Using Fusion Middleware Control, click WebLogic Server and then Web Services.

8-10 Oracle Fusion Middleware Security and Administrators Guide for Web Services Figure 8–7 Attachment Summary Page

9. Click Back to make any changes, or click Attach to complete the bulk attachment.

10. For ADF and WebCenter applications, restart the Web service application. You do not need to restart a SOA composite or a WebLogic Java EE Web service application. Validating Policy Subjects The type and number of assertions within a policy may be valid and, therefore, a policy may be internally consistent and valid. However, when more than one policy is attached to a policy subject, the combination of policies must also be valid. Specifically, the following must be true: ■ Only one MTOM policy can be attached to a policy subject. ■ Only one Reliable Messaging policy can be attached to a policy subject. ■ Only one WS-Addressing policy can be attached to a policy subject. ■ Only one Security policy with subtype authentication can be attached to a subject. ■ Only one Security policy with subtype sts-config can be attached to a subject. ■ Only one security policy with subtype authorization can be attached to a subject. Note: You need to wait approximately 30 seconds or the equivalent of the configured Graceful Shutdown Timeout time between stopping and restarting the application. During this time, the server is allowing all global transactions to complete before shutting down the application. If you do not wait the configured Graceful Shutdown Timeout time, then the application will not be restarted appropriately and you will not be able to access it. To avoid waiting the graceful shutdown timeout period, you can restart the application twice. Note: When you view a policy, only the major category, such as security, is displayed. To see the subtype such as authorization, see the Assertion Details section of the assertion template on which the policy is based. Note: There may be either one or two security policies attached to a policy subject. A security policy can contain an assertion that belongs to the authentication or message protection subtype categories, or an assertion that belongs to both subtype categories. The second security policy contains an assertion that belongs to the authorization subtype.