This appendix includes the following sections:
Oracle Fusion Middleware installs a portability layer on top of WebLogic Server that integrates OWSM security policies into the WebLogic Server environment. This portability layer provides OWSM security policies that you can use to protect WebLogic JAX-WS web services and clients.
You can use the OWSM security policies as an alternative to the WebLogic WS-Security policies for enforcing security for web services. You can also create custom OWSM security policies and use them with WebLogic web services.
The following sections provide more information about the OWSM policies that are available and when you should use them.
Only a subset of OWSM policies are supported for Java EE web services. See Which OWSM Policies Are Supported for Java EE Web Services? in Securing Web Services and Managing Policies with Oracle Web Services Manager.
You might want to use OWSM security policies to protect JAX-WS web services if you already use SOA, ADF, or Web Center applications elsewhere in your environment and you want a consistent security environment.
You should secure a WebLogic JAX-WS web service with OWSM security policies to have consistent and interoperable web service security when these web services are used in conjunction with Oracle Fusion Middleware applications.
That is, you should secure WebLogic JAX-WS web services with OWSM security policies for use with applications that interact with Oracle Fusion Middleware applications, not with standalone WebLogic Server web service applications.
Consider the following scenarios:
If you develop WebLogic JAX-WS web services or clients that interact with SOA Composite Services, ADF Components, or WebCenter Services, then you should use the OWSM security policies.
If you develop only WebLogic native Java JAX-WS web services, then you should use WebLogic WS-Security policies.
Table A-1 lists policy selection guidelines for using the OWSM policies. In this table:
weblogic.jws.Policy
annotation applies to WebLogic web service policies
weblogic.wsee.jws.jaxws.owsm.SecurityPolicy
annotation applies to OWSM policies
Table A-1 Policy Selection Guidelines
@Policy | @SecurityPolicy | Feature to be Implemented | Which Policies to Use |
---|---|---|---|
Yes |
No |
WSS 1.0 with multiple must support key reference methods |
Wssp1.2-2007-Wss1.0-UsernameToken-Plain-X509-Basic256.xml Wssp1.2-2007-Saml1.1-SenderVouches-Wss1.0.xml |
Yes |
No |
Username Token digest authentication |
Wssp1.2-2007-Https-UsernameToken-Digest.xml Wssp1.2-2007-Wss1.0-UsernameToken-Digest-X509-Basic256.xml Wssp1.2-2007-Wss1.1-UsernameToken-Digest-X509-Basic256.xml |
No |
Yes |
Kerberos Authentication |
oracle/wss11_kerberos_token_client_policy oracle/wss11_kerberos_token_service_policy oracle/wss11_kerberos_token_with_message_protection_client_policy oracle/wss11_kerberos_token_with_message_protection_service_policy oracle/wss11_kerberos_token_with_message_protection_basic128_client_policy oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy |
Yes |
No |
WSS 1.1 Derived Key |
Wssp1.2-2007-Wss1.1-DK-X509-SignedEndorsing.xml Wssp1.2-2007-Wss1.1-UsernameToken-Plain-DK.xml |
Yes |
No |
All SAML 2.0 scenarios |
oracle/http_saml20_token_bearer_client_policy oracle/http_saml20_token_bearer_service_policy oracle/http_saml20_token_bearer_over_ssl_client_policy oracle/http_saml20_token_bearer_over_ssl_service_policy oracle/wss_saml20_token_bearer_over_ssl_client_policy oracle/wss_saml20_token_bearer_over_ssl_service_policy oracle/wss_saml20_token_over_ssl_client_policy oracle/wss_saml20_token_over_ssl_service_policy oracle/wss10_saml20_token_client_policy oracle/wss10_saml20_token_service_policy oracle/wss10_saml20_token_with_message_protection_client_policy oracle/wss10_saml20_token_with_message_protection_service_policy oracle/wss11_saml20_token_with_message_protection_client_policy oracle/wss11_saml20_token_with_message_protection_service_policy |
Yes |
No |
Encrypt before signing |
Policy assertion <sp:EncryptBeforeSigning/> in both WSS10 or WSS11, Symmetric Binding or Asymmetric Binding, such as the following: <wsp:Policy xmlns:wsp="..." > <sp:SymmetricBinding> <wsp:Policy> .. . <sp:EncryptBeforeSigning/> . . . </wsp:Policy> </sp:SymmetricBinding> . . . </wsp:Policy> |
Yes |
No |
Multiple policy alternatives |
Policy assertion such as the following: <wsp:Policy xmlns:wsp="..." > <wsp:ExactlyOne> <wsp:All> ... ALternative 1 ... </wsp:All> <wsp:All> ... ALternative 2 ... </wsp:All> </wsp:ExactlyOne> </wsp:Policy> |
For non-security features, such as WS-RM and MTOM, use WebLogic web service policies.
For specific policy instances, you can attach an OWSM policy to the web service client or service, and an WebLogic web service policy to the WebLogic Java EE web service or client, and they will interoperate. The specific interoperability scenarios are described in Interoperability with Oracle WebLogic Server 11g Web Service Security Environments in Interoperability Solutions Guide for Oracle Web Services Manager.
For these interoperability scenarios, you can use either OWSM or WebLogic web service policies, depending on the following considerations:
If additional non-standard policy assertions in the OWSM policy are needed for configuration, then use the @SecurityPolicy
annotation.
Examples of these non-standard assertions might be as follows:
<oralgp:Logging xmlns:oralgp="http://schemas.oracle.com/ws/2006/01/loggingpolicy" . . . orawsp:category="security/logging"> . . . </oralgp:Logging>
or
<orawsp:Config xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" . . .> <orawsp:PropertySet . . .> . . . </orawsp:PropertySet> </orawsp:Config>
If the application will be used to interoperate with existing WebLogic web services or Microsoft Windows Communication Foundation (WCF)/.NET Framework services, and the previously-mentioned non-standard policy assertions are not required, then use the @Policy
annotation with WebLogic web service policies.
A subset of WebLogic web service policies interoperate with OWSM policies.
That is, for specific policy instances, you can attach an OWSM policy to the web service client or service, and a WebLogic web service policy to the WebLogic Java EE web service or client, and they will interoperate.
The specific interoperability scenarios are described in Interoperability with Oracle WebLogic Server 11g Web Service Security Environments in Interoperability Solutions Guide for Oracle Web Services Manager.
WebLogic Server includes the policies shown in Table A-2 for interoperability with OWSM.
Table A-2 Interoperability WebLogic WS-Security Policies
Policy Name | Description |
---|---|
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of It endorses with the sender's X509 certificate, and message signature is protected. It requires the use of the Basic128 algorithm suite (AES128 for encryption) instead of the Basic256 algorithm suite (AES256). |
|
This policy provides similar security features to that of |
|
Two-way SSL that uses SAML 1.1 token with sender vouches confirmation method for authentication. It requires client certificates, and the recipient checks for the initiator's public certificate. |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
|
This policy provides similar security features to that of |
The OWSM WS-Security policy attachment model is similar to that of the WebLogic web service policies. You can attach OWSM policies to WebLogic JAX-WS web services using one of the following methods:
Policy annotations at design time, as described in Attaching Policies to Java EE Web Services and Clients Using Annotations in Securing Web Services and Managing Policies with Oracle Web Services Manager.
WebLogic Server Administration Console at runtime, as described in Attaching OWSM Security Policies Using the Administration Console.
Fusion Middleware Control or WLST at runtime, as described in the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager:
You can attach only one type of security policy to a web service, either WebLogic web service security policies or OWSM policies. You cannot attach both WebLogic web service policies and OWSM policies to the same web service, through either the annotation mechanism, the WebLogic Server Administration Console, Fusion Middleware Control, or a combination of the three.
You can attach an OWSM security policy only to a JAX-WS web service; you cannot attach this type of policy to a JAX-RPC web service.
The following sections describe how to use the WebLogic Server Administration Console to attach OWSM security policies to JAX-WS web services:
Attaching OWSM policies to a deployed web service at runtime using the WebLogic Server Administration Console is similar to attaching WebLogic web service policies, as described in Configuring Message-Level Security.
You can choose to not use @SecurityPolicy
or @SecurityPolicies
annotations in your JWS file and attach policies only at runtime using the WebLogic Server Administration Console. Or, you can attach a subset of policies using the annotations and then attach additional policies at runtime. If you attach a policy file using the JWS annotations, you can remove the policy at runtime using the WebLogic Server Administration Console.
At runtime, the WebLogic Server Administration Console allows you to attach as many policies as you want with a web service and its operations, even if the assertions in the policies contradict each other or contradict the assertions in policies attached at design time using the JWS annotations. It is up to you to ensure that multiple attached policies work together. If any contradictions exist, WebLogic Server returns a runtime error when a client application invokes the web service operation.
There is no policy validation. The following specific combinations are valid:
One management policy can be attached to a policy subject.
One security policy with subtype authentication can be attached to a subject.
One security policy with subtype message protection can be attached to a subject.
One security policy with subtype authorization can be attached to a subject.
Note:
There may be either one or two security policies attached to a policy subject. A security policy can contain an assertion that belongs to the authentication or message protection subtype categories, or an assertion that belongs to both subtype categories. The second security policy contains an assertion that belongs to the authorization subtype.
If an authentication policy and an authorization policy are both attached to a policy subject, the authentication policy must precede the authorization policy.
Perform the following steps to attach an OWSM security policy via the WebLogic Server Administration Console:
WebLogic Server caches data for a deployed resource, and there is one cache per session. You may need to clear this cache in order to see a policy attached to a web service.
In typical use, the WebLogic Server Administration Console caches the last deployed resource with which a user interacts. Any changes made to a cached deployment by an external tool or API (such as Fusion Middleware Control,WLST, or the JMX API) will not be reflected in the cached version.
Consider the following scenario.
To see the policy attachment, you need clear the cache. You can do this in two ways:
Navigate to another deployment (thus caching it) and then revisit the original page.
Log out of the WebLogic Server Administration Console and back in again.
The following procedure describes the high-level steps to attach an OWSM security policy to a web service client application at design time. See Developing Basic JAX-WS Web Service Clients in Developing JAX-WS Web Services for Oracle WebLogic Server.
Note:
It is assumed that you have created the client application that invokes a deployed web service, and that you want to update it by attaching a client-side policy file. It is also assumed that you have set up an Ant-based development environment and that you have a working build.xml
file that includes a target for running the clientgen
Ant task.
When you run the client application, it loads the policy files that the web service client runtime uses to enable security for the SOAP request message.
No behavior policies provide the ability to effectively disable an OWSM policy attached globally in a policy set. Table A-3 lists the no behavior policies that are supported by Java EE web services and clients to disable a globally attached OWSM security policy.
Table A-3 No Behavior Policies Supported by Java EE Web Services and Clients
No Behavior Policy | Description |
---|---|
OWSM no behavior policies |
OWSM no behavior policies that are valid for Java EE web services and clients include:
See No Behavior Policies in Securing Web Services and Managing Policies with Oracle Web Services Manager. Attach an OWSM no behavior policy directly to the Java EE web service or client using the procedures defined in the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager: |
WebLogic no behavior policy |
The WebLogic no behavior policy, <?xml version="1.0"?> <wsp15:Policy xmlns:wsp15="http://www.w3.org/ns/ws-policy"> <wsp15:All> <wsp15:Policy/> </wsp15:All> </wsp15:Policy> Attach the Web service: Web service client: |
See the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager:
You must configure your web service Securing Web Services in Securing Web Services and Managing Policies with Oracle Web Services Manager.
You can override the default configuration properties of an OWSM security policy programmatically at design time using one of the following methods:
JAX-WS RequestContext
, as described in Overriding Client Policy Configuration Properties at Design Time in Securing Web Services and Managing Policies with Oracle Web Services Manager.
@Property
annotation when attaching an OWSM security policy using the @SecurityPolicy
annotation, as described in Attaching Policies to Java EE Web Services and Clients Using Annotations in Securing Web Services and Managing Policies with Oracle Web Services Manager.
You can use either the WebLogic Server Administration Console or Fusion Middleware Control to monitor and test a WebLogic JAX-WS web service that is protected with an OWSM security policy.
To monitor and test the web service from the WebLogic Server Administration Console, perform the following steps:
To monitor and test the web service using the Fusion Middleware Control, see Monitoring and Auditing Web Services and Testing Web Services in Administering Web Services.