Redeploying Applications Oracle Fusion Middleware Online Documentation Library

6 Securing SOA Composite Applications 6-1 6 Securing SOA Composite Applications This chapter describes security procedures unique to SOA composite applications. This chapter includes the following topics: ■ Section 6.1, Introduction to Securing SOA Composite Applications ■ Section 6.2, Configuring Oracle HTTP Server with Oracle BPM Worklist ■ Section 6.3, Setting up SAML Message-Protected Policy Configuration for the SOA Infrastructure ■ Section 6.4, Automatically Authenticating Users ■ Section 6.5, Listing the Authentication Provider ■ Section 6.6, Configuring SSL ■ Section 6.7, Configuring Security for Human Workflow WSDL Files

6.1 Introduction to Securing SOA Composite Applications

This chapter describes security procedures unique to SOA composite applications. Most SOA composite application security procedures do not require SOA-unique steps and can be performed by following the documentation listed in Table 6–1 . Note: See the following sections for information on attaching and detaching policies: ■ Section 8.8, Managing SOA Composite Application Policies ■ Section 13.2, Managing BPEL Process Service Component Policies ■ Section 16.3, Managing Oracle Mediator Policies ■ Section 21.1, Managing Human Task Service Component Policies ■ Section 35.1, Managing Binding Component Policies Table 6–1 Security Documentation For Information On... See The Following Guide... Securing Oracle Fusion Middleware, including Oracle Single Sign-On OSSO configuration Oracle Fusion Middleware Application Security Guide 6-2 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

6.2 Configuring Oracle HTTP Server with Oracle BPM Worklist

You must add the integration location in the mod_wl_ohs.conf file of Oracle HTTP Server for Oracle BPM Worklist to work through Oracle HTTP Server. Location integration SetHandler weblogic-handler PathTrim weblogic ErrorPage http:WEBLOGIC_HOME:WEBLOGIC_PORT Location

6.3 Setting up SAML Message-Protected Policy Configuration for the SOA Infrastructure

This section describes how to set up and validate Security Assertion Markup Language SAML message-protected policy configuration for the SOA Infrastructure with the WebLogic Scripting Tool WLST. The example in this section describes task query service configuration. However, these instructions are relevant to all human workflow services that support SAML-token ports: ■ AG query service ■ AG metadata service ■ AG admin service ■ Task query service ■ Task service ■ Task metadata service ■ Runtime config service ■ Task evidence service ■ User metadata service If you want to change the policy for another service, you must apply the same WLST commands to that services SAML-token port. Securing and administering web services Oracle Fusion Middleware Security and Administrators Guide for Web Services Understanding Oracle WebLogic Server security Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server Securing an Oracle WebLogic Server production environment Oracle Fusion Middleware Securing a Production Environment for Oracle WebLogic Server Securing Oracle WebLogic Server Oracle Fusion Middleware Securing Oracle WebLogic Server Developing new security providers for use with Oracle WebLogic Server Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server Securing web services for Oracle WebLogic Server Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server Programming security for Oracle WebLogic Server Oracle Fusion Middleware Programming Security for Oracle WebLogic Server Table 6–1 Cont. Security Documentation For Information On... See The Following Guide...