Web service security.

Similar Questions

• Web Service security settings of 10g and 11g Migration

  We will migrate a complete Application of the ADF from 10g to 11g. We got all this work, but the web services. It seems that we learned the work of web services, but the security settings for the web service are very different and I have difficulties to make them work.

  For example, we have a customer's web service that has a X 509 certificate for authentication. We use the WSS 1.0 safety and I chose in the Configuration of the customer strategy: "oracle/wss10_x509_token_with_message_protection_client_policy and in 'Select credentials', I use https identification information."

  However, I get the following error when I try to use the web service pointing to the customer: Note: I also detached the client and deleted the credentials and get a SIMILAR error.

  < javax.xml.ws.soap.SOAPFaultException: WS-Security treat failure: FAULT CODE: InvalidSecurity MESSAGE of ERROR: header missing WS Security in the SOAP message >

  < to com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:197) >

  < to com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:122) >

  < to com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:125) >

  < to com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:95) >

  < to com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:136) >

  So any that I have attached a customer or have not a joint, I get the same error. An idea that I am wrong?

  Thank you

  Okay, figured it out. I had to use ClientConstants to set the web strategy and set the OWSM political Director to use the appropriate strategy.

  The ClientConstants code is:

  SecurityPoliciesFeature = securityFeatures

  New SecurityPoliciesFeature (new String() {"oracle/wss10_x509_token"});

  In InboundOutbound_Service = new InboundOutbound_Service();

  InboundOutbound svc = in.getInboundOutboundPort (securityFeatures);

  String urlLn = this.getURL ('url');

  BindingProvider bp = svc (BindingProvider);

  Card reqContext = bp.getRequestContext ();

  reqContext.put (BindingProvider.ENDPOINT_ADDRESS_PROPERTY, urlLn);

  reqContext.put (ClientConstants.WSSEC_KEYSTORE_TYPE, "JKS");

  reqContext.put (ClientConstants.WSSEC_KEYSTORE_LOCATION, "web.jks");

  reqContext.put (ClientConstants.WSSEC_KEYSTORE_PASSWORD, "pw");

  reqContext.put (ClientConstants.WSSEC_ENC_KEY_ALIAS, "keyalias");

  reqContext.put (ClientConstants.WSSEC_ENC_KEY_PASSWORD, "pw");

  reqContext.put (ClientConstants.WSSEC_SIG_KEY_ALIAS, "keyalias");

  reqContext.put (ClientConstants.WSSEC_SIG_KEY_PASSWORD, "pw");

  reqContext.put (ClientConstants.WSSEC_RECIPIENT_KEY_ALIAS, "serveralias");

  Here is a picture of link at all that I found useful:

  https://blogs.Oracle.com/OWSM/entry/owsm_concepts_11g

  http://docs.Oracle.com/CD/E21764_01/Web.1111/b32511/setup_config.htm#BABJHIBI

  Using Oracle Web Service security policies

  Review of the architecture of Oracle WSM in Oracle Fusion Middleware

• JDeveloper 12.2.1.0.0 do not add the header of web service security

  Hello

  I write simple WebService Java Client to a simple wsdl.

  If I click with the right button on the WSDL file and say 'Test Web Service', a request was made for me by Jdeveloper, all I have to do is click the box include the username and password for SOAP Header-> Header WS:Security and under the "security-> UserNameToken" and my request now has a security header

  " < = xmlns:env env:Envelope ' http://www.w3.org/2003/05/soap-envelope "xmlns:ns1 =" " http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd "xmlns:ns2 =" " http://Oracle.apps.CTB.cdapersistence.types ">

  < env:Header >

  < ns1:Security >

  < ns1:UsernameToken >

  WebLogic < ns1:Username > < / ns1:Username >

  password < ns1:Password > < / ns1:Password >

  < / ns1:UsernameToken >

  < / ns1:Security >

  < / env:Header >

  < env:Body >

  < ns2:PersistCDADocumentRequest >

  < ns2:Document / >

  < / ns2:PersistCDADocumentRequest >

  < / env:Body >

  < / env:Envelope >

  I tried 3 separate ways to do it in my Java Web Service Proxy and all 3 have failed, the demand created by my java code does not include the security header and don't include that the < env:Header / > why are my bottom 3 attempts of creation of the grave security header down when they are means documented to supply security headers? Help, please

  Method 1:

