Overriding Policies Using a Deployment Plan Testing Secured Services using CAVS

26-4 Developers Guide for Oracle Application Integration Architecture Foundation Pack All AIA services out of the box are secured, so if you think security is not needed for your deployment, you must disable.

26.2.2 Invoking Secured Application Services

To invoke a secured web service: 1. Determine what type of security is needed. AIA recommends using WS-security for authentication, encryption and integrity.

2. Check if the global security policy is sufficient for the web service.

3. Find the WS-policy with the appropriate combination of features.

For example, if you need encryption and integrity, then you must find the policy which does both encryption and integrity.

4. Attach policy to service to enable security for a service.

For more information about how to attach policies, see Attaching Policies to Web Services in the Oracle Fusion Middleware Security and Administrators Guide for Web Services.

5. Configure policies.

You may need to perform additional configurations for each policy. In the case of WS-Security client side basic authentication policy, you must do the following:

1. Configure credential store.

2. Add the UserID and password associating with a key into the store.

3. Use the key in the policy.

For more information about how to configure each policy, see Configuring Policies in the Oracle Fusion Middleware Security and Administrators Guide for Web Services.

6. Diagnose problems.

For more information about how to diagnose problems, see Diagnosing Problems in the Oracle Fusion Middleware Security and Administrators Guide for Web Services.

26.2.3 Overriding Policies Using a Deployment Plan

AIA Foundation Pack provides infrastructure to override the global policies in a declarative way. To override the policy, service developers must: 1. Create service configuration file as described in section Section 26.6.3, AIA Security Configuration Properties. 2. Place it in the project folder.

26.2.4 Testing Secured Services using CAVS

To test secured services using CAVS, the element cavs:CAVSRequestInput_1 should have the element shown in Example 26–1 under the soap:Envelope. Working with Security 26-5 Example 26–1 soap:Envelope Content soapenv:Header wsse:Security xmlns=http:docs.oasis-open.orgwss200401oasis-200401-wss-wssecurity- secext-1.0.xsd xmlns:wsse=http:docs.oasis-open.orgwss200401oasis-200401-wss-wssecurity- secext-1.0.xsd wsse:UsernameToken Username[user name]Username Password[pwd]Password wsse:UsernameToken wsse:Security soapenv:Header If you are using a default user in the Identity store, then [user name] = weblogic and [pwd] = weblogic1.

26.3 Security for Applications

This section contains the following topics: ■ Section 26.3.1, Enabling Security in Application Services ■ Section 26.3.2, Invoking Secured AIA Services

26.3.1 Enabling Security in Application Services

You can use the built-in capabilities of participating applications to enable security for services. If you need to choose a product for enabling security, check if Oracle WSM has agent support for the application, and if so, use Oracle WSM. If the applications can enable any kind of security, use Web service security for authentication, encryption, and integrity. Otherwise, you can use SSL to secure the connection.

26.3.2 Invoking Secured AIA Services

When interacting with an AIA service that is enabled for WS-security, you must add a security header in the SOAP header with all the information needed for security functions on AIA service. Based on the security of the AIA service, you must add information for any combination of authentication, encryption and integrity. Example 26–2 is a sample of a security header for authentication. Example 26–2 Security Header for Authentication wsse:Security env:mustUnderstand=1 wsse:UsernameToken wsu:Id=UsernameToken-dXtD14011QZUTlfIaSrMhw22 wsse:Usernameweblogicwsse:Username wsse:Password Type=http:docs.oasis-open.orgwss200401oasis-200401-wss-username-token- profile-1.0PasswordTextweblogic1wsse:Password wsse:UsernameToken wsse:Security If the AIA service requires SSL, then the application should configure SSL for both one way and two-way SSL.