Securing OSB 11g proxy services with OWSM 11g

Oracle Web Service Manager (OWSM) 11g is a standards-based solution that allows administrators to implement web services security declaratively (no coding is required, and security is separate from the web services to be protected). Web services security and management policies are defined centrally in OWSM 11g's Policy Manager and executed locally at runtime.

This blog post describes how to implement WS-BASIC for authentication.


Prerequisites

In order to allow OWSM 11g policies to secure OSB 11g proxy services, you must extend your domain to include Oracle Service Bus and the Oracle Service Bus OWSM Extension.

 
Creating Authentication User Accounts

User accounts used for authentication can be created either from the OSB Console or the WebLogic Administration Console. Here, I describe how to do so from the OSB Console.

1. Login to the OSB console

2. Click on 'Security Configuration'

3. Click on 'Add New'

4. Enter the following to create an account that the service will authenticate against:
        User Name:                    <username>
        Password:                      <password>
        Authentication Provider:    DefaultAuthenticator


Securing the OSB Proxy Service

1. Log in to the OSB Console

2. Click on your OSB project

3. Click on the proxy service

4. Click on the 'Policies' tab

5. Select 'From OWSM Policy Store'

6. Click 'Add'

7. Select the policy 'oracle/wss_username_token_service_policy'

8. Update, activate, and submit the changes




Testing

When testing, add the following to the SOAP request header to your payload:

<soap:Header xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <wsse:Security soap:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <wsse:Username>oratest</wsse:Username>
      <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">welcome1</wsse:Password>
    </wsse:UsernameToken>
  </wsse:Security>
</soap:Header>


Applicable Versions

• Oracle Service Bus 11g (11.1.1.5)
• Oracle Web Services Manager 11g (11.1.1.5)