Home / Middleware / Oracle Web Services Manager

Contents

Title and Copyright Information

Preface

• Audience
• How to Use This Guide
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide

• New and Changed Features for Release 12c (12.2.1)
• New and Changed Features for Release 12c (12.1.3)
• Other Significant Changes in This Document for Release 12c (12.1.3)
• New and Changed Features for Release 12c (12.1.2)
• Other Significant Changes in this Book for Release 12c (12.1.2)

Part I Introducing Oracle Web Services

1 Overview of Oracle Web Services Security and Policy Management

• 1.1 Web Services Security and Policy Management

2 Using Oracle Web Services Manager with WebLogic Server

• 2.1 Installing Oracle Web Services Manager with WebLogic Server
• 2.2 Configuring OWSM with a Domain-Wide Administration Port
• 2.3 Using Cross-Component Wiring for Auto-Discovery of Policy Manager
• 2.4 Verifying Service Table Entries and Agent Bindings
  • 2.4.1 Verifying Service Table Entries and Components Using Fusion Middleware Control
  • 2.4.2 Verifying Agent Bindings Using Fusion Middleware Control
• 2.5 Modifying the Default User
  • 2.5.1 Configuring an Authentication Provider
  • 2.5.2 Configuring the Credential Store Provider
  • 2.5.3 Configuring the Policy Manager CSF Key for the Domain
  • 2.5.4 Modifying the User's Group or Role
  • 2.5.5 Ensuring the User Has the Required Role
  • 2.5.6 Examples of Using OPSS Scripts to Manage Application Roles

3 Determining Which Predefined Policies to Use for a Web Service

• 3.1 Security Policy Questionnaire for a Web Service
  • 3.1.1 Choosing the Right Authentication Policy for a Web Service
  • 3.1.2 Choosing the Right Confidentiality and Integrity Policy for a Web Service
• 3.2 Summary of Predefined Security Policies for a Web Service
  • 3.2.1 Authentication Only Policies
  • 3.2.2 Message Protection Only Policies
  • 3.2.3 Message Protection and Authentication Policies
  • 3.2.4 Authorization Policies
  • 3.2.5 WS-Trust Policies
  • 3.2.6 MTOM Attachment Policies
  • 3.2.7 Reliable Messaging Policies
  • 3.2.8 No Behavior Policies
• 3.3 Which OWSM Policies Are Supported for Java EE Web Services and Clients?
• 3.4 Which OWSM Policies Are Supported for RESTful Web Services and Clients?
• 3.5 Which OWSM Policies Are Supported for Web Services and Clients That Use SOAP Over JMS Transport
• 3.6 Which OWSM Policies Are Supported for SOA Composite Services and Clients
• 3.7 Which OWSM Policies Require You to Configure SSL?
  • 3.7.1 Which Policies Require You to Configure Two-Way SSL?
• 3.8 Which OWSM Policies Are Supported for Identity Context?
• 3.9 Which OWSM Policies Support WS-SecureConversation?
• 3.10 Which OWSM Policies Are Supported for JCA Adapters?
• 3.11 Which OWSM Policies Are Supported for OES Integration?
• 3.12 Which OWSM Policies Are Supported for PII?
• 3.13 Which OWSM Policies Are Supported for Oracle Service Bus?

