Enabling Security for AIA Services

Working with Security 26-3 ■ Domain - all services in a domain ■ Instance - all services in a WLS server instance ■ Based on SOA Composite name - all services in a composite For a list of the delivered policies, see Predefined Policies in the Oracle Fusion Middleware Security and Administrators Guide for Web Services.

26.2 Implementing Security

This section includes the following topics: ■ Section 26.2.1, Enabling Security for AIA Services ■ Section 26.2.2, Invoking Secured Application Services ■ Section 26.2.3, Overriding Policies Using a Deployment Plan ■ Section 26.2.4, Testing Secured Services using CAVS.

26.2.1 Enabling Security for AIA Services

To enable security in AIA services: 1. Determine what type of security is needed. AIA recommends using WS-security for authentication, encryption and integrity. 2. Check if the global security policy is sufficient for the web service. 3. Find the WS-policy with the appropriate combination of features. For example, if you need encryption and integrity, then you must find the policy which does both encryption and integrity. 4. Attach policy to service to enable security for a service. For more information about how to attach policies, see Attaching Policies to Web Services in the Oracle Fusion Middleware Security and Administrators Guide for Web Services. 5. Configure policies. You may need to perform additional configurations for each policy. For more information about how to configure each policy, see Configuring Policies in the Oracle Fusion Middleware Security and Administrators Guide for Web Services. 6. Diagnose problems. For more information about how to diagnose problems, see Diagnosing Problems in the Oracle Fusion Middleware Security and Administrators Guide for Web Services. 26.2.1.1 Should I Secure All AIA Services? Security can have a negative impact in terms of performance so it must be carefully used. AIA mandates securing services whose interaction with other services cross organizational boundaries. Any AIA service that is being called from clients outside corporate network must be secured. For A2A integration where all the services are within the same organization and inside the firewall, you may decide it is not necessary to secure all the services. 26-4 Developers Guide for Oracle Application Integration Architecture Foundation Pack All AIA services out of the box are secured, so if you think security is not needed for your deployment, you must disable.

26.2.2 Invoking Secured Application Services