A Note About Third-party Software

Upgrading Oracle Web Services Manager Policies and OC4J Security Enviroments 13-5

13.1.3 Upgrading Oracle WSM Custom Policies

In Oracle WSM 10g, you create, develop, and deploy custom policy steps using the procedures described in the Oracle Web Services Manager Extensibility Guide in the Oracle Application Server 10g Release 3 10.1.3.1.0 documentation library at: http:www.oracle.comtechnologydocumentation In Oracle WSM 11g, you create, develop, and deploy custom policy assertions. You will need to redefine your custom policy steps as custom policy assertions using the procedures described in Creating Custom Assertions in Security and Administrator’s Guide for Oracle Web Services.

13.2 Upgrading Oracle Containers for J2EE OC4J Security Environments

In OC4J 10g, you configure your security environment by modifying the contents of the XML-based deployment descriptor files. For complete details about securing OC4J environments, see Oracle Application Server Web Services Security Guide at: http:www.oracle.comtechnologydocumentation In Oracle WSM 11g, you attach policies to Web service endpoints. Each policy consists of one or more assertions, defined at the domain-level, that define the security requirements. A set of predefined policies and assertions are provided out-of-the-box. For more details about the predefined policies, see “Predefined Policy Reference” in Security and Administrator’s Guide for Oracle Web Services. The following sections describe the most common OC4J upgrade scenarios based on the following security requirements: authentication, message protection, transport, Username token over SSL 1. Configure the application server for SSL. 2. Attach policy steps as follows: Client : Insert WSBASIC Credentials. Web service : Extract Credentials and File Authenticate. 1. Configure the application server for SSL. 2. Attach policies as follows: Client : oraclewss_username_token_ over_ssl_client_policy. Web service : oraclewss_username_ token_over_ssl_client_service_policy. 3. Disable the Include Timestamp configuration setting. ID propagation with SAML token sender vouches over SSL WS-Security 1.0 1. Configure the application server for SSL. 2. Attach policy steps as follows: Client : SAML—Insert WSS 1.0 Sender-Vouches Token. Web service : SAML—Verify WSS 1.0 Token. 1. Configure the application server for SSL. 2. Attach policies as follows: Client : oraclewss_saml_token_over_ ssl_client_policy. Web service : oraclewss_saml_token_ over_ssl_client_service_policy. 3. Disable the Include Timestamp configuration setting. Log information Attach the following policy step to the client or Web service: Log Attach the following policy to the client or Web service: oraclelog_policy Table 13–1 Cont. Upgrading Oracle WSM 10g Predefined Policies