Authorization PermitAll Policy
Category: Security
Provides a simple role-based authorization policy based on the authenticated subject. This policy permits all users with any roles. It should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-124, "component_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. Use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: Component Permission Based Authorization Policy
Category: Security
Provides a permission-based authorization policy based on the authenticated Subject. This policy should follow an authentication policy where the Subject is established and can be attached to any SCA-based endpoint.
This policy ensures that the subject has permission to perform the operation. To do this, the Authorization Policy executor leverages OPSS to check if the authenticated subject has been granted oracle.wsm.security.WSFunctionPermission
(or whatever permission class is specified in Permission Check Class
) using the Resource Pattern
and Action Pattern
as parameters. Resource Pattern
and Action Pattern
are used to identify if the authorization assertion is to be enforced for this particular request. Access is allowed if the authenticated subject has been granted WSFunctionPermission
. For more information, see "Determining Authorization Permissions".
You can grant the WSFunctionPermission
permission to a user, a group, or an application role. If you grant WSFunctionPermission
to a user or group it will apply to all applications that are deployed in the domain.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-126, "component_permission_authorization_template Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Use Fusion Middleware Control to grant the WSFunctionPermission
permission to the user, group, or application that will attempt to authenticate to the web service.
Configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
Display Name: No Behavior Authorization Component Policy
Category: Security
When directly attached to a SOA component or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled as well. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-52 lists the configuration property that you can override for the no behavior policy.
Table 17-52 Configuration Property for oracle/no_authorization_component_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Authorization Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached authorization policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the authorization assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-53 lists the configuration property that you can override for the no behavior policy.
Table 17-53 Configuration Property for oracle/no_authorization_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Constraints Based Authorization Policy
Category: Security
This policy is a special case of role based authorization policy. This policy can be attached to any SOAP-based endpoint.
Accepts requests only if one of the following conditions is true:
The authenticated token is SAML Sender Vouches.
The user is in a particular role (the default is trustedEnterpriseRole
, that establishes the user as a trusted entity
The request is coming from within a private network.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
To successfully invoke a service that has the whitelist_authorization_policy
attached, you must do one of the following:
If the service accepts SAML sender vouches for authentication (for example, a SAML token service policy is attached to the service), you must attach the corresponding SAML token client policy to the client.
If the service accepts username/password for authentication (for example, a username token service policy is attached to the service), you must attach the corresponding username token client policy to the client and make sure that the client is in a trusted role as defined in the policy. (By default, the role defined in the predefined policy is trustedEnterpriseRole
. You need to modify this role in the predefined policy.)
If the service is invoked using Oracle HTTP Server, and it is configured to indicate that the request came from a private internal network (see "Configuring the Oracle HTTP Server to Specify the Request Origin"), then a client on the internal network only has to attach the corresponding username token client policy at the client side.
To set up OPSS:
If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. You use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Online Help.
You must configure a WebLogic Authentication provider, as described in "Configure Authentication and Identity Assertion providers" in the Oracle WebLogic Server Administration Console Online Help.
The Constraint Pattern property setting contains a requestOrigin
field that specifies whether the request originated from an internal or external network. This property is valid only when using Oracle HTTP Server and the Oracle HTTP Server administrator has added a custom VIRTUAL_HOST_TYPE
header to the request. To configure the Oracle HTTP Server, see "Configuring the Oracle HTTP Server to Specify the Request Origin".
Table 17-54 summarize the predefined OWSM message protection only security policies.
Table 17-54 Predefined Message Protection Only Security Policies
Policy Name | Description |
---|---|
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. |
|
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. |
|
Provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
Enforces message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
|
Provides message integrity and confidentiality for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
|
Enforces message integrity and confidentiality for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
Display Name: No Behavior Message Protection Client Policy
Category: Security
When directly attached to a client endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the message protection assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-55 lists the configuration property that you can override for the no behavior policy.
Table 17-55 Configuration Property for oracle/no_messageprotection_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Behavior Message Protection Service Policy
Category: Security
When directly attached to a service endpoint or globally attached at a lower scope, effectively disables a globally attached message protection policy at a higher scope. If the globally attached policy contains any other assertions, in addition to the message protection assertion, those assertions are disabled also. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
This policy is not supported for Java EE (WebLogic) web services.All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-56 lists the configuration property that you can override for the no behavior policy.
Table 17-56 Configuration Property for oracle/no_messageprotection_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: Wss10 Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-38, "wss10_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To configure OPSS, set up the OWSM keystore and the web service client keystore, as described in "Configuring Keystores for Message Protection". The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
You can include signature and encryption elements in the Security header in conformance with the WS-Security 1.0 standards.
The following example (WS-Security 1.0 Message Integrity of SOAP Message) shows the typical structure of a signature included in the Security header. In this example, the body element of the SOAP message is signed.
<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> <dsig:SignedInfo> <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> <dsig:Reference URI="#Timestamp-..."> <dsig:Transforms> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </dsig:Transforms> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <dsig:DigestValue>...</dsig:DigestValue> </dsig:Reference> <dsig:Reference URI="#Body-..."> <dsig:Transforms> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </dsig:Transforms> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <dsig:DigestValue>...</dsig:DigestValue> </dsig:Reference> <dsig:Reference URI="#KeyInfo-..."> <dsig:Transforms> <dsig:Transform Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform"> <TransformationParameters xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns="http://www.w3.org/2000/09/xmldsig#"/> </TransformationParameters> </dsig:Transform> </dsig:Transforms> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <dsig:DigestValue>...</dsig:DigestValue> </dsig:Reference> </dsig:SignedInfo> <dsig:SignatureValue>....</dsig:SignatureValue> <dsig:KeyInfo Id="KeyInfo-..."> <wsse:SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"> ...</wsse:KeyIdentifier> </wsse:SecurityTokenReference> </dsig:KeyInfo> </dsig:Signature>
The following example (WS-Security 1.0 Message Confidentiality of SOAP Message) shows the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
<env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-JA9fsCRnqbFJ0ocBAMKb7g22"> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content" Id="..."> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/> <xenc:CipherData> <xenc:CipherValue>...</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </env:Body>
Display Name: Wss10 Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
The messages are protected using WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-39, "wss10_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. You also need to store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Message Protection Client Policy
Category: Security
Provides message integrity and confidentiality for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
Symmetric key technology is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-41, "wss11_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore and the web service client keystore, as described in "Configuring Keystores for Message Protection". The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure the policy assertion for message signing, message encryption, or both.
