Setting WS-Security

www.altova.com Print this Topic Previous Page Up One Level Next page

Home >  Calling Web Services >

Setting WS-Security

The WS-Security settings must be configured if the Web service is protected by WS-Security and requires that you provide the UsernameToken security token.

 

Conventions

The following abbreviations for the namespaces applicable to Web services are used in this topic:

 

Prefix

Namespace

wsse

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd

wsu

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd

 

 

To set WS-Security:

1.Open the Web Service Call Settings dialog box (see Web Service Call Settings).
2.Click the Edit button next to WS-Security Settings.

mf_ws_10

WS-Security Settings dialog box

Add UsernameToken

A UsernameToken is an optional WS-security element present in the header of the SOAP message. The UsernameToken is used by the Web server to authenticate the caller of the Web service.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken

Username

Enter the username included in the UsernameToken.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken/wsse:Username

Password

Enter the text of the password included in the UsernameToken.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken/wsse:Password

Password type

Select the type of password included in the UsernameToken. Select Digest if the Web server expects the password in this mode; otherwise select Text.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken/wsse:Password/@Type

Dynamic authentication

Select this check box if you would like to supply the username and password from the mapping instead of entering them into this dialog box.

Add nonce

Select this check box if you want to add a nonce to the Username token. A nonce is a random value which uniquely identifies each UsenameToken to provide additional security. If you enable this option, it is recommended to enable the Add "Created" timestamp option as well.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken/wsse:Nonce

Add "Created" timestamp

Select this option to add a timestamp to each nonce.

 

In the wsse specification (see Conventions), this field corresponds to:

 

/wsse:UsernameToken/wsu:Created

Add Timestamp

Select this check box if you want to enable the time-to-live (TTL) value for the SOAP message (see the next option).

 

In the wsu specification (see Conventions), this field corresponds to:

 

/wsu:Timestamp

Time to live

Enter the time-to-live (TTL) for the SOAP message to diminish the chance of someone intercepting the message and replaying it.


© 2019 Altova GmbH