Part II Attaching and Managing Policies

4 Attaching Policies to Manage and Secure Web Services

• 4.1 Overview of Policy Attachment
• 4.2 Attaching Policies to Web Services and Clients at Design Time
  • 4.2.1 Attaching Policies to Java EE Web Services and Clients at Design TIme
    • 4.2.1.1 Attaching Policies to Java EE Web Services and Clients Using Annotations
    • 4.2.1.2 Attaching Policies to Java EE Web Service Clients Using Feature Classes
    • 4.2.1.3 Attaching Policies to Java EE Web Services and Clients Using JDeveloper
  • 4.2.2 Attaching Policies to RESTful Web Services and Clients at Design Time
    • 4.2.2.1 Attaching Policies to RESTful Web Services Using Annotations
    • 4.2.2.2 Attaching Policies to RESTful Web Service Clients Using Feature Classes
    • 4.2.2.3 Attaching Policies to RESTful Web Services and Clients Using JDeveloper
  • 4.2.3 Attaching Policies to Oracle Infrastructure Web Services and Clients at Design Time
    • 4.2.3.1 Attaching Policies to Oracle Infrastructure Web Services Using Annotations
    • 4.2.3.2 Attaching Policies to Oracle Infrastructure Web Service Clients Using Feature Classes
    • 4.2.3.3 Attaching Policies to Oracle Infrastructure Web Services Using Oracle JDeveloper
• 4.3 Attaching Policies to Web Services and Clients Using Fusion Middleware Control
  • 4.3.1 Attaching Policies Directly Using Fusion Middleware Control
    • 4.3.1.1 Attaching Policies Directly to a Single Subject Using Fusion Middleware Control
    • 4.3.1.2 Attaching Policies Directly to Web Service Clients Using Fusion Middleware Control
    • 4.3.1.3 Enabling or Disabling Directly Attached Policies Using Fusion Middleware Control
    • 4.3.1.4 Detaching Directly Attached Policies Using Fusion Middleware Control
  • 4.3.2 Attaching Policies Globally Using Fusion Middleware Control
    • 4.3.2.1 Navigating to the WSM Policy Set Summary Page Using Fusion Middleware Control
    • 4.3.2.2 Viewing the Configuration of a Policy Set Using Fusion Middleware Control
    • 4.3.2.3 Creating a Policy Set Using Fusion Middleware Control
    • 4.3.2.4 Cloning a Policy Set Using Fusion Middleware Control
    • 4.3.2.5 Editing a Policy Set Using Fusion Middleware Control
    • 4.3.2.6 Specifying Run-time Constraints in a Policy Set Using Fusion Middleware Control
    • 4.3.2.7 Enabling and Disabling a Policy Set Using Fusion Middleware Control
    • 4.3.2.8 Deleting Policy Sets Using Fusion Middleware Control
  • 4.3.3 Viewing Policies Attached to a Web Service Using Fusion Middleware Control
  • 4.3.4 Validating Policy Attachments
  • 4.3.5 Validating a Policy Set
• 4.4 Attaching Policies to Web Services and Clients Using WLST
  • 4.4.1 Viewing Available Policies Using WLST
  • 4.4.2 Attaching Policies Directly to Java EE Web Services and Clients Using WLST
    • 4.4.2.1 Viewing the Policies That Are Attached to a Java EE Web Service
    • 4.4.2.2 Viewing the Policies That Are Attached to a Java EE Web Service Client
    • 4.4.2.3 Attaching Policies Directly to a Java EE Web Service Using WLST
    • 4.4.2.4 Attaching Policies Directly to Java EE Web Service Clients Using WLST
    • 4.4.2.5 Detaching Directly Attached Policies from Java EE Web Service and Clients Using WLST
    • 4.4.2.6 Enabling and Disabling Web Service Client Policies Using WLST
  • 4.4.3 Attaching Policies Directly to RESTful and Oracle Infrastructure Web Services and Clients Using WLST
    • 4.4.3.1 Identifying and Selecting the Policy Subject Using WLST
    • 4.4.3.2 Attaching Policies Directly Using WLST
    • 4.4.3.3 Enabling and Disabling Directly Attached Policies Using WLST
    • 4.4.3.4 Detaching Directly Attached Policies Using WLST
  • 4.4.4 Attaching Policies Globally Using WLST
    • 4.4.4.1 Viewing a List of Policy Sets
    • 4.4.4.2 Displaying the Configuration of a Policy Set
    • 4.4.4.3 Managing Sessions Using WLST
    • 4.4.4.4 Creating a New Policy Set Using WLST
    • 4.4.4.5 Cloning a Policy Set using WLST
    • 4.4.4.6 Editing a Policy Set
    • 4.4.4.7 Validating a Policy Set
    • 4.4.4.8 Enabling and Disabling a Policy Set
    • 4.4.4.9 Deleting Policy Sets Using WLST
    • 4.4.4.10 Specifying Runtime Constraints in Policy Sets Using WLST
  • 4.4.5 Viewing Policies Attached to a Web Service with WLST
  • 4.4.6 Displaying the Effective Policy Set Using WLST
• 4.5 Attaching Policies to Servlet Applications
  • 4.5.1 Attaching Policies Directly to Servlet Applications
  • 4.5.2 Attaching Policies Globally to Servlet Applications
• 4.6 Specifying Run-time Constraints in Policy Sets
• 4.7 Defining the Type and Scope of Resources for Globally Attached Policies
  • 4.7.1 Defining the Resource Type
  • 4.7.2 Defining the Resource Scope
  • 4.7.3 Determining the Namespace for a Web Service
  • 4.7.4 Examples of Creating Policy Sets Using Different Resource Types and Scopes
• 4.8 Migrating Direct Policy Attachments to Global Policy Attachments
• 4.9 Disabling a Globally Attached Policy
• 4.10 Specifying the Priority of a Policy Attachment
• 4.11 Managing Endpoint Configuration Properties Using Fusion Middleware Control
• 4.12 Determining the Secure Status of an Endpoint
• 4.13 How the Effective Set of Policies is Calculated
• 4.14 Determining the Source of Policy Attachments