The following example (WS-Security 1.1 Message Confidentiality of SOAP Message) shows the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="EK-..."> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" /> </xenc:EncryptionMethod> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> <wsse:SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">...</wsse:KeyIdentifier> </wsse:SecurityTokenReference> </dsig:KeyInfo> <xenc:CipherData> <xenc:CipherValue>...</xenc:CipherValue> </xenc:CipherData> <xenc:ReferenceList> <xenc:DataReference URI="#_..." /> </xenc:ReferenceList> </xenc:EncryptedKey> <env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-..."> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content" Id="..."> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:Reference URI="#EK-..." ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" /> </wsse:SecurityTokenReference> </dsig:KeyInfo> <xenc:CipherData> <xenc:CipherValue>...</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </env:Body>
Display Name: Wss11 Message Protection Service Policy
Category: Security
Enforces message integrity and confidentiality for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-42, "wss11_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
To set up OPSS:
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. You also need to store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Table 17-57 summarize the predefined OWSM message protection and authentication security policies.
Table 17-57 Predefined OWSM Message Protection and Authentication Policies
Policy Name | Description |
---|---|
Encrypts the PII data you want to protect. |
|
Specifies the STS client configuration information that is used to invoke the STS for token exchange. |
|
Specifies the STS configuration information that is used to invoke the STS for token exchange. |
|
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
|
|
Includes SAML tokens in outbound SOAP request messages. |
|
Includes SAML tokens in outbound SOAP request messages. |
|
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. |
|
Includes credentials in the HTTP header for outbound client requests, authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. |
|
Extracts the credentials in the HTTP header and authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. |
|
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type. |
|
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
Includes SAML tokens in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header, and verifies that the transport protocol provides SSL message protection. |
|
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. |
|
oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_policy |
Inserts a SAML bearer assertion issued by a trusted STS. |
oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_policy |
Authenticates a SAML bearer assertion issued by a trusted STS. |
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. |
|
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. |
|
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. |
|
oracle/wss10_saml_hok_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and SAML holder of key based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_hok_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML holder of key based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_integrity_client_policy |
Provides message-level integrity and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_integrity_service_policy |
Enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_protection_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_protection_ski_basic256_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml_token_with_message_protection_ski_basic256_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml20_token_with_message_protection_client_policy |
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. |
oracle/wss10_saml20_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_username_id_propagation_with_msg_protection_client_policy |
Provides message protection (integrity and confidentiality) and identity propagation for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_username_id_propagation_with_msg_protection_service_policy |
Enforces message level protection (i.e., integrity and confidentiality) and identity propagation for inbound SOAP requests using mechanisms described in WS-Security 1.0. |
oracle/wss10_username_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_username_token_with_message_protection_service_policy |
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_username_token_with_message_protection_ski_basic256_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_username_token_with_message_protection_ski_basic256_service_policy |
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_x509_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and certificate credential population for outbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss10_x509_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. |
oracle/wss11_kerberos_token_with_message_protection_client_policy |
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
oracle/wss11_kerberos_token_with_message_protection_service_policy |
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy |
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy |
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. |
oracle/wss11_saml_or_username_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML, username, or HTTP token, respectively:
|
oracle/wss11_saml_token_identity_switch_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml_token_with_message_protection_wssc_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml_token_with_message_protection_wssc_reauthn_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml_token_with_message_protection_wssc_reauthn_service_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml20_token_with_message_protection_client_policy |
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. |
oracle/wss11_saml20_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_sts_issued_saml_hok_with_message_protection_client_policy |
Inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS. |
oracle/wss11_sts_issued_saml_hok_with_message_protection_service_policy |
Authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). |
oracle/wss11_username_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client. |
oracle/wss11_username_token_with_message_protection_service_policy |
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_username_token_with_message_protection_wssc_client_policy |
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_username_token_with_message_protection_wssc_service_policy |
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_x509_token_with_message_protection_client_policy |
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_x509_token_with_message_protection_service_policy |
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_x509_token_with_message_protection_wssc_client_policy |
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. |
oracle/wss11_x509_token_with_message_protection_wssc_service_policy |
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. |
Display Name: PII Security Policy
Category: Security
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
Override the configuration properties defined in Table 18-104, "pii_security_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Display Name: STS Trust Configuration Client Policy
Category: Security
Specifies the STS client configuration information that is used to invoke the STS for token exchange.
Use this policy only if you are not using Automatic (Client STS) Policy Configuration, as described in "Setting Up Automatic Policy Configuration for STS"
If you attach multiple instances of oracle/sts_trust_config_client_policy
, no error is generated. However, only one instance is enforced, and you cannot control which instance that is.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised.
To configure the policy:
Override the configuration properties defined in Table 18-107, "oracle/sts_trust_config_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the STS configuration policy from the web service, as described in "Setting Up Automatic Policy Configuration for STS".
However, if you did not configure the STS configuration policy from the web service, or if you are using the SAML sender vouches confirmation method, then you must configure it from the web service client. For more information, see "Manually Configuring the STS Config Policy From the Web Service Client: Main Steps".
