On the Settings for Realm Name page select Users and Groups and then Users.

10-62 Oracle Fusion Middleware Security and Administrators Guide for Web Services

2. Using Fusion Middleware Control, click WebLogic Domain, then Security, and

then Security Provider Configuration. Click the plus sign + to expand the Keystore control near the bottom of the page, then click Configure. The Web Services Manager Keystore Configuration page is displayed, as shown in Figure 10–3 .

3. If it is not already enabled, click the Configure Keystore Management check box.

4. Enter the path and name for the keystore that you created. By default, the keystore name is default-keystore.jks, as used in this use case. The keystore type must be JKS. 5. Enter the password for the keystore and confirm it. 6. Enter the alias and password for the signature and encryption keys. In this use case, orakey is the alias for both the signature and encryption keys. Confirm the passwords.

7. Click OK to submit the changes.

Note that all fields on this page require a restart of Fusion Middleware Control to take effect. Store the Password for the Decryption Key in the Credential Store You must store the password for the decryption key in the credential store, as described in Adding Keys and User Credentials to the Credential Store on page 10-17. Use keystore.enc.csf.key as the key name. Attach the Policy to Your Web Service Attach wss11_saml_token_with_message_protection_service_policy to your Web service as described in Attaching a Policy to a Single Subject on page 8-3. Configure the policy assertion for message signing and message encryption. The default is to sign and encrypt the entire body for the request the response. You have the option to not do this and to instead specify the specific body elements that you want to sign and encrypt. You can also additionally specify header elements that you want to sign and encrypt. Whatever you set here mush match the client policy settings. Attach the Policy to Your Web Service Client Attach wss11_saml_token_with_message_protection_client_policy to your Web service client, as described in { Attaching Policies to Web Service Clients on page 8-11. Configure the policy assertion for message signing, message encryption, or both. Note: You can override keystore.sig.csf.key and keystore.enc.csf.key, as described in Attaching Web Service Policies Permitting Overrides on page 8-16. If you do override these values, the keys for the new values must be in the keystore. That is, overriding the values does not free you from the requirement of configuring these keys in the keystores.