5 Overriding Policy Configuration Properties

• 5.1 Overview of Policy Configuration Overrides
• 5.2 Scope of Predefined Configuration Properties
• 5.3 Overriding Client Policy Configuration Properties at Design Time
• 5.4 Overriding Policy Configuration Properties Using Fusion Middleware Control
  • 5.4.1 Overriding Configuration Properties at the Domain Level (Defining the Default Value)
  • 5.4.2 Overriding Configuration Properties for Directly Attached Service Policies Using Fusion Middleware Control
  • 5.4.3 Overriding Configuration Properties at the Web Service Client Application Level Using Fusion Middleware Control
  • 5.4.4 Overriding Configuration Properties for Globally Attached Policies Using Fusion Middleware Control
• 5.5 Overriding Policy Configuration Properties Using WLST
  • 5.5.1 Overriding Configuration Properties for Directly Attached Service Policies Using WLST
  • 5.5.2 Overriding Configuration Properties at the Web Service Client Application Using WLST
  • 5.5.3 Overriding Configuration Properties for Globally Attached Policies Using WLST
• 5.6 Configuring User-Defined Properties for Web Service and Client Policies Using Fusion Middleware Control
  • 5.6.1 Scope of User-Defined Configuration Properties
  • 5.6.2 Adding a User-Defined Configuration Property
  • 5.6.3 Editing a User-Defined Configuration Property
  • 5.6.4 Deleting a User-Defined Configuration Property
  • 5.6.5 Overriding the User-Defined Configuration Properties

6 Managing Web Service Policies with Fusion Middleware Control

• 6.1 Overview of Web Services Policy Management
• 6.2 Managing Web Service Policies
  • 6.2.1 Navigating to the WSM Policies Page
  • 6.2.2 Searching for Policies in the WSM Policies Page
    • 6.2.2.1 Using Advanced Search
    • 6.2.2.2 Using the Query by Example Filter
  • 6.2.3 Viewing the Details of a Web Service Policy
  • 6.2.4 Creating and Editing Web Service Policies
    • 6.2.4.1 Creating a New Web Service Policy
    • 6.2.4.2 Cloning a Web Service Policy
    • 6.2.4.3 Creating Custom Policies
    • 6.2.4.4 Editing a Web Service Policy
  • 6.2.5 Using Local Optimization with OWSM Policies (SOA Composites)
    • 6.2.5.1 Viewing the Default Local Optimization Setting in OWSM Policies
    • 6.2.5.2 Controlling When Local Optimization is Used
  • 6.2.6 Generating Client Policies from a WSDL
  • 6.2.7 Adding Assertions to a Policy
  • 6.2.8 Adding an OR Group to a Policy
  • 6.2.9 Importing Web Service Policies
  • 6.2.10 Exporting Web Service Policies
  • 6.2.11 Versioning Web Service Policies
    • 6.2.11.1 Viewing the Version History of a Web Service Policy
    • 6.2.11.2 Changing the Current Version of a Policy
    • 6.2.11.3 Deleting Versions of a Web Service Policy
    • 6.2.11.4 Exporting a Version of a Policy
  • 6.2.12 Deleting a Web Service Policy
• 6.3 Validating Web Service Policies
• 6.4 Managing Policy Assertion Templates
  • 6.4.1 Navigating to the Assertion Templates Page
  • 6.4.2 Searching for an Assertion Template in the Assertion Templates Page
    • 6.4.2.1 Using Advanced Search
    • 6.4.2.2 Using the Query by Example Filter
  • 6.4.3 Viewing the Details of an Assertion Template
  • 6.4.4 Naming Conventions for Assertion Templates
  • 6.4.5 Cloning an Assertion Template
  • 6.4.6 Editing an Assertion Template
  • 6.4.7 Editing the Configuration Properties in an Assertion Template
  • 6.4.8 Exporting an Assertion Template
  • 6.4.9 Importing an Assertion Template
  • 6.4.10 Deleting an Assertion Template
• 6.5 Enabling or Disabling Policies and Assertions
  • 6.5.1 Enabling or Disabling a Policy for all Policy Subjects
  • 6.5.2 Enabling or Disabling Assertions Within a Policy
• 6.6 Analyzing Policy Usage
• 6.7 Advertising Policy Assertions
• 6.8 Advertising WS-Policy and WS-SecurityPolicy Versions