At design time, you can set up and attach the oracle/sts_trust_config_client_policy
policy programmatically, as shown in the following example.
URL endpointUrl = new URL(getWebConnectionString() + "/jaxws-test-service/jaxws-test-port"); ServiceDelegateImpl client = new ServiceDelegateImpl( new URL(endpointUrl.toString() + "?WSDL"), new QName("http://jaxws.example.com/targetNamespace/JaxwsService", "JaxwsService"), OracleService.class); JaxwsService port = client.getPort( new QName("http://jaxws.example.com/targetNamespace/JaxwsService", "JaxwsServicePort"), test.jaxws.client.JaxwsService.class); ((BindingProvider)port).getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY,endpointUrl.toExternalForm()); ((BindingProvider)port).getRequestContext().put(ClientConstants.CLIENT_CONFIG, fileToElement(new File("./jaxws/client/dat/oracle-webservice-client.xml")));
The following example shows the related oracle-webservice-client.xml
file with the STS config policy and STS issue policy.
<?xml version="1.0" encoding="UTF-8"?> <oracle-webservice-clients> <webservice-client> <port-info> <policy-references> <policy-reference uri="oracle/sts_trust_config_client_policy" category="security"/> <policy-reference uri="oracle/wss11_sts_issue_saml_hok_with_message_protection_client_policy " category="security"/> </policy-references> </port-info> </webservice-client> </oracle-webservice-clients>
Display Name: STS Trust Configuration Service Policy
Category: Security
Specifies the STS configuration information that is used to invoke the STS for token exchange.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-109, "oracle/sts_trust_config_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration for STS".
Display Name: WSSecurity SAML Token Bearer or WSSecurity UserName Token
Category: Security
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the bearer confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains the following assertions as an OR group—meaning either type of policy can be enforced by a client:
The assertions are advertised in the WSDL.
Display Name: Wss SAML Token or Wss Username Token Service Policy
Category: Security
Enforces one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion templates, as an OR group—meaning either one of the tokens can be sent by the client:
The assertions are advertised in the WSDL.
For information about configuring this policy, refer to the following policy descriptions:
Display Name: Wss SAML Token or Wss Username Token Over SSL Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML or username token, respectively:
SAML token within WS-Security SOAP header using the sender-vouches confirmation type.
WS-Security UsernameToken SOAP header to authenticate users against the configured identity store.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion templates as an OR group—meaning either one of the tokens can be sent by the client:
The assertions are advertised in the WSDL.
For information about configuring this policy, refer to the following policy descriptions:
Display Name: Wss SAML Token (confirmation method as bearer) Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-52, "wss_saml_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss SAML Token (confirmation method as bearer) Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically. The policy also verifies that the transport protocol provides SSL message protection. This policy can be attached to any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-52, "wss_saml_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss SAML Token (confirmation method as bearer) Over SSL Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. The credentials in the SAML token are authenticated against a SAML login module. The policy verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-53, "wss_saml_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss HTTP Token Over SSL Client Policy
Category: Security
Includes credentials in the HTTP header for outbound client requests, authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. The client must pass the credentials in the HTTP header.
Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based client.
Note:
Currently only HTTP basic authentication is supported.This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-45, "wss_http_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring One-Way SSL for a Web Service Client".
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
The client must pass the credentials in the HTTP header.
Display Name: Wss HTTP Token Over SSL Service Policy
Category: Security
Extracts the credentials in the HTTP header and authenticates users against the OPSS identity store, and verifies that the transport protocol is HTTPS. Requests over a non-HTTPS transport protocol are refused. This policy can be enforced on any HTTP-based endpoint.
Notes:
This policy functions similarly to oracle/http_basic_auth_over_ssl_service_policy. The only difference is thatoracle/wss_http_token_over_ssl_service_policy
enables the include-timestamp
attribute in the require-tls
element to prevent replay attacks, which is not applicable to RESTful services. For more information about the require-tls
element, see "orasp:require-tls Element".
Currently only HTTP basic authentication is supported.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-46, "wss_http_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way SSL, as described in "Configuring One-Way SSL for a Web Service Client".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Display Name: Wss SAML Token Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type. The policy verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-58, "wss_saml_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss SAML Token Over SSL Service Policy
Category: Security
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. The SAML token is mapped to a user in the configured identity store. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-59, "wss_saml_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss SAML V2.0 Token (confirmation method as bearer) Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. The SAML token with confirmation method Bearer is created automatically. This policy can be attached to any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-55, "wss_saml20_token_bearer_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
on the Configurations page, or override it on a per-client basis using the Security Configuration Details control when you attach the policy. The propagate.identity.context
property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss SAML V2.0 Token (confirmation method as bearer) Over SSL Service Policy
Category: Security
Authenticates users using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header, and verifies that the transport protocol provides SSL message protection. The credentials in the SAML token are authenticated against a SAML login module. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-56, "wss_saml20_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss SAML V2.0 Token Over SSL Client Policy
Category: Security
Includes SAML tokens in outbound WS-Security SOAP headers using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. This policy can be enforced on any SOAP-based client.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-61, "wss_saml20_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss SAML V2.0 Token Over SSL Service Policy
Category: Security
Enforces the authentication of credentials provided via a SAML token within WS-Security SOAP header using the sender-vouches confirmation type, and verifies that the transport protocol provides SSL message protection. The SAML token is mapped to a user in the configured identity store. This policy can be enforced on any SOAP-based endpoint.
The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-56, "wss_saml20_token_bearer_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the provider.
Configure SAML and set up OPSS, as described in "Configuring SAML".
