Click Add. Click OK. Click Delete.

Configuring Policies 11-69 ■ The user is in a particular role the default is trustedEnterpriseRole, that establishes the user as a trusted entity ■ The request is coming from within a private network. This policy can be attached to any SOAP-based endpoint. This policy contains the following assertion template: oraclebinding_authorization_ template. See oraclebinding_authorization_template on page C-89 for more information about the assertion. You must configure a WebLogic Authentication provider, as described in Configure Authentication and Identity Assertion providers in the Oracle WebLogic Server Administration Console Help. Settings You Can Change See Table C–86 . To add roles:

1. Click Add.

2. To add roles, click the check box next to each role you want to add in the Roles

Available column and click Move. To add all roles, click Move All. To remove roles, click the check box next to each role you want to remove in the Roles Selected to Add column, and click Remove. To remove all roles, click Remove All . To search for roles, enter a search string in the Role Name search box and click the go arrow. The Roles Available column is updated to include only those roles that match the search string.

3. Click OK.

To delete roles:

1. Select the role that you want to delete in the Selected Roles list.

2. Click Delete.

Properties You Can Configure None defined. How to Set Up Oracle Platform Security Services OPSS If you specify one or more of the WebLogic Server enterprise roles, the authenticated subject must already have that role. You use the WebLogic Server Administration Console to grant a role to a user or group, as described in the Oracle WebLogic Server Administration Console Help. You must configure a WebLogic Authentication provider, as described in Configure Authentication and Identity Assertion providers in the Oracle WebLogic Server Administration Console Help. How to Successfully Invoke Services Using This Policy To successfully invoke a service that has the whitelist_authorization_policy attached, you must do one of the following: 11-70 Oracle Fusion Middleware Security and Administrators Guide for Web Services ■ If the service accepts SAML sender vouches for authentication for example, a SAML token service policy is attached to the service, you must attach the corresponding SAML token client policy to the client. ■ If the service accepts usernamepassword for authentication for example, a username token service policy is attached to the service, you must attach the corresponding username token client policy to the client and make sure that the client is in a trusted role as defined in the policy. By default, the role defined in the predefined policy is trustedEnterpriseRole. You need to modify this role in the predefined policy. ■ If the service is invoked using Oracle HTTP Server, and it is configured to indicate that the request came from a private internal network see Configuring Oracle HTTP Server to Specify Request Origin on page 11-70, then a client on the internal network only has to attach the corresponding username token client policy at the client side. Configuring Oracle HTTP Server to Specify Request Origin The Constraint Pattern property setting contains a requestOrigin field that specifies whether the request originated from an internal or external network. This property is valid only when using Oracle HTTP Server and the Oracle HTTP server administrator has added a custom VIRTUAL_HOST_TYPE header to the request. To do so, the administrator must modify the httpd.conf file as follows:

1. Verify that the module mod_headers is loaded.

2. Set the VIRTUAL_HOST_TYPE header name in the RequestHeader. Valid values

are internal and external. Use the following command syntax: RequestHeader set|append|add|unset header [value [env=[]variable]] For example, to configure the virtual host for internal requests: VirtualHost :7777 RequestHeader set VIRTUAL_HOST_TYPE internal VirtualHost To configure the virtual host for external requests: VirtualHost :8888 RequestHeader set VIRTUAL_HOST_TYPE external VirtualHost In these examples, all the requests coming from outside of the private network are routed through virtual host:8888 and all the requests coming from the internal private network are routed through virtual host:7777. Note that you must also add these ports in the httpd.conf file as listen ports so that the applications are available on the ports externally. 3. Restart the Oracle HTTP Server. WS-Addressing Policies and Configuration Steps The Web Services Addressing WS-Addressing specification http:www.w3.orgTRws-addr-core provides transport-neutral mechanisms to address Web services and messages. In particular, the specification defines a number of XML elements used to identify Web service endpoints and to secure end-to-end endpoint identification in messages. Configuring Policies 11-71 This section describes the predefined WS-Addressing policies. oraclewsaddr_policy This policy causes the platform to check inbound messages for the presence of WS-Addressing headers conforming to the W3C 2005 Final WS-Addressing Policy standard. In addition, it causes the platform to include a WS-Addressing header in outbound SOAP messages. How to Set Up the Web Service Client No configuration is needed. How to Set Up the Web Service Client at Design Time Configure WS-Addressing for the Web service client as described in the Web Services Addressing 1.0 - SOAP Binding specification http:www.w3.orgTRws-addr-soap . How to Set Up Oracle Platform Security Services OPSS No configuration is needed. WS-Trust Policies This section describes the predefined WS-Trust policies. The predefined policies conform to the WS-Trust 1.3 specification. oraclests_trust_config_service_policy Use this policy to specify the STS configuration information that is used to invoke the STS for token exchange. This policy contains the following assertion template: oraclests_trust_config_service_ template. See oraclests_trust_config_service_template on page C-78 for more information about the assertion. Policy Assertion The oraclests_trust_config_service_policy policy assertion is as follows: ?xml version = 1.0 encoding = UTF-8? wsp:Policy xmlns:oralgp = http:schemas.oracle.comws200601loggingpolicy xmlns:orasp = http:schemas.oracle.comws200601securitypolicy orawsp:description = i18n:oracle.wsm.resources.policydescription.PolicyDescriptionBundle_oraclests_ trust_config_service_policy_PolyDescKey orawsp:displayName = i18n:oracle.wsm.resources.policydescription.PolicyDescriptionBundle_oraclests_ trust_config_service_policy_PolyDispNameKey wsu:Id = sts_trust_config_service_policy orawsp:attachTo = binding.server orawsp:status = enabled xmlns:orawsp = http:schemas.oracle.comws200601policy Name = oraclests_trust_config_service_policy xmlns:wsp = http:schemas.xmlsoap.orgws200409policy xmlns:wsu = http:docs.oasis-open.orgwss200401oasis-200401-wss-wssecurity-utility-1.0.xs