Part III Securing Web Services

7 Configuring Message Protection for Web Services

• 7.1 Overview of Message Protection Configuration for Web Services
• 7.2 Configuring Keystores for Message Protection
  • 7.2.1 Understanding OPSS Keystore Service for Message Protection
    • 7.2.1.1 Using the OPSS Keystore Service for Message Protection
    • 7.2.1.2 Migrating a JKS Keystore Into the KSS Keystore
    • 7.2.1.3 Importing Certificates Into the KSS Keystore
    • 7.2.1.4 Overriding keystore.sig.csf.key and keystore.enc.csf.key Attributes
  • 7.2.2 Understanding Java Keystore for Message Protection
    • 7.2.2.1 Generating Private Keys and Creating the Java Keystore
    • 7.2.2.2 Obtaining a Trusted Certificate and Importing it into the Keystore
    • 7.2.2.3 Configuring the OWSM Keystore
  • 7.2.3 Adding Keys and User Credentials to Configure the Credential Store
    • 7.2.3.1 Adding Keys and User Credentials to the Credential Store Using Fusion Middleware Control
    • 7.2.3.2 Adding Keys and User Credentials to the Credential Store Using WLST
• 7.3 Creating an Application-level Credential Map
  • 7.3.1 How CSF Keys Are Retrieved from an Application-level Credential Map
  • 7.3.2 Granting Permission to Access an Application-level Credential Map
    • 7.3.2.1 Configure the csf.map Property Override
    • 7.3.2.2 Grant CredentialAccessPermission to wsm-agent-core.jar
    • 7.3.2.3 Grant WSIdentityPermission to wsm-agent-core.jar
  • 7.3.3 Policies that Can Be Used to Access an Application-level CSF Map
• 7.4 Using the Service Identity Certificate Extensions
  • 7.4.1 Ignoring the Service Identity Certificate Extension From the Client
  • 7.4.2 Ignoring Hostname Verification from the Client
• 7.5 Caching the Nonce with Oracle Coherence
  • 7.5.1 Caching the Nonce Where There Are No Managed Coherence Servers
    • 7.5.1.1 Understanding Coherence Custer Topology Where There Are No Managed Coherence Servers
    • 7.5.1.2 Configuring the Standard Topology Using Fusion Middleware Configuration Wizard
  • 7.5.2 Caching the Nonce for Storage-Disabled WebLogic Servers and Storage-Enabled Managed Coherence Servers
    • 7.5.2.1 Understanding Coherence Custer Topology For Storage-Disabled WebLogic Servers and Storage-Enabled Managed Coherence Servers
    • 7.5.2.2 Configuring the Cluster Topology Using Fusion Middleware Configuration Wizard
• 7.6 Configuring Partial Encryption with Fusion Middleware Control
  • 7.6.1 Using Fusion Middleware Control for Partial Encryption
  • 7.6.2 How to Secure SwA Attachments

8 Protecting Personally Identifiable Information

• 8.1 Protecting PII Information: Main Steps
  • 8.1.1 Approach to Follow to Determine What PII Data to Protect
  • 8.1.2 Composing the XPath Expressions to Protect the PII Data
  • 8.1.3 Configuring the PII Encryption Key
  • 8.1.4 Attaching the pii_security_policy Policy
  • 8.1.5 Attaching the pii_security_policy to SOA Composite
  • 8.1.6 Attaching the pii_security_policy to Oracle Service Bus
  • 8.1.7 Attaching the pii_security_policy to JCA Binding
• 8.2 Using WLST to Override the pii_security_policy Attributes
• 8.3 Using the API to Decrypt PII

9 Configuring Transport-Level Security (SSL)

• 9.1 Configuring Keystores for SSL
  • 9.1.1 Configuring a KSS Keystore on WebLogic Server
    • 9.1.1.1 Configuring the OPSS Keystore Service for Demo Identity and Trust
    • 9.1.1.2 Recreating the OPSS Keystore Service for Demo Identity and Trust
    • 9.1.1.3 Configuring the OPSS Keystore Service for Custom Identity and Trust
  • 9.1.2 Configuring a JKS Keystore on WebLogic Server
  • 9.1.3 Configuring Synchronization of JKS Keystore File on Cluster
• 9.2 Configuring One-Way SSL on WebLogic Server
• 9.3 Configuring Two-Way SSL on WebLogic Server
• 9.4 Configuring One-Way SSL for a Web Service Client
• 9.5 Configuring Two-Way SSL for a Web Service Client
• 9.6 Configuring SSL on Oracle HTTP Server
  • 9.6.1 Configuring One-Way SSL on Oracle HTTP Server
  • 9.6.2 Configuring Two-Way SSL on Oracle HTTP Server