Display Name: Wss Issued Token with Saml Bearer Over SSL Client Policy
Category: Security
Inserts a SAML bearer assertion issued by a trusted STS. Messages are protected using SSL.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-111, "oracle/wss_sts_issued_saml_bearer_token_over_ssl_client_template Properties". For more information, see "Overriding Policy Configuration Properties". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML on the client side, as described in "Configuring SAML Web Service Client at Design Time".
Display Name: Wss Issued Token with Saml Bearer Over SSL Service Policy
Category: Security
Authenticates a SAML bearer assertion issued by a trusted STS. Messages are protected using SSL.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
See also "WS-Trust Assertion Templates" for more information about the assertion.
To configure the policy:
Override the configuration properties defined in Table 18-112, "oracle/wss_sts_issued_saml_bearer_token_over_ssl_service_template Properties". For more information, see "Overriding Policy Configuration Properties". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss Username Token Over SSL Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-64, "wss_username_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For information about how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>
) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Over SSL Service Policy
Category: Security
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-65, "wss_username_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
The username and password must exist and be valid.
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss Username Token Over SSL with secure conversation enabled Client Policy
Category: Security
Includes credentials in the WS-Security UsernameToken header in outbound SOAP request messages, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy has secure conversation enabled. For more information, see Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-64, "wss_username_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure secure conversation, as describe in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. See "Adding Keys and User Credentials to Configure the Credential Store" for information about how to add the key to the credential store.
If you specify a password type of None on the Settings page, you do not need to include a password in the key.
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>
) in the SOAP request message. The client provides a username and password for authentication.
Display Name: Wss Username Token Over SSL with secure conversation enabled Service Policy
Category: Security
Uses the credentials in the WS-Security UsernameToken SOAP header to authenticate users against the OPSS configured identity store, and verifies that the transport protocol provides SSL message protection. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy has secure conversation enabled. For more information, see Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-65, "wss_username_token_over_ssl_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
The username and password must exist and be valid.
Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
Display Name: Wss10 SAML Holder-Of-Key Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and SAML holder of key based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. A SAML token, included in the SOAP message, is used in SAML-based authentication with holder of key confirmation.
The policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-67, "wss10_saml_hok_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. See "Adding an Additional SAML Assertion Issuer Name" for additional considerations.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Override the saml.assertion.filename
property to point to the file that has the holder-of-key assertion, as described in "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Override the saml.assertion.filename
property to point to the file that has the holder-of-key assertion. For more information, see "Overriding Client Policy Configuration Properties at Design Time".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML for the web service client at design time, as described in "Configuring SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Holder-Of-Key Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML holder of key based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-68, "wss10_saml_hok_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Note:
ACertificateExpiredException
is returned if an expired certificate is present in the keystore, regardless of whether this certificate is being referenced. To resolve this exception, remove the expired certificate from the keystore.Configure one-way or two-way SSL, as described in "Configuring One-Way SSL on WebLogic Server" or "Configuring Two-Way SSL for a Web Service Client", respectively.
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Store the trusted certificate of the SAML authority in the keystore.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Display Name: Wss10 SAML Token With Message Integrity Client Policy
Category: Security
Provides message-level integrity and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. A SAML token, included in the SOAP message, is used in SAML-based authentication with sender vouches confirmation.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies and SHA-1 hashing algorithm for message integrity. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-70, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure SAML, as described in "Configuring SAML".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the client for SAML at design time, as described in "Configuring SAML Web Service Client at Design Time".
Include a WS-Security Header Element (<saml:Assertion>
) that inserts a SAML token in the outbound SOAP message. The confirmation type is always sender-vouches
.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Integrity Service Policy
Category: Security
Enforces message-level integrity protection and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. It extracts the SAML token from the WS-Security binary security token or the current Java Authentication and Authorization Service (JAAS) subject, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies and SHA-1 hashing algorithm for message integrity. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-71, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Display Name: Wss10 SAML Token With Message Protection Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-70, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. See "Using SAML Policies to Propagate Identity Context" for additional considerations.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure SAML, as described in "Configuring SAML".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure the client for SAML at design time, as described in "Configuring SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-71, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Store the trusted certificate of the SAML authority in the keystore.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Display Name: Wss10 SAML Token With Message Protection SKI Basic 256 Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html
.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security
with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-70, "wss10_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Configure SAML, as described in "Configuring SAML".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML Token With Message Protection SKI Basic 256 Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
The policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites"
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html
.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security
with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-71, "wss10_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module. For more information, see "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Specify a value for propagate.identity.context
, as described in "Overriding Policy Configuration Properties". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
This policy requires you to set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Display Name: Wss10 SAML V2.0 Token With Message Protection Client Policy
Category: Security
Provides message-level protection and SAML-based authentication for outbound SOAP messages in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-73, "wss10_saml20_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include
, as described in "Configuring Keystores for Message Protection".
Specify a value for propagate.identity.context
, as described in "Configuring Keystores for Message Protection". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 SAML V2.0 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. The web service consumer includes a SAML token in the SOAP header and the confirmation type is sender-vouches. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
To prevent replay attacks, the assertion provides the option to include time stamps, SAML token limits, and their verification by the web service provider.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-74, "wss10_saml20_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml2.loginmodule
login module. See "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control" for more information. The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
To set up OPSS:
Configure SAML, as described in "Configuring SAML".
Configure the policy assertion for message signing, message encryption, or both.
