Uisng Message Level Security for JAX WS Web services deployed unde Weblogic 10

[Ravi Kiran Va]

Hi ,

I want to provide security to JAX Ws Webservice , so i am planning to use Message Level Security .
We are using Weblogic 10 as our server .

So as per the Weblogic docs , it says that for Message Level security :

WebLogic Server includes pre-packaged WS-Policy files that you can use for configuring message-level security and reliable messaging, including the following. These files are static and you cannot change them:

DefaultReliability1.1.xml

Reliability1.1_SequenceTransportSecurity

Reliability1.0_1.1.xml

Does it mean that we can use any one of the following xml files for providing security ??

If so , Please let me know what is best for configuring my Web service for security ??

Thanks in advance .

[Ivan Krizsan]

Hi!
First of all, are you familiar with WS-Policy?
My guess is that the files you mention contain one or more policies and, from the names, I conclude that they are focused on message reliability, that is, ensuring that each message is delivered to its destination, resending messages if necessary.
WS-Policy policies can be included in WSDLs, either directly in the WSDL or imported. The following is an example of an inline WS-Policy declaration declaring a policy that consists of:
- WS-Reliable messaging (required).
- Ordering of messages (required).
- The use of WS-Addressing (optional).

<?xml version="1.0" encoding="UTF-8"?>
<definitions
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    xmlns:tns="http://service.ivan.com/"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://schemas.xmlsoap.org/wsdl/"
    targetNamespace="http://service.ivan.com/"
    name="CalculatorService">

    <!-- Define a WS-Policy policy regarding WS-Reliable Messaging. -->
    <ns1:Policy
        xmlns:ns1="http://schemas.xmlsoap.org/ws/2004/09/policy"
        wsu:Id="CalculatorPortBindingPolicy">
        <!--
            Standard WS-Policy normal form with an <ExactlyOne> and
            a <All> element.
        -->
        <ns1:ExactlyOne>
            <ns1:All>
                <!-- Enable WS-Reliable Messaging. -->
                <ns3:RMAssertion
                    xmlns:ns3="http://schemas.xmlsoap.org/ws/2005/02/rm/policy"/>
                <!-- Enable WS-Reliable Messaging flow control. -->
                <ns2:RmFlowControl
                    xmlns:ns2="http://schemas.microsoft.com/net/2005/02/rm/policy"/>
                <!-- Enable WS-Reliable Messaging message ordering. -->
                <ns4:Ordered xmlns:ns4="http://sun.com/2006/03/rm"/>
                <!-- Optionally use WS-Addressing. -->
                <ns5:UsingAddressing
                    xmlns:ns5="http://www.w3.org/2006/05/addressing/wsdl"
                    ns1:Optional="true"/>
            </ns1:All>
        </ns1:ExactlyOne>
    </ns1:Policy>

    <types>
    ...

If you want to use WS-Policy, you need to write at least one policy similar to the above and include it in your WSDL of the web service.
Best wishes!