10 Configuring Authorization Using Oracle Web Services Manager

• 10.1 Overview of Authorization
• 10.2 Determining Which Resources to Protect
• 10.3 Determining Authorization Permissions
• 10.4 Determining the OPSS Resource Name
• 10.5 Configuring Fine-Grained Authorization Using Oracle Entitlements Server
  • 10.5.1 Prerequisites for Configuring OES Integration
  • 10.5.2 Understanding Attributes for Obligations
  • 10.5.3 Configuring OES Policies For Fine-Grained Authorization
    • 10.5.3.1 Configuring the OES Resource
    • 10.5.3.2 Creating Authorization Policy to Return Obligations
    • 10.5.3.3 Creating Actual OES Authorization Policy
  • 10.5.4 Configuring OES Policies For Coarse-Grained Authorization
    • 10.5.4.1 Configuring the OES Resource
    • 10.5.4.2 Creating Actual OES Authorization Policy
  • 10.5.5 Configuring OES Policy For Masking
    • 10.5.5.1 Configuring the OES Resource
    • 10.5.5.2 Creating Masking Policy to Return Obligations
    • 10.5.5.3 Creating Actual OES Masking Policy
  • 10.5.6 Understanding How to Attach OWSM OES Policy
    • 10.5.6.1 Attaching the OWSM OES Policy
    • 10.5.6.2 Understanding Configuration Properties and Overrides
• 10.6 Configuring the Oracle HTTP Server to Specify the Request Origin
• 10.7 Using OAuth2 with Oracle Web Services Manager
  • 10.7.1 Understanding OAuth2 with Oracle Web Services Manager
    • 10.7.1.1 About 2-Legged Authorization
  • 10.7.2 Configuring OAuth2 for Use With Oracle Web Services Manager Policies

11 Configuring Authentication Using Oracle Web Services Manager

• 11.1 Overview of Authentication Configuration
• 11.2 Supported Authentication Providers in WebLogic Server
• 11.3 Configuring Digest Authentication
  • 11.3.1 Prerequisites for Configuring Digest Authentication
  • 11.3.2 Configuring the Default Authenticator and Identity Asserter
  • 11.3.3 Attaching a Policy and Enabling Digest Authentication
• 11.4 Configuring SAML
  • 11.4.1 Understanding the Flow of SAML Token Validation
  • 11.4.2 Configuring SAML Web Service Client at Design Time
  • 11.4.3 Including User Attributes in the Assertion
  • 11.4.4 Including User Roles in the Assertion
  • 11.4.5 Understanding the Configuration of Oracle Platform Security Services (OPSS) for SAML Policies
  • 11.4.6 Adding an Additional SAML Assertion Issuer Name
  • 11.4.7 Configuring SAML Web Service Clients for Identity Switching
    • 11.4.7.1 Understanding Identity Switching Use Case Scenarios
    • 11.4.7.2 Setting the javax.xml.ws.security.auth.username Property
    • 11.4.7.3 Setting the WSIdentityPermission Permission
  • 11.4.8 Understanding Trusted Issuers and Trusted Distinguished Names List for SAML Signing Certificates
  • 11.4.9 Understanding How to Use Anonymous Users with SAML Policies
• 11.5 Propagating Identity Context with OWSM
  • 11.5.1 An Overview of Identity Context
  • 11.5.2 Using SAML Policies to Propagate Identity Context
  • 11.5.3 Configuring Identity Context Propagation: Main Steps
• 11.6 Configuring Kerberos Tokens
  • 11.6.1 Using MIT Kerberos
    • 11.6.1.1 Initializing and Starting the MIT Kerberos KDC
    • 11.6.1.2 Creating Principals
    • 11.6.1.3 Configuring the Web Service Client to Use the Correct KDC
  • 11.6.2 Using Microsoft Active Directory with Key Distribution Center
    • 11.6.2.1 Setting Up the Web Service Client
    • 11.6.2.2 Setting Up the Web Service
  • 11.6.3 Setting the Service Principal Name In the Web Service Client
  • 11.6.4 Configuring the Web Service to Use the Correct KDC
  • 11.6.5 Using the Correct Keytab File in Enterprise Manager
    • 11.6.5.1 Extracting the Keytab File
    • 11.6.5.2 Exporting the Keytab File
    • 11.6.5.3 Modifying the krb5 Login Module to use the Keytab File
  • 11.6.6 Authenticating the User Corresponding to the Service Principal
  • 11.6.7 Creating a Ticket Cache for the Web Service Client
  • 11.6.8 Understanding How to Configure Kerberos Over SSL
  • 11.6.9 Understanding How to Configure Kerberos With SPNEGO Negotiation
  • 11.6.10 Configuring Credential Delegation
    • 11.6.10.1 Configuring Credential Delegation in Kerberos
    • 11.6.10.2 Configuring Delegation Permission to OWSM
    • 11.6.10.3 Enabling Credential Delegation in the Client Policy and the Service Policy
    • 11.6.10.4 Configuring Credential Delegation for a Service in Active Directory
    • 11.6.10.5 Configuring Credential Delegation With An Example
• 11.7 Configuring WS-Trust
  • 11.7.1 Overview of Web Services WS-Trust
    • 11.7.1.1 Understanding the Mechanism to Obtain STS Configuration
    • 11.7.1.2 Understanding the Token Types Exchanged
  • 11.7.2 Supported STS Servers
  • 11.7.3 Understanding Token Lifetime and Token Caching
  • 11.7.4 Setting Up Automatic Policy Configuration for STS
    • 11.7.4.1 Understanding the Requirements for Automatic Policy Configuration
    • 11.7.4.2 Setting Up Automatic Policy Configuration: Main Steps
    • 11.7.4.3 Manually Configuring the STS Config Policy From the Web Service Client: Main Steps
  • 11.7.5 Configuring Web Services Federation
    • 11.7.5.1 Configuring a Web Service for Web Services Federation
    • 11.7.5.2 Configuring a Web Client for Web Services Federation
    • 11.7.5.3 Configuring an STS for Web Services Federation
  • 11.7.6 An Overview of SAML Holder of Key and SAML Bearer as Issued Tokens
    • 11.7.6.1 Determining the Proof Key for SAML HOK Only
  • 11.7.7 Understanding SAML Sender Vouches as Issued Tokens
    • 11.7.7.1 Configuring SAML Sender Vouches with WS-Trust
  • 11.7.8 An Overview of On Behalf Of Use Cases
  • 11.7.9 Programmatically Overriding Policy Configuration for WS-Trust Client Policies

