Encrypting SOAP messages with EncryptedKey

Oracle Web Services Security 10-17 with references to each of these encrypted data sections, and place the ReferenceList in the wsse:Security header.

10.2.6.1 Encrypting SOAP messages with EncryptedKey

First decide on a key to use to encrypt this random session key, then create an STR with the information that the receiver will use to locate this decryption key: Key keyEncKey = ... ; WSSecurityTokenReference str = ... create a WSSEncryptionParams with this information: Choose a data encryption algorithm - say AES 128 String dataEncAlg = XMLURI.alg_aes128_CBC; Either generate a random session key yourself, or set this to null to indicate that OSDT should generate it SecretKey dataEncKey = null; Depending on the KeyEncryptionKey that you have chosen choose either an RSA key wrap or a symmetric key wrap String keyEncAlg = XMLURI.alg_rsaOAEP_MGF1; Now put all this information into a WSSEncryptionParams WSSEncryptionParams eParam = new WSSEncryptionParams dataEncAlg, dataEncKey, keyEncAlg, keyEncKey, str; regular DOM element, SOAP headers, the SOAP Body or AttachmentParts: Element elem1 = ... one object to be encrypted Element elem2 = … another object to be encrypted ArrayList objectList[] = new ArrayList; objectList.addelem1; objectList.addelem2; Create two more arrays to indicate whether each object is to be encrypted content only, and what IDs will be assigned to the resulting EncryptedData objects: both these elements are not content only boolean[] contentOnlys = { false, false }; After encryption the EncryptedData elements will get these ids String encDataIds[] = { id1, id2 }; Finally, call the encryptWithEncKey method: WSSecurity ws = ... XEEncryptedKey encKey = ws.encryptWithEncKeyobjectList, contentOnlys, Note: While encrypting regular DOM elements is standard practice, you can also encrypt SOAP headers, the SOAP body, and attachments. Special considerations apply for encrypting these objects as explained later. Note: SOAP bodies are always encrypted content only, regardless of what you pass in this flag. For attachments, not content only means content plus mime headers. 10-18 Oracle Fusion Middleware Reference for Oracle Security Developer Tools encDataIds, eParam;

10.2.6.2 Encrypting SOAP messages without EncryptedKey