This policy requires you to set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Display Name: Wss10 Username Id Propagation With Message Protection Client Policy
Category: Security
Note:
In this release, the policy oracle/wss10_username_id_propagation_with_msg_protection_client_policy has been deprecated.Provides message protection (integrity and confidentiality) and identity propagation for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Credentials (only username) are included in outbound SOAP request messages via a WS-Security UsernameToken header. No password is included.This policy can be enforced on any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
Message protection is provided using WS-Security's Basic128 suite of asymmetric key technologies. Specifically RSA key mechanisms for confidentiality, SHA-1 hashing algorithm for integrity and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-76, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Include a WS-Security UsernameToken element (<wsse:UsernameToken/>
) in the SOAP request message. The client provides a username and password for authentication.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Id Propagation With Message Protection Service Policy
Category: Security
Note:
In this release, the policy oracle/wss10_username_id_propagation_with_msg_protection_service_policy has been deprecated.Enforces message level protection (i.e., integrity and confidentiality) and identity propagation for inbound SOAP requests using mechanisms described in WS-Security 1.0. This policy can be enforced on any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
Message protection is provided using WS-Security 1.0's Basic128 suite of asymmetric key technologies. Specifically RSA key mechanisms for confidentiality, SHA-1 hashing algorithm for integrity and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 Username Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-76, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For more information about the how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Token With Message Protection Service Policy
Category: Security
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 Username Token With Message Protection SKI Basic 256 Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html
.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security
with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-76, "wss10_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for csf-key
, as described in "Overriding Policy Configuration Properties". The value signifies a key that maps to a username/password. For more information about the how to add the key to the credential store, see "Adding Keys and User Credentials to Configure the Credential Store".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 Username Token With Message Protection SKI Basic 256 Service Policy
Category: Security
Enforces message protection (message integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses WS-Security's Basic 256 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-256 bit encryption. This policy uses Subject Key Identifier (ski) reference mechanism for encryption key in the request and for both signature and encryption keys in the response. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
Note:
Due to the import restrictions of some countries, the jurisdiction policy files distributed with the JDK 5.0 software have built-in restrictions on available cryptographic strength.By default, policies that use the basic192 algorithms and above do not work with the bundled JRE/JDK. To use these algorithms, you need to download the JCE Extension jars (Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0) file from http://www.oracle.com/technetwork/java/javase/downloads/index-jdk5-jsp-142662.html
.
To use these policy files, you need to replace the following JAR files in $JAVA_HOME/jre/lib/security
with the corresponding JARs from the JCE Extension:
US_export_policy.jar
local_policy.jar
You should back up your existing JAR files before replacing them.
To configure the policy:
Override the configuration properties defined in Table 18-77, "wss10_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the keystore. When using the ski reference mechanism, use OpenSSL or another such utility to create the certificate.
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss10 X509 Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate credential population for outbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-79, "wss10_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 shows the typical structure of a signature included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element of the SOAP message is signed.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.0 standards. In this example, the body element is encrypted.
Display Name: Wss10 X509 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.0 standard.
This policy uses WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanisms for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-79, "wss10_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure an Authentication provider, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.sig.csf.key
and keystore.enc.csf.key
server-side configuration properties, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Kerberos Token With Message Protection Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard.
This policy can be enforced on any SOAP-based client.
This policy is compatible with MIT Kerberos KDC and with newer versions of Active Directory KDC. It is not compatible with versions of Active Directory earlier than 2008 because it uses Triple DES encryption. With these earlier versions, use "oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-82, "wss11_kerberos_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Configure Kerberos tokens, as described in "Configuring Kerberos Tokens".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Kerberos Token With Message Protection Service Policy
Category: Security
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. It extracts the Kerberos token from the SOAP header and authenticates the user, and it enforces message integrity and confidentiality using Kerberos keys. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
This policy can be enforced on any SOAP-based endpoint.
This policy is compatible with MIT Kerberos KDC and with newer versions of Active Directory KDC. It is not compatible with versions of Active Directory earlier than 2008 because it uses Triple DES encryption. With these earlier versions, use "oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-82, "wss11_kerberos_token_over_ssl_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule
login module. See "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Display Name: Wss11 Kerberos Token With Message Protection Basic 128 Client Policy
Category: Security
Includes a Kerberos token in the WS-Security header, and uses Kerberos keys to guarantee message integrity and confidentiality, in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with Active Directory KDCs. This policy can be enforced on any SOAP-based client.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-85, "wss11_kerberos_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Configure Kerberos tokens, as described in "Configuring Kerberos Tokens".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Kerberos Token With Message Protection Basic 128 Service Policy
Category: Security
Enforced in accordance with the WS-Security Kerberos Token Profile v1.1 standard. This policy is compatible with Active Directory KDCs. This policy can be attached to any SOAP-based endpoint.
This policy uses the WS-Security's Basic 128 suite of asymmetric key technologies, specifically RSA key mechanism for message confidentiality, SHA-1 hashing algorithm for message integrity, and AES-128 bit encryption. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy extracts the Kerberos token from the SOAP header and authenticates the user, and it enforces message integrity and confidentiality using Kerberos keys. The container must have the Kerberos infrastructure configured through Oracle Platform Security Services.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
To configure the policy:
Override the configuration properties defined in Table 18-86, "wss11_kerberos_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the krb5.loginmodule
login module. See "Configuring the Kerberos Login Module".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Configure Kerberos, as described in "Configuring Kerberos Tokens".
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token or Wss11 Username Token With Message Protection or Wss SAML Token(Confirmation Method As Bearer) Over SSL or Wss Username Token Over SSL or Http Basic Auth Over SSL Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and one of the following authentication policies, based on whether the client uses a SAML, username, or HTTP token, respectively:
SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
Username token authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
SAML-based authentication using credentials provided in SAML tokens with confirmation method 'Bearer' in the WS-Security SOAP header. Verifies that the transport protocol provides SSL message protection.
Username token authentication using the credentials in the UsernameToken WS-Security SOAP header to authenticate users against the configured identity store. Verifies that the transport protocol provides SSL message protection.