  Map < String, Object > requestContext = (cDAPersistenceServicePortType) .getRequestContext ((BindingProvider));

  requestContext.put (BindingProvider.USERNAME_PROPERTY, "weblogic");

  requestContext.put (BindingProvider.PASSWORD_PROPERTY, "password");

  Methos 2:

  Map < String, Object > requestContext = (cDAPersistenceServicePortType) .getRequestContext ((BindingProvider));

  Map < String, List < String > > headers = new HashMap < String, List < String > > ();

  headers.put ("Username", Collections.singletonList ("weblogic"));

  headers.put ("Password", Collections.singletonList ("password"));

  requestContext.put (MessageContext.HTTP_REQUEST_HEADERS, headers);

  Methos 3:

  @Generated ("oracle JDeveloper")

  public static void setPortCredentialProviderList (map < String, Object > requestContext) bird Exception {}

  TODO - provides the required identification information values

  String username = "weblogic";

  String password = "password";

  credList.add (getUNTCredentialProvider (username, password));

  
  

  requestContext.put (WSSecurityContext.TRUST_MANAGER, new TrustManager() {}

  {public boolean certificateCallback (X509Certificate [] string, int validateErr)

  Boolean result =

  (string! = null & & chain.length > 0) & & (chain [0] (serverCert) .equals | chain [0] .equals (clientCert));

  return the result;

  Returns true;

  }

  });

  credList.add (getSAMLTrustCredentialProvider ());

  requestContext.put (WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credList);

  }

  @Generated ("oracle JDeveloper")

  public static CredentialProvider getUNTCredentialProvider (String username, String password) {}

  new return ClientUNTCredentialProvider (username.getBytes (), password.getBytes ());

  }

  @Generated ("oracle JDeveloper")

  public static CredentialProvider getSAMLTrustCredentialProvider() {}

  return new SAMLTrustCredentialProvider();

  }

  found an answer here - http://stackoverflow.com/questions/5976940/how-to-add-soap-header-in-java

• Web services security

  Hello
  
  How can I secure web services native Oracle (PL/SQL)? How can I make sure that calls (from PHP, ASP.NET, etc.) to these PL/SQL web services are authenticated and authorized? What other software do I need to implement security?
  
  Thank you.
  
  Andy

  andychow wrote:

  I've been using Oracle APEX since its initial release (1.6 HTMLDB?).

  Has been called Marvel project. :-)

  However, web services is really a new object me - until now, I need to learn more about this topic.

  A web service is not that much different. He gets a HTTP request and responds to it. The difference from a technical point of view is the payload. A SOAP payload is received and a load XML is the answer.

  I think that, especially with Java developers, which is described by using several acronyms and definitions more and more moving parts. But it's especially stuffed animals. This is the client-server tcp using the HTTP application protocol to send and receive payloads.

  This means that all of the basic concepts and standards and security issues with HTTP client-server, remain valid.

  What I'm not clear, is that, with respect to web services Oracle XML DB, do I really need to set a port in the server that is running the database for the XDB HTTP listener

  For the web service procedure or method to receive the call and answering the call, a layer of HTTP communication is necessary. This can be Apache, IIS, Tomcat or servlet HTTP in XDB.

  I feel very uncomfortable allow access to resources of database directly through a browser without worrying it's http or https.

  I don't see that as the real problem. If the customer uses OIC via tcp or HTTP over tcp to communicate with the database, basic security issues and principles remain the same.

  What offer the XDB is the elimination of a layer external s/w (like Apache) to deal with the aspect of communication tcp and HTTP interface. This can be useful sometimes (deletes an external point of failure and external complexity). Maybe it's not ideal at other times. As usual, it depends on the security requirements and the physical communications infrastructure.

  We can expose web services Oracle XML DB with Oracle HTTP instead of use the XDB HTTP listener in an Oracle database?

  Yes. The caller specifies what exactly? A URL that refers to a procedure from PL/SQL web active. So if that is served by Apache mod_plsql or via a servlette XDB is neither here or there - both are interface HTTP communication layers. Their main goal is to provide the interface between the client and the web service.

  I find the documentation on web services to confusion at times because it is too abstract and does not address the fundamental workings of its operation. And Oracle API web service in the data base is (AFAIK), on ito Java classes complex configuration and use of the PL/SQL wrappers and cryptic in error responses.

  So when it comes to web services, I generally prefer to roll my own using PL/SQL only.