12 Configuring Secure Conversation Using Oracle Web Services Manager

• 12.1 Configuring Secure Conversation
  • 12.1.1 Configuring Secure Conversation Using Fusion Middleware Control
  • 12.1.2 Configuring Secure Conversation Using WLST
• 12.2 Attaching a Secure Conversation Policy at Design Time
• 12.3 Configuring Persistence
  • 12.3.1 An Overview of Persistence
  • 12.3.2 Configuring Persistence for a Web Service
  • 12.3.3 Configuring Persistence for a Client
• 12.4 Understanding Secure Conversation Sessions
  • 12.4.1 Managing Secure Conversation Sessions Using WLST Commands

13 Integrating Hardware with Oracle Web Services Manager

• 13.1 Using Hardware Security Modules With OWSM
  • 13.1.1 Understanding SafeNet Luna SA With OWSM for Key Storage
  • 13.1.2 About Installing and Configuring the Luna SA HSM Client
  • 13.1.3 Configuring the JRE Used By OWSM
  • 13.1.4 Logging On to Luna SA
  • 13.1.5 Copying Keys and Certificates to Luna SA
  • 13.1.6 Configuring OWSM to Use Luna SA
• 13.2 Configuring OWSM for Oracle SPARC T5 and SPARC T4 Cryptographic Acceleration
  • 13.2.1 Terms You Need to Understand
  • 13.2.2 Overview of Oracle SPARC T5 and SPARC T4 Hardware Assisted Cryptographic Acceleration
  • 13.2.3 Configuring Transport-Level Security for Cryptographic Acceleration
  • 13.2.4 Configuring Message-level Security for Cryptographic Acceleration
  • 13.2.5 Additional Reading

