In the Assertion List section, click Add OR Group. Click OK.

Managing Web Service Policies 7-15 Importing an Assertion Template Follow the steps in this section to view an assertion template.

1. Navigate to the Web Services Assertions Templates page, as described in

Navigating to the Web Services Assertion Templates Page on page 7-8.

2. Click Import From File.

You are prompted to provide the assertion template file.

3. Click Browse to navigate to the directory where the assertion template file is

located and select the assertion template to be imported.

4. Click OK.

The assertion template appears in the Assertion Templates table. Deleting an Assertion Template Follow the steps in this section to delete an assertion template. 1. Navigate to the Web Services Assertions Templates page, as described in Navigating to the Web Services Assertion Templates Page on page 7-8. 2. Select the assertion template from the Assertion Templates table that you want to delete.

3. Click Delete.

You are prompted to confirm that you want to delete the assertion template.

4. Click OK.

Validating Web Services Policies There are restrictions on the type and number of policy assertions that are permitted in a Web service policy. When you validate a policy, Enterprise Manager checks to see if the policy is consistent with these restrictions. A policy can contain only assertions that belong to a single category. Therefore, you cannot combine a Security assertion with an MTOM assertion in the same policy. The policy type is determined by the category of the assertion. Therefore, a policy containing a security assertion is a security policy, a policy containing a management assertion is a management policy, and so on. Security assertions are further categorized into subcategories: authentication, logging, message protection msg-protection, and authorization. There are restrictions on the number and type of assertions you can have in a policy. The restrictions are as follows: ■ MTOM and Reliable Messaging policies can contain only one assertion. ■ A security policy can contain multiple security assertions; however, there can be only one assertion from the following subcategories in a policy: encryption, signing, and authentication. ■ Some assertions contain both authentication and message protection. For example, if you view the oraclewss11_username_token_with_message_protection_service_policy, you will see that the second assertion falls into two categories: securityauthentication and securitymsg-protection. See Figure 7–8 . 7-16 Oracle Fusion Middleware Security and Administrators Guide for Web Services Figure 7–8 Assertion Belonging to Two Categories ■ A security policy can contain any number of security_log_template assertions. For example, if you view any of the predefined security policies, you will see two logging assertions included. Oracle recommends that you create one policy for authentication and message protection, and a second policy for authorization. If you create a policy that contains both an authentication and an authorization assertion, then the authentication assertion must precede the authorization assertion. When you validate your policies, the validation process checks to see that your policies meet these requirements. If the validation fails during policy creation, the policy is created but is marked as disabled. Validating a Policy Policies can be validated from the Create Policy and Edit Policy pages. To validate a policy: 1. From the Create Policy or Edit Policy page, make any changes to your policy.

2. Click Validate.

If successful, the Validation successful message appears. If not successful, the resulting error message describes the problem. Editing Web Service Policies You can make changes to the policies you create or to the predefined policies that come with the product. However, Oracle recommends that you do not change the predefined policies so that you will always have a known set of valid policies to work with. The changes take effect at the next polling interval for policy changes. If you are using a database-based metadata repository, each time you save a change to your policy, a new version is created, and the older versions are retained. To edit Web service policies: 1. Navigate to the Web Services Policy page, as described in Navigating to the Web Services Policies Page in Fusion Middleware Control on page 7-2.

2. From the Web Services Policies page, select a policy from the Policies table and

click Edit. 3. On the Edit Policy page, make the changes to the policy.

4. Click Save.