• BPM 11 g: call a secure web service

  Hi all

  I need to invoke a web service secured a BPM process. I do the following

  1. to add a reference, I added the customer strategy security "oracle/wss_username_token_client_policy' using option set up political WS on the reference. I also added oracle/log_policy to see SOAP requests being generated.

  2. I added the below properties in the composite.xml slot of the reference binding.ws

  < name = "oracle.webservices.auth.username property" type = "xs: String" "

  much = 'false' override = "may" > SomeUserName < / property >

  < name = "oracle.webservices.auth.password property" type = "xs: String" "

  Override = 'may' many 'false' = > SomePassword < / property >

  But I get an exception during the invocation

  MustUnderstand headers: [{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd} Security] are not included

  Also the SOAP request sent to the service of reference I think newspapers don't have the password or a usernametoken anywhere. What else must be configured or set to invoke the secure web service.

  Thank you

  Siva Renon

  Hi all

  I got it working to create a new key - basic.credentials - in oracle.wsm.security map the credentials of the domain. You can check this link for the steps.

  Thank you

  Siva Renon

• The secure web service call error.

  Hello
  
  I try to access a web service secured through a simple BPEL process in SOA Suite 11 g. When I test it through the company Manager, I get the following error. Since this is a guarantee websecure I put the policy(oracle/wss_username_token_client_policy) WS in the external reference and also provided identifying information. If someone had a similar error or know the solution please let me know. Also, I'm not sure if its related to security, or is - the way I am calling the service.
  
  Error message:
  Error ID reference: 80014
  Lack of time may 22, 2011 12:54:45
  Anomaly of the non-recoverable system:
  javax.xml.ws.soap.SOAPFaultException: 99999: unknown Service
  
  Error message: {http://schemas.oracle.com/bpel/extension} remoteFault
  Error default/Mocking!1.0*soa_be35cb3e-5f05-49df-a696-a653d5703681/BPELProcess1/30017-BpInv0-BpSeq0.3-3 ID
  Lack of time may 22, 2011 12:54:46
  
  Anomaly of the non-recoverable system:
  < bpelFault > < faultType > 0 < / faultType > < remoteFault xmlns = "http://schemas.oracle.com/bpel/extension" > < a name = "summary" part > < summary > 99999: unknown Service < / summary > < / part > < part name = "detail" > < details > & lt; con xmlns:Con: fault = "http://www.bea.com/wli/sb/context" > & lt; Con: errorCode > 99999 & lt; / con: error code > & lt; Con: reason > unknown Service & lt; / con: reason > & lt; Con: location > & lt; Con: node > PipelinePairNode1 & lt; / con: node > & lt; Con: pipeline > PipelinePairNode1_request & lt; / con: pipeline > & lt; Con: Stadium > stage1 & lt; / con: Stadium > & lt; / con: location > & lt; / con: fault > < / detail > < / part > < part name = "code" > < SOAP: server code > < / code > < / piece > < / remoteFault > < / bpelFault >

  This occurs if you have several (different webservices) WSDL imported into your project and they share common artifacts(XSD's). In this case, what you do, it's just that you separated from xsd to wsdl and deleted conflicts. This approach is suggested when you do not have control on WSDL that may be provided by different team and they all share common XSD.

  Thank you
  Smail
  http://soadiscovery.blogspot.com

• OPA 12.2 Query Web Service xml structure

  Hi OPA Experts,

  We installed the version hub 12.2 of the OPA. I use the interface webservice sample project 'HealthEating '. But "Evaluate" the demand is huge, how to fill out only necessary data entry.

  Do you have sample compact xml for tests in SOAPUI?

  Thank you

  Moses.

  is the user name and password is required in the version of hub? , I tried to "authentication failure". So SOAPUI, I created manually authentication, it worked fine,

  It is mandatory by default, as the end point of the web service is restricted to users with the role of user API web service.

  See "a political model deployed as a web service secure", for more details, including how to allow anonymous access ( http://documentation.custhelp.com/euf/assets/devdocs/august2015/PolicyAutomation/en/Default.htm#Guides/Project_Administrator_Guide/Security/Secure_web_services.htm )

  How to pass username and password in the hub of 12.2. the demand?

  See the topic "Authenticate with a secure web service" ( http://documentation.custhelp.com/euf/assets/devdocs/august2015/PolicyAutomation/en/Default.htm#Guides/Developer_Guide/DeterminationsAPI/Authenticate_w_secured_Web_Service.htm )

• PL/SQL proc as a web service

  Oracle 11.2.0.x
  Reference: Accessing PL/SQL procedures stored using a Web Service (< i > Oracle Developer of Microsoft® XML DB Guide < /i >).
  
  The feature works very well. Have tested a number of written PL/SQL procs customized this way - is used as a web service and SoapUI and UTL_HTTP procedures as customers, call the web service.
  
  Issue.
  Can it withstand WSS (Web Services Security) with this feature?
  
  I added a WSSE to the header of the SOAP envelope when calling - using the standard password (no digest) and the default address. Orawsv XDB servlet accepts the call, the analysis of the SOAP envelope and executes the PL/SQL procedure successfully.
  
  However, it uses Basic authentication (schema name and password). Not the WSSE.
  
  Because the WSSE authentication data are part of the SOAP header (and not the body envelope), the PL/SQL procedure of course don't don't can't see the details of the WSSE. (also would make sense ito how XDB abstracts orawsv as a web service interface and allows procedures PL/SQL standard vanilla and functions to be used as web service endpoints).
  
  So if the WSSE must be supported, this would probably mean that he needs to be supported in XDB himself. And it is outside my small area of expertise of the Oracle.
  
  Not much on the net (many UTL_DBWS) and just a couple of basic orawsv supports Metalink notes.
  
  Ideas, suggestions or pointers will be appreciated.
  
  Thank you.

  WSS will not be supported by Native Web Services database. It is a deliberate choice to differentiate when an application server should be used Vs when DBNWS is appropriate. If you are in an environment where WSS is a requirement, you should be usiing an applications, such as Oracle WebLogic Server, to offer your Web Services.

  It said the next version of the database willl help DIGEST so authenitcation BASE for HTTP. If the current model of BASIC authentication is a problem, then you should force the use of an SSL (HTTPS) connection. That's why we have the role XDB_WEBSERVICES_OVER_HTTP. If this role is not granted then the DBNWS accessible only using HTTPS.

• Integration with the secure web service IS deployed on EBS

  Hello experts,

  I have a REST webservice deployed to an Instance of the EBS. I try to call the web service using a mobile application in the ADF. However, the web service is secure and requires security settings to be sent in the request header.

  Anyone can recall or explain how I can add a custom header to the object of the application for the REST web service? Any help will be appreciated.

  Thank you

  Abhishek

  Hi Abhishek,

  You can do the following:

  String theUsername = "abc";

  String thePassword = "pass";

  String userPassword = theUsername + ': ' + thePassword.

  String encoding = new sun.misc.BASE64Encoder () .encode (userPassword.getBytes ());

  restServiceAdapter.addRequestProperty ("Authorization", "Basic" + coding);

  If you use Webservice DataControl, then automatically the connection information in the login form is injected into the webservice framework.

  Kind regards

  Deepak

• Web Service on JCS13.2: InvalidSecurityToken: the security token is not valid.

  Hello

  I deployed a web service with security @SecurityPolicy (uri = "oracle/wss_username_token_over_ssl_service_policy") policy.  The WSDL file seems

  But when I test with SOAPUI and JDeveloper HTTP Analyzer, it always, up InvalidSecurityToken: the security token is not valid.

  The Web Service code is as below,

  Import javax.jws.WebMethod;

  Import javax.jws.WebService;

  Import weblogic.wsee.jws.jaxws.owsm.SecurityPolicies;

  Import weblogic.wsee.jws.jaxws.owsm.SecurityPolicy;

  @WebService

  @SecurityPolicy (uri = "oracle/wss_username_token_over_ssl_service_policy")

  public class HelloWorld {}

  public HelloWorld() {

  Super();

  }

  @WebMethod

  public String sayHi (String name) {}

  Return "Hello" + name;

  }

  }

  What is the valid username and password for the web service deployed on JCS?  Any suggestion and assistance is very much appreciated.

  Looked into this a bit and I think that your problem can be caused by a time stamp missing security feature. Try something like:

  http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"xmlns:wsu ="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">."

  username

  http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText "> pwd"

  http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-SOAP-message-security-1.0#base64Binary "> XtfCRwo4W3qo8DqryRpuwg =="

  2014-07 - 04T 10: 29:29.371