Part IV Managing and Troubleshooting Oracle Web Services Manager

14 Managing Oracle Web Services Manager Domain Configuration

• 14.1 Understanding OWSM Domain Configuration
• 14.2 Navigating to the WSM Domain Configuration Page
• 14.3 Viewing the General OWSM Domain Configuration Using Fusion Middleware Control
• 14.4 Configuring Domain-Level Authentication Using Fusion Middleware Control
  • 14.4.1 Configuring SAML Trusted Issuers and DN Lists Using Fusion Middleware Control
    • 14.4.1.1 About SAML Trusted Issuers and DN Lists
    • 14.4.1.2 Adding SAML Issuers and Defining a Trusted DN List Using Fusion Middleware Control
    • 14.4.1.3 Deleting Trusted Issuers, DNs, or DN Lists Using Fusion Middleware Control
  • 14.4.2 Configuring Token Attribute Rules for Trusted Issuers Using Fusion Middleware Control
  • 14.4.3 Configuring the Lifetime for the Issued Token Using Fusion Middleware Control
  • 14.4.4 Configuring the SAML and SAML2 Login Modules Using Fusion Middleware Control
  • 14.4.5 Configuring the Kerberos Login Module
  • 14.4.6 Configuring Subject Properties Using Fusion Middleware Control
  • 14.4.7 Configuring the X509 Login Module Using Fusion Middleware Control
  • 14.4.8 Creating Custom Login Modules
• 14.5 Configuring Domain-Level Message Security Using Fusion Middleware Control
  • 14.5.1 Configuring the OWSM Keystore Using Fusion Middleware Control
    • 14.5.1.1 Configuring OWSM to Use the KSS Keystore
    • 14.5.1.2 Configuring OWSM to Use the JKS Keystore
    • 14.5.1.3 Configuring OWSM to Use HSM Keystores
    • 14.5.1.4 Configuring OWSM to Use the PKCS11 Keystore
  • 14.5.2 Configuring Security Policy Enforcement Using Fusion Middleware Control
  • 14.5.3 Configuring Identity Extension Properties Using Fusion Middleware Control
  • 14.5.4 Configuring Secure Conversation for the Domain Using Fusion Middleware Control
    • 14.5.4.1 About Secure Conversation
    • 14.5.4.2 Configuring Secure Conversation with Fusion Middleware Control
• 14.6 Configuring OWSM Policy Access Using Fusion Middleware Control
  • 14.6.1 Configuring the Policy Manager Connection Using Fusion Middleware Control
    • 14.6.1.1 About Auto-Discovery and Connecting to the Policy Manager
    • 14.6.1.2 Configuring a Connection to the Policy Manager Using Fusion Middleware Control
  • 14.6.2 Configuring SSL for the Policy Manager Connection Using Fusion Middleware Control
  • 14.6.3 Configuring High Availability and Cache Management Using Fusion Middleware Control
    • 14.6.3.1 About High Availability and Cache Management
    • 14.6.3.2 Configuring High Availability and Managing the Cache Using Fusion Middleware Control
• 14.7 Managing OWSM Domain Configuration Properties Using WLST
  • 14.7.1 Viewing OWSM Domain Configuration Using WLST
  • 14.7.2 Using the setWSMConfiguration Command to Set OWSM Domain Configuration Properties
• 14.8 Configuring Domain-Level Authentication Using WLST
  • 14.8.1 Configuring SAML Trusted Issuers, DN Lists, and Token Attribute Rules Using WLST
  • 14.8.2 Deleting a Token Issuer Trust Document Using WLST
  • 14.8.3 Configuring the Lifetime for the Issued Token Using WLST
  • 14.8.4 Configuring Subject Properties Using WLST
  • 14.8.5 Configuring the SAML and SAML2 Login Modules Using WLST
  • 14.8.6 Configuring the Kerberos Login Module Using WLST
  • 14.8.7 Configuring the X509 Login Module Using WLST
  • 14.8.8 Configuring Custom Login Modules Using WLST
• 14.9 Configuring Domain-Level Message Security Using WLST
  • 14.9.1 Configuring the OWSM Keystore Using WLST
  • 14.9.2 Configuring Security Policy Enforcement Using WLST
  • 14.9.3 Configuring Identity Extension Properties Using WLST
  • 14.9.4 Configuring Secure Conversation for the Domain Using WLST
• 14.10 Configuring Policy Access Using WLST
  • 14.10.1 Configuring the Policy Manager Connection Using WLST
  • 14.10.2 Configuring High Availability and Cache Management Using WLST

15 Managing the Oracle Web Services Manager Repository

• 15.1 About the OWSM Repository
• 15.2 Registering an OWSM Repository
• 15.3 Understanding the Different Mechanisms for Importing and Exporting Policies
• 15.4 Importing and Exporting Documents in the Repository Using WLST
  • 15.4.1 Exporting Documents from the Repository Using WLST
  • 15.4.2 Exporting Application Metadata from the Repository Using WLST
  • 15.4.3 Importing Documents into the Repository Using WLST
• 15.5 Exporting Policies from the OWSM Repository for Use in JDeveloper
• 15.6 About Patching Policies in the Repository
• 15.7 Backing Up and Restoring the OWSM Repository
• 15.8 Upgrading the OWSM Repository
• 15.9 Rebuilding the OWSM Repository