HTTP authentication using credentials extracted from the HTTP header to authenticate users against the configured identity store. Verifies that the transport protocol is HTTPS.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available algorithms for message protection, see "Supported Algorithm Suites".
This policy contains the following assertions, as an OR group—meaning any one of the tokens can be sent by the client:
oracle/wss11_saml_token_with_message_protection_service_template
oracle/wss11_username_token_with_message_protection_service_template
The assertions are advertised in the WSDL.
Display Name: Wss11 Saml Token Identity Switch With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-88, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
subject.precedence
is set to false
to allow for the use of a client-specified username rather than the authenticated subject. (If subject.precedence
is false
, the user name to create the SAML assertion is obtained only from the csf-key
username property.) The wss11_saml_token_identity_switch_with_message_protection_client_policy policy
requires that an application to which the policy is attached must have the WSIdentityPermission
permission. That is, applications from which OWSM accepts the externally-supplied identity must have the WSIdentityPermission
permission. This is to avoid potentially rogue applications from providing an identity to OWSM.
For information about configuring this policy, see "Configuring SAML Web Service Clients for Identity Switching". In particular, you need to set the javax.xml.ws.security.auth.username property, as described in "Setting the javax.xml.ws.security.auth.username Property", and the WSIdentityPermission permission, as descried in "Setting the WSIdentityPermission Permission".
For additional SAML considerations, see "Configuring SAML Web Service Client at Design Time".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for saml.issuer.uri
, as described in "Overriding Policy Configuration Properties".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-88, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Configuring Keystores for Message Protection". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection Service Policy
Category: Security
This policy enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-89, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-88, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Configuring Keystores for Message Protection". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection with secure conversation enabled Service Policy
Category: Security
This policy enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-89, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml Token With Message Protection with secure conversation and re-authenticate mode enabled Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-88, "wss11_saml_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Configuring Keystores for Message Protection". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml Token With Message Protection with secure conversation and re-authenticate mode enabled Service Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-89, "wss11_saml_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Saml V2.0 Token With Message Protection Client Policy
Category: Security
Enables message protection (integrity and confidentiality) and SAML token population for outbound SOAP requests using mechanisms described in WS-Security 1.1. A SAML token is included in the SOAP message for use in SAML based authentication with sender vouches confirmation.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-91, "wss11_saml20_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Specify a value for saml.issuer.name
, as described in "Overriding Policy Configuration Properties". The saml.issuer.name
property defaults to a value of www.oracle.com
. For additional considerations, see "Adding an Additional SAML Assertion Issuer Name".
Specify a value for user.roles.include
, as described in "Overriding Policy Configuration Properties".
Specify a value for propagate.identity.context
, as described in "Configuring Keystores for Message Protection". The propagate.identity.context
property defaults to a value of blank. For additional considerations, see "Using SAML Policies to Propagate Identity Context".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
Configure SAML, as described in "Configuring SAML Web Service Client at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Saml V2.0 Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and SAML-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. It extracts the SAML token from the WS-Security binary security token, and uses those credentials to validate users against the Oracle Platform Security Services identity store.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-92, "wss11_saml20_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure SAML, as described in "Configuring SAML".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
Configure the saml.loginmodule
login module, as described in "Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control". The SAML login module extracts the username from the verified token and passes it to the Authentication provider.
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Client Policy
Category: Security
Inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-114, "oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Note:
When using Oracle STS, the asymmetric proof key (HoK) use-case works only when a client cert csf key is configured in the policy using thests.auth.x509.csf.key
configuration override.
This value is used for signing the WS-Trust request sent to the STS and by Oracle STS as the proof key. The public key in the SAML assertion also corresponds to this keypair.
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Service Policy
Category: Security
Authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using WS-Security's Basic 128 suite of symmetric key technologies.
You also have the option to override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-115, "oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Client Policy
Category: Security
This policy inserts a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using proof key material provided by the STS.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-114, "oracle/wss11_sts_issued_saml_hok_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Issued Token with Saml Holder of Key with Message Protection Service Policy
Category: Security
This policy authenticates a SAML HOK assertion issued by a trusted STS (Security Token Service). Messages are protected using WS-Security's Basic 128 suite of symmetric key technologies.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-115, "oracle/wss11_sts_issued_saml_hok_with_message_protection_service_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
Display Name: Wss11 Issued Token with Saml Sender Vouches with Message Protection Client Policy
Category: Security
This policy inserts a SAML sender vouches assertion issued by a trusted STS (Security Token Service). Messages are protected using the client's private key.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-117, "oracle/wss11_sts_issued_saml_with_message_protection_client_template Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time". For examples of overriding STS configuration settings, see "Programmatically Overriding Policy Configuration for WS-Trust Client Policies".
Set up the web service client, as described in "Setting Up Automatic Policy Configuration: Main Steps".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Display Name: Wss11 Username Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-94, "wss11_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.sig.csf.key
and keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Username Token With Message Protection Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-95, "wss11_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 Username Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported. This policy can be attached to any SOAP-based client.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-94, "wss11_username_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
This policy uses symmetric key technology, which is an encryption method that uses the same shared key to encrypt and decrypt data. The symmetric key is used to sign the message.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 Username Token With Message Protection with secure conversation enabled Service Policy
Category: Security
Enforces message protection (integrity and confidentiality) and authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard. Both plain text and digest mechanisms are supported.
The web service consumer inserts username and password credentials, and signs and encrypts the outgoing SOAP message. The web service provider decrypts and verifies the message and the signature. This policy can be attached to any SOAP-based endpoint.
To protect against replay attacks, the assertion provides the option to require nonce and creation time in the username token. The SOAP message is signed and encrypted. The web service provider decrypts the message, and verifies and authenticates the signature.
