<!--
DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
The contents of this file are subject to the terms of either the GNU
General Public License Version 2 only ("GPL") or the Common Development
and Distribution License("CDDL") (collectively, the "License"). You
may not use this file except in compliance with the License. You can
obtain a copy of the License at
or packager/legal/LICENSE.txt. See the License for the specific
language governing permissions and limitations under the License.
When distributing the software, include this License Header Notice in each
file and include the License file at packager/legal/LICENSE.txt.
GPL Classpath Exception:
Oracle designates this particular file as subject to the "Classpath"
exception as provided by Oracle in the GPL Version 2 section of the License
file that accompanied this code.
Modifications:
If applicable, add the following below the License Header, with the fields
enclosed by brackets [] replaced by your own identifying information:
"Portions Copyright [year] [name of copyright owner]"
Contributor(s):
If you wish your version of this file to be governed by only the CDDL or
only the GPL Version 2, indicate your decision by adding "[Contributor]
elects to include this software in this distribution under the [CDDL or GPL
Version 2] license." If you don't indicate a single choice of license, a
recipient has the option to distribute your version of this file under
either the CDDL, the GPL Version 2 or to extend the choice of license to
its licensees as provided above. However, if you add GPL Version 2 code
and therefore, elected the GPL Version 2 license, then the option applies
only if the new code is made subject to such option by the copyright
holder.
-->
<!--
This client side config file pairs with wss-server-config-2.0.xml on the server
and supports the following UseCases:
Usecase 2: Encrypted UsernameToken
Usecase 3: Encrypted UsernameToken and MessageBody
Usecase 4: Response Encryption Key Learnt from Incoming Message
Certificate Alias Information :
1. A certificateAlias under the <xwss:Encrypt> element signifies the certificate
of the recipient of the message.
2. A certificateAlias under the <xwss:Sign> element signifies the certificate of the
sender.
NOTE:
1. the certificateAlias has the above meaning for all the Sign and Encrypt elements below
2. there are several Sign and Encrypt elements below and similarly several RequireSignature and
RequireEncryption elements. Which of them would be actually used at runtime will depend on
the AuthPolicy passed to the module.
For Example : if Auth-Source=Sender then only the <xwss:UsernameToken> elements will be used
and none of the <xwss:Sign> elements will be used.
If Auth-Source=Content then the <xwss:Sign> element will be used
3. The different variations of <xwss:Encrypt> elements in this configuration file are to accomodate
default encryption of the UsernameToken.
4. The actual certificate alias to be used for any Signature operation can be modified during AuthModule
initialization by setting the alias as the value of "signature.key.alias" property in the Module Options Map.
5. The actual certificate alias to be used for any Encrypt operation can be modified during AuthModule
initialization by setting the alias as the value of "encryption.key.alias" property in the Module Options Map.
6. Debug Dumping of Messages can be enabled by setting the "debug" property in the Module Options Map to "true" during
AuthModule initialization.
7. The Actual configuration file to be used by an Authmodule can be changed by setting the property "security.config" in
the Module Options Map to point to the configuration file location.
8. When the "security.config" property is not set during module initialization then a client auth module will use wss-client-config-2.0.xml
by default.
9. When the "security.config" property is not set during module initialization then a server auth module will use wss-server-config-2.0.xml
by default.
10. The property "dynamic.username.password" when set during module initialization to "true" will signal the provider runtime to collect the username and password from the CallbackHandler for each request. When this property is set to "false" or if the property is not set then the username and password for wsse:UsernameToken(s) is collected once during Module Initialization.
-->
dumpMessages="false">
<xwss:Timestamp/>
<xwss:Encrypt>
<xwss:X509Token certificateAlias="s1as"/>
</xwss:Encrypt>
<xwss:Encrypt>
<xwss:X509Token certificateAlias="s1as"/>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
</xwss:Encrypt>
<xwss:Encrypt>
<xwss:X509Token certificateAlias="s1as"/>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
</xwss:Encrypt>
<xwss:Encrypt>
<xwss:X509Token certificateAlias="s1as"/>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
</xwss:Encrypt>
<xwss:Sign>
<xwss:X509Token certificateAlias="s1as"/>
</xwss:Sign>
<xwss:UsernameToken digestPassword="false" useNonce="true"/>
<xwss:RequireUsernameToken nonceRequired="true" passwordDigestRequired="false"/>
<xwss:RequireSignature>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
</xwss:RequireSignature>
<xwss:RequireEncryption>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
</xwss:RequireEncryption>
<xwss:RequireEncryption>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
</xwss:RequireEncryption>
<xwss:RequireEncryption>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
</xwss:RequireEncryption>
<xwss:RequireEncryption>
<xwss:Target type="qname">SOAP-BODY</xwss:Target>
<xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
</xwss:RequireEncryption>
</xwss:SecurityConfiguration>