1 Overview of Web Services Security and Administration

Web Services Security and Administration in Oracle Fusion Middleware 11g

The following highlights the main features of Oracle Fusion Middleware 11g Release 1 (11.1.1):

• Oracle Web Services Manager (WSM) security and management has been completely redesigned and rearchitected. The previous release, Oracle WSM 10g, was delivered as a standalone product or as a component of the Oracle SOA Suite. In the 11g release, Oracle WSM has been integrated into the Oracle WebLogic Server. For complete details, see "Examining the Rearchitecture of Oracle WSM in Oracle Fusion Middleware".

• Oracle Web services can be classified into the following categories:

  • WebLogic (Java EE) Web services (see "Securing and Administering WebLogic Web Services")

  • SOA, ADF, and WebCenter services (see "Securing and Administering SOA, ADF, and WebCenter Services")

  For more information about the two Web service categories and the types of Web services and clients in Oracle Fusion Middleware 11g, see Oracle Fusion Middleware Introducing Web Services.

• To support the two categories, there are two types of policies that can be attached to Web services, as defined in the following table.

  Table 1-1 Types of Web Service Policies

  Type of Policy	Description
  Oracle Web Services Manager (WSM) Policy	Policy provided by the Oracle WSM. You can attach Oracle WSM policies to SOA, ADF, and WebCenter Web services. You can attach Oracle WSM security policies only to WebLogic JAX-WS Web services to interface with the SOA/ADF/WebCenter Web services, for example. (You cannot attach Oracle WSM policies to JAX-RPC Web services.) You manage Oracle WSM policies from Oracle Enterprise Manager Fusion Middleware Control.
  WebLogic Web Service Policy	Policy provided by WebLogic Server. For more information about the WebLogic Web service policies, see Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server. A subset of WebLogic Web service policies interoperate with Oracle WSM policies. For more information, see "Interoperability with Oracle WebLogic Server 11g Web Service Security Environments". You manage WebLogic Web service policies from WebLogic Administration Console.

  
  

• Application developers can use Oracle JDeveloper to leverage the security and management features of the Oracle WSM policy framework. For more information about attaching policies using Oracle JDeveloper, see the following sections:

  • "Attaching Policies to Binding Components and Service Components" in Oracle Fusion Middleware Developer's Guide for Oracle SOA Suite.

  • "Securing Web Service Data Controls" in Oracle Fusion Middleware Fusion Developer's Guide for Oracle Application Development Framework.

  • "Using Oracle Web Service Security Policies" in Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server

  • "Using Policies with Web Services" in the "Designing and Developing Applications" section of the Oracle JDeveloper online help

• System administrators can use the following tools to secure and administer Web services:

  • Oracle Enterprise Manager Fusion Middleware Control to secure and administer SOA, ADF, and WebCenter services and to monitor and test WebLogic (Java EE) Web services.

  • Oracle WebLogic Administration Console to secure and administer WebLogic (Java EE) Web services.

Web Service Security and Administration Tasks

The following provides an example of the tasks required to secure and administer Web services:

• Deploy, configure, test, and monitor Web services.

• Enable, publish, and register Web services.

• Attach policies to secure and manage Web services and analyze policy usage.

• Create new policies and assertion templates, and manage and configure existing policies.

• Create custom assertions to meet the requirements of your application.

• Manage policy lifecycle to transition from a test to production environment.

• Manage your file-based and database stores in your development and production environments, respectively.

• Test interoperability with other Web services.

• Diagnose problems.

The steps to develop, secure, and administer Web services vary based on the Web service category in use. The following sections outline the steps required:

• Securing and Administering SOA, ADF, and WebCenter Services

• Securing and Administering WebLogic Web Services

Securing and Administering SOA, ADF, and WebCenter Services

To secure and administer SOA, ADF, and WebCenter services:

• At development time, application developers can attach policies, using Oracle JDeveloper or other IDE, to leverage the security and management features of the Oracle WSM policy framework. For more information about attaching policies using Oracle JDeveloper, see the following sections:

  • "How to Attach Policies to Binding Components and Service Components" in Oracle Fusion Middleware Developer's Guide for Oracle SOA Suite.

  • "Securing Web Service Data Controls" in Oracle Fusion Middleware Fusion Developer's Guide for Oracle Application Development Framework.

  • "Using Policies with Web Services" in the "Designing and Developing Applications" section of the Oracle JDeveloper online help.

• System administrators can use Oracle Enterprise Manager Fusion Middleware Control to secure and administer SOA, ADF, and WebCenter services, performing the tasks described in "Web Service Security and Administration Tasks". To access Oracle Enterprise Manager Fusion Middleware Control, see "Accessing Oracle Enterprise Manager Fusion Middleware Control".

  Oracle Enterprise Manager Fusion Middleware Control leverages Oracle Web Services Manager (WSM) to centrally define security and management policies, and enforce them locally at runtime. For more information about Oracle WSM, see "Understanding Oracle WSM Policy Framework".

  For more information about Oracle Enterprise Manager Fusion Middleware Control, see "Getting Started Using Oracle Enterprise Manager Fusion Middleware Control" in Oracle Fusion Middleware Administrator's Guide.

Part II, "Basic Administration" and Part III, "Advanced Administration" describe how to secure and administer SOA, ADF, and WebCenter services in detail.

Securing and Administering WebLogic Web Services

To secure and administer WebLogic Web services:

• At development time, application developers can attach security policies using Oracle JDeveloper or other IDE. For more information, see the following topics:

  • "Using Policies with Web Services" in the "Designing and Developing Applications" section of the Oracle JDeveloper online help.

  • "Using Oracle Web Service Security Policies" in Securing WebLogic Web Services for Oracle WebLogic Server

• System administrators can use the following tools defined in Table 1-2 to secure and administer WebLogic Web services.

Part IV, "WebLogic Web Service Administration" provides a roadmap for securing and administering WebLogic Web services.

Accessing the Security and Administration Tools

The following sections describe how to access the security and administration tools described in the previous sections.