To prevent replay attacks, the assertion provides the option to include time stamps and verification by the web service provider. The message can be protected with ciphers of different strengths.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-95, "wss11_username_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Add an Authentication provider to the active security realm for the WebLogic domain in which the web service is deployed, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 X509 Token With Message Protection Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-97, "wss11_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
Specify a value for keystore.enc.csf.key
, as described in "Overriding Policy Configuration Properties".
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 X509 Token With Message Protection Service Policy
Category: Security
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-98, "wss11_x509_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the Authentication provider, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss11 X509 Token With Message Protection with secure conversation enabled Client Policy
Category: Security
Provides message protection (integrity and confidentiality) and certificate-based authentication for outbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised.
To configure the policy:
Override the configuration properties defined in Table 18-97, "wss11_x509_token_with_message_protection_client_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Set up the OWSM keystore to specify a key (username/password or X.509) to authenticate to the STS, as described in "Configuring Keystores for Message Protection".
Configure the policy assertion for message signing, message encryption, or both.
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
The web service's base64-encoded public certificate is published in the WSDL for use by the web service client, as described in "Using the Service Identity Certificate Extensions". As an alternative, you can specify a value for keystore.recipient.alias
, as described in "Overriding Policy Configuration Properties". The keystore.recipient.alias
specifies the alias used to look up the public key in the keystore when retrieving a key for encryption of outbound SOAP messages.
At design time:
Override configuration settings, as described in "Overriding Client Policy Configuration Properties at Design Time".
Configure Secure Conversation, as described in Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Set up the web service client keystore, as described in "Understanding Keys and Certificates" in Understanding Oracle Web Services Manager. The policy specifically requires that the client's and web service's respective keystores already contain digital certificates containing each other's public key.
The web service client needs to provide valid X.509 authentication credentials in the SOAP message through the WS-Security binary security token.
Configure the policy assertion for message signing, message encryption, or both.
Example 17-0 is an example of the typical structure of encryption elements included in the Security header in conformance with the WS-Security 1.1 standards. In this example, the body element is encrypted.
Display Name: Wss11 X509 Token With Message Protection with secure conversation enabled Service Policy
Category: Security
Enforces message-level protection and certificate-based authentication for inbound SOAP requests in accordance with the WS-Security 1.1 standard.
This policy uses the symmetric key technology for signing and encryption, and the WS-Security's Basic 128 suite of asymmetric key technology for endorsing signatures. For more information about the available asymmetric algorithms for message protection, see "Supported Algorithm Suites".
This policy has secure conversation enabled. See Chapter 12, "Configuring Secure Conversation Using Oracle Web Services Manager".
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-98, "wss11_x509_token_with_message_protection_service_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Configure the Authentication provider, as described in "Supported Authentication Providers in WebLogic Server".
To set up OPSS:
Configure the policy assertion for message signing, message encryption, or both.
Set up the OWSM keystore, as described in "Configuring Keystores for Message Protection".
Store the trusted certificate that corresponds to the client's private key (used to sign the message) in the keystore. Store the service's private key in the keystore for decrypting the message, and the CA root certificate.
Store the password for the decryption key in the credential store, as described in "Adding Keys and User Credentials to Configure the Credential Store". Use keystore.enc.csf.key
as the key name.
Override the keystore.enc.csf.key
server-side configuration property, as described in "Overview of Policy Configuration Overrides".
Display Name: Wss SAML Token Bearer Identity Switch Client Policy
Category: Security
Performs dynamic identity switching by propagating a different identity than the one based on the authenticated subject. This policy includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically. This policy can be attached to any SOAP-based client.
This policy contains the following assertion:
oracle/wss_saml_token_bearer_client_template
See "oracle/wss_saml_token_bearer_client_template" for more information about the assertion.
This policy includes SAML tokens in outbound SOAP request messages. The SAML token with confirmation method Bearer is created automatically. The policy also verifies that the transport protocol provides SSL message protection. This policy can be attached to any SOAP-based client.
This policy contains the following policy assertion: oracle/wss_saml_token_bearer_over_ssl_client_template. See "oracle/wss_saml_token_bearer_client_template" for more information about the assertion.
See Table 18-47.
See Table 18-48.
Table 17-58 summarize the predefined OWSM Oracle Entitlements Server (OES) security policies.
Table 17-58 Predefined OWSM Oracle Entitlements Server Security Policies
Policy Name | Description |
---|---|
Sets user authorization based on the policy defined in Oracle Entitlements Server. |
|
Does response masking based on the policy defined in Oracle Entitlements Server. |
|
Sets user authorization based on the policy defined in Oracle Entitlements Server. |
Display Name: Fine-grained authorization using Oracle Entitlements Server
Category: Security
This policy sets authorization based on the policy defined in Oracle Entitlements Server (OES). Authorization is based on attributes, the current authenticated subject, and the web service action invoked by the client. This policy is used for fine-grained authorization on any operation on the web service.
This policy should follow an authentication policy where the subject is established. You can attach this policy to any SOAP endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is not advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-101, "binding_oes_authorization_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Display Name: Response masking using Oracle Entitlements Server
Category: Security
This policy does response masking based on the policy defined in OES. Masking is based on attributes, the current authenticated subject, and the web service action invoked by the client. This template is used for fine-grained masking on any operation of a web service.
This policy should follow an authentication policy where the subject is established. You can attach this policy to any SOAP endpoint.
This policy contains an assertion that is based on the following assertion template, which defines the settings and configuration properties for the policy:
This assertion is advertised in the WSDL.
To configure the policy:
Override the configuration properties defined in Table 18-101, "binding_oes_authorization_template Configuration Properties". For more information, see "Overriding Policy Configuration Properties".
Table 17-59 summarize the predefined OWSM SOAP Over JMS Transport policies.
Table 17-59 Predefined OWSM SOAP Over JMS Transport Policies
Policy Name | Description |
---|---|
Enables and configures support for SOAP over JMS transport for web service clients. |
|
Enables and configures support for SOAP over JMS transport for web services. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport client policy at a higher scope. |
|
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport service policy at a higher scope. |
For more information about attaching SOAP over JMS transport policies, see:
"Configuring SOAP Over JMS Transport Using Fusion Middleware Control" in Administering Web Services
"Configuring SOAP Over JMS Transport Using WLST" in Administering Web Services
Display Name: JMS Transport Client Policy
Category: SOAP Over JMS Transport
Enables and configures support for SOAP over JMS transport for web service clients.
Note:
This policy cannot be duplicated, and the assertion template associated with this template is not available for generating new policies.This policy is not supported for Java EE (WebLogic) web services.
Table 17-60 lists the configuration properties that you can override for SOAP over JMS transport clients.
Table 17-60 Configuration Properties for oracle/jms_transport_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
JNDI name of the destination queue or topic. |
|
Required |
|
Destination type. Valid values include: |
|
Required |
|
JMS header properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
JMS message properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
JNDI name of the connection factory that is used to establish a JMS connection. |
|
Required |
|
JNDI properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: The properties are added to the |
None |
Optional |
|
Name of the initial context factory class used for JNDI lookup. This value maps to the |
|
Required |
|
JNDI provider URL. This value maps to the |
|
Required |
|
Message type to use with the request message. Valid values are For more information, see "Configuring the JMS Message Type" in Developing JAX-WS Web Services for Oracle WebLogic Server. |
|
Required |
|
JMS priority associated with the request and response message. Specify this value as a positive Integer from 0, the lowest priority, to 9, the highest priority. The default value is |
|
Required |
|
JNDI name of the JMS destination to which the response message is sent. For a two-way operation, a temporary response queue is generated by default. Using the default temporary response queue minimizes the configuration that is required. However, in the event of a server failure, the response message may be lost. This property enables the client to use a previously defined, "permanent" queue or topic rather than use the default temporary queue or topic, for receiving replies. For more information about configuring the JMS response queue, see "Configuring the Response Queue" in Developing JAX-WS Web Services for Oracle WebLogic Server. The value maps to the |
None |
Optional |
|
Port component name of the web service. This value is used by the service implementation to dispatch the service request. If not specified, the service name from the WSDL or This value maps to the |
None |
Optional |
|
Lifetime, in milliseconds, of the request message. A value of 0 indicates an infinite lifetime. On the service side, |
|
Required |
|
See "reference.priority". |
None |
Optional |
Display Name: JMS Transport Service Policy
Category: SOAP Over JMS Transport
Note:
This policy cannot be duplicated, and the assertion template associated with this template is not available for generating new policies.This policy is not supported for Java EE (WebLogic) web services.
Table 17-61 lists the configuration properties that you can override for SOAP over JMS transport for web services.
Table 17-61 Configuration Properties for oracle/jms_transport_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
Version of the SOAP JMS binding. This value must be set to This value maps to the |
|
Required |
|
Delivery mode indicating whether the request message is persistent. Valid values are |
|
Required |
|
Boolean flag that specifies whether to publish the WSDL through HTTP. |
|
Optional |
|
Principal used to run the listening MDB. |
None |
Optional |
|
Role used to run the listening MDB. |
None |
Optional |
|
Boolean flag that specifies whether to create one listening message-driven bean (MDB) for each requested destination. If set to |
|
Optional |
|
Activation configuration properties passed to the JMS provider. Each property is specified using name-value pairs, separated by semicolons (;). For example: For a list of activation configuration properties that are supported by this property, see "Summary of JMS Transport Configuration Properties" in Developing JAX-WS Web Services for Oracle WebLogic Server. |
None |
Optional |
|
JNDI name of the destination queue or topic. |
|
Required |
|
Destination type. Valid values include: |
|
Required |
|
JMS header properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
JMS message properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: |
None |
Optional |
|
JNDI name of the connection factory that is used to establish a JMS connection. |
|
Required |
|
JNDI properties. Each property is specified using name-value pairs, separated by semicolons (;). For example: The properties are added to the |
None |
Optional |
|
Name of the initial context factory class used for JNDI lookup. This value maps to the |
|
Required |
|
JNDI provider URL. This value maps to the |
|
Required |
Display Name: No Jms Transport Client Policy
Category: SOAP Over JMS Transport
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport client policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-62 lists the configuration property that you can override for the no behavior policy.
Table 17-62 Configuration Property for oracle/no_jms_transport_client_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |
Display Name: No Jms Transport Client Policy
Category: SOAP Over JMS Transport
When directly attached to an endpoint or globally attached at a lower scope, effectively disables a globally attached SOAP over JMS transport service policy at a higher scope. For details about using this no behavior policy, see "Disabling a Globally Attached Policy".
Note:
Please note the following:This no behavior policy cannot be duplicated.
The assertion template associated with this no behavior policy is not available for generating new policies.
This no_behavior policy is not supported for Java EE (WebLogic) web services.
All no behavior policies use the same no behavior assertion. An assertion template is not provided for the no behavior assertion. For that reason, it is important that you do not delete the no behavior policies. To recreate them you will need to restore the OWSM repository with the original policies. For information about restoring the repository, see "Rebuilding the OWSM Repository".
Table 17-63 lists the configuration property that you can override for the no behavior policy.
Table 17-63 Configuration Property for oracle/no_jms_transport_service_policy
Name | Description | Default | Required? |
---|---|---|---|
|
See "reference.priority". |
None |
Optional |