WS-Security
Description
Web service security (WS-Security) is an additional level of security that is applied on SOAP web services. Even though TLS provides protection of SOAP web service communication on transport level, it does not provide protection (integrity, confidentiality, non repudiation) on a message level.
WS-Security brings security of SOAP web services to a higher level by additionally protecting SOAP messages exchanged in SOAP.
Creation
WS-Security is a implicitly part of SoapBinding in service declaration.
Configuration
To start using WS-Security you simply have to select the Use Web Service Security check box in security configuration of service declaration SOAP binding:
Header is an instruction to the receiving side if WS-Security element has to be understood. If this check box is selected, Security element (from http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd) will contain mustUnderstand="1" attribute (from http://schemas.xmlsoap.org/soap/envelope/).
The logging Level combo box determines on which log level will be SOAP message logged in Orchestra. This is useful if you need to trace SOAP messages that are sent and received.
Outbound configuration
All parameters defined here are implementing OASIS Web Service Security specifications. Only crucial functions are supported currently, such as signature, time-stamp and encryption of SOAP messages.
SOAP Message Actions is a combination of actions performed over SOAP message.
Signature Parts says which elements of SOAP envelope will be included in signature generation. Signature is generated using XMLDSig W3C recommendation.
Encryption Parts says which elements of SOAP envelope will be encrypted. Encrypted data is generated using XMLEnc W3C recommendation.
Signing Credentials is a credential of type Technical login (has to contain private key of sender - PKCS#12 file) and it is required to sign SOAP message.
Signature Algorithm is an algorithm that is used for signing content (digested Signature Parts).
Digest Algorithm is an algorithm used for cryptographic digest operation over Signature Parts.
Encryption Credentials is a credential of type Client login (has to contain public key of receiver - public key certificate) that is used to encrypt content (Encryption Parts).
Key identifier type is a determining format of key transferred in a SOAP envelope.
Inbound configuration
SOAP Message Actions is an expected combination of actions that are performed over incoming SOAP message.
Signature Parts are parts of a SOAP envelope that are expected to be signed.
Encryption Parts are parts of a SOAP envelope that are expected to be encrypted.
Decrypting Credentials is credential of type Technical login (has to contain private key - PKCS#12 file that corresponds to the public key that was used for encryption) and it is required to decrypt SOAP message.
Signature verification Credentials is credential of type Client login (has to contain public key of a signer - public key certificate) that is used to verify signed content.