In the Navigator pane, expand WebLogic Domain. From the WebLogic Domain menu select Security Audit Policy.

14-16 Oracle Fusion Middleware Security and Administrators Guide for Web Services The Platform Policy Configuration page appears, as shown in Figure 14–11 . Figure 14–11 Platform Policy Configuration Page

4. Select the tab corresponding to the component for which you want to define

properties: ■ Configuring a Web Service on a Remote Policy Manager and Tuning the Policy Cache on page 14-16 ■ Configuring Web Service Policy Retrieval on page 14-18 ■ Tuning Web Service Security Policy Enforcement on page 14-20 ■ Defining Identity Extension Properties on page 14-21 ■ Defining a Trusted Distinguished Name List for SAML Signing Certificates on page 14-21 Configuring a Web Service on a Remote Policy Manager and Tuning the Policy Cache By default, the Oracle Web Services Manager WSM supports an auto-discovery feature that it uses to locate and connect to an Oracle WSM Policy Manager within the same WebLogic domain. In certain scenarios auto-discovery may not work as expected. Note: When the Oracle WSM Policy Manager is deployed on a server that is configured to use SSL, the auto-discovery mechanism will only attempt to connect to Policy Managers on other SSL-configured servers. To ensure that the secure connection is maintained, Policy Managers deployed on servers that are not configured for SSL are ignored. Advanced Administration 14-17 You may want to disable the auto-discovery feature, for example, in the following scenarios: ■ Your domain is split into two or more networks, especially if a firewall exists between them. ■ You want to access an Oracle WSM Policy Manager that is running in a different domain without additional WebLogic security configuration. ■ You are running on a non-WebLogic application server that does not support the auto-discovery feature, such as WebSphere Application Server and JBOSS. ■ You prefer to override the default settings. For Oracle Infrastructure Web service policies, on the Platform Policy Configuration page: ■ The Policy Accessor tab enables you to explicitly set a remote JNDI provider URL and corresponding csf-key credentials to access a Policy Manager in a remote domain or on another platform. ■ The Policy Cache tab allows you to tune the behavior of the policy cache delay for Web service endpoints, which can help to avoid network calls and increase performance when fetching policies from a remote Oracle WSM Policy Manager. To configure a Web service on a remote Oracle WSM Policy Manager and tune the policy cache: 1. To access an Oracle WSM Policy Manager that is in a different domain—for example, if the Oracle WSM Policy Manager is in a domain that is different from the Web service client—enable cross-domain security between WebLogic Server domains, as described in Enabling Cross Domain Security Between WebLogic Server Domains in Securing Oracle WebLogic Server. Cross domain security establishes trust between two WebLogic domain pairs by using a credential mapper to configure communication between these WebLogic domains. 2. Access the Platform Policy Configuration page, as described in Configuring Platform Policy Properties on page 14-15.

3. Select the Policy Accessor tab.

4. Click Add to define a remote JNDI provider.

In the Add Property window, specify the following values: a. In the Name field, enter the JNDI provider URL property as java.naming.provider.url. b. In the Value field, enter the JNDI provider’s URL for the remote domain. This specifies the location of a running Policy Manager in a different domain in order to access that Policy Manager. If this property is not specified, the auto-discovery feature attempts to look up the Policy Manager in the same domain.

c. Click OK.

5. Click Add to define a corresponding csf-key credential property. In the Add

Property window, specify the following values: a. In the Name field, enter the name of the JNDI provider’s csf-key credential property as jndi.lookup.csf.key. b. In the Value field, enter the csf-key credentials.