16 Diagnosing Problems with Oracle Web Services Manager

• 16.1 Diagnosing Policy Manager Problems Using the OWSM Policy Manager Page
• 16.2 Diagnosing Common Problems with Oracle Web Services Manager
  • 16.2.1 Diagnosing and Solving Common Policy Manager Connection Problems
    • 16.2.1.1 Understanding Common Policy Manager Connection Problems
    • 16.2.1.2 Solving Policy Manager Connection Problems
  • 16.2.2 Diagnosing and Solving Key Store or Credential Store Errors After an Application Invokes a Web Service
    • 16.2.2.1 Understanding Common Key or Credential Store Errors
    • 16.2.2.2 Solving Key and Credential Store Problems
  • 16.2.3 Diagnosing and Solving a Trust Certificate Error After Application Invokes a Web Service
    • 16.2.3.1 Understanding a Trust Certificate Error
    • 16.2.3.2 Solving Trust Certificate Problems
  • 16.2.4 Troubleshooting SAML Assertion Errors During Identity Propagation
    • 16.2.4.1 Understanding Common SAML Assertion Problems
    • 16.2.4.2 Troubleshooting SAML Assertion Problems
  • 16.2.5 Diagnosing and Solving Policy Access Problems After an Application Invokes a Web Service
    • 16.2.5.1 Understanding Common Policy Access Problems
    • 16.2.5.2 Solving Common Policy Access Problems
  • 16.2.6 Diagnosing and Solving Problems Accessing Users in the Credential Store
    • 16.2.6.1 Understanding Common User Access Problems
    • 16.2.6.2 Solving User Access Problems
  • 16.2.7 Diagnosing and Solving Common User Authorization Problems After an Application Invokes a Web Service
    • 16.2.7.1 Understanding Common User Authorization Problems
    • 16.2.7.2 Solving a User Authorization Problem
  • 16.2.8 Diagnosing and Solving Timestamp Errors After an Application Invokes a Web Service
    • 16.2.8.1 Understanding What Causes a Timestamp or clockSkew Error
    • 16.2.8.2 Solving Timestamp or clockSkew Errors
  • 16.2.9 Diagnosing and Solving Multiple Authentication Security Policy Errors After an Application Invokes a Web Service
    • 16.2.9.1 Understanding Common Multiple Authentication Security Policy Errors
    • 16.2.9.2 Solving Multiple Authentication Security Policy Errors
• 16.3 Diagnosing Policy Attachment Issues Using WLST
  • 16.3.1 Using the listWSMPolicySubjects Command to Identify Policy Attachment Issues
  • 16.3.2 Sample Configuration Output with Globally and Directly Attached Policies
  • 16.3.3 Sample Valid Configuration Output with Directly Attached Policies Only
• 16.4 Diagnosing Problems With a Domain Configuration Using WLST
  • 16.4.1 Using the checkWSMStatus Command to Identify Domain Configuration Issues
  • 16.4.2 Example checkWSMStatus Output Showing Status
  • 16.4.3 Example checkWSMStatus Output Showing Credential Store Failure
• 16.5 Diagnosing Common Oracle Web Services Manager Exceptions for WS-Trust Use Cases

Part V Oracle Web Services Manager Predefined Policies and Assertions Templates

17 Oracle Web Services Manager Predefined Policies

18 Oracle Web Services Manager Predefined Assertion Templates

Part VI Security and Policy Reference for Oracle Web Services

A Security and Policy Annotations for Oracle Web Services

• A.1 About Security and Policy Annotations for Web Services
• A.2 Security and Policy Annotations for Web Services

B Predefined Assertion Templates for Oracle Web Services

C Schema Reference for Predefined Assertions for Oracle Web Services

• C.1 Graphical Representation of Assertions in the WS-Policy File
• C.2 Element Descriptions in an Assertion

D Schema Reference for Web Services Policy Sets

• D.1 Graphical Representation of Web Services Policy Sets
• D.2 Element Descriptions of Web Services Policy Sets

E Oracle Web Services Manager Introspection Plug-in for Oracle Virtual Assembly Builder

• E.1 About the OWSM Introspection Plug-in for Oracle Virtual Assembly Builder
• E.2 Using the OWSM Introspection Plug-in
  • E.2.1 OWSM Introspection Plug-in Parameter
  • E.2.2 OWSM Introspection Plug-in Reference System Prerequisites
  • E.2.3 OWSM Introspection Plug-in Usage Requirements
  • E.2.4 OWSM Introspection Plug-in Resulting Artifact Type
  • E.2.5 OWSM Introspection Plug-in Wiring
  • E.2.6 OWSM Introspection Plug-in Wiring Properties
  • E.2.7 OWSM Introspection Plug-in Appliance Properties
  • E.2.8 OWSM Introspection Plug-in Supported Template Types