WS-SecurityPolicy and templates
Web Services Security (WS-Security) in Liberty is configured by using the WS-SecurityPolicy in either Web Services Description Language (WSDL) or policy attachment file of a web service application. To protect your web service application with WS-Security, your JAX-WS application must contain a WSDL or policy attachment file that has an embedded WS-Security Policy. WS-SecurityPolicy templates contain several commonly used WS-Security policy samples. These templates can be modified to satisfy many different usage scenarios.
The following list of commonly used WS-SecurityPolicy templates
are provided, and can be modified to satisfy many different usage
scenarios:
- Scenario 1: UsernameToken with password digest (HashPassword) and timestamp over SSL
- Scenario 2: UsernameToken with password text, nonce, and created timestamp over SSL
- Scenario 3: UsernameToken as an EndorsingToken and an X509Token symmetric for message protection
- Scenario 4: UsernameToken with X509Token asymmetric message protection (mutual authentication)
- Scenario 5: Client X509Token as an EndorsingToken and a server X509Token symmetric for message protection
- Scenario 6: UsernameToken authentication and an X509Token symmetric for message protection
- Scenario 7: UsernameToken with password text, nonce, and created timestamp over HTTP
- Scenario 8: SamlToken as SupportingToken over SSL
- Scenario 9: SAMLToken with X509Token asymmetric for message signature
- Scenario 10: SamlToken with X509Token asymmetric message protection (mutual authentication)
- Scenario 11: SAMLToken with X509Token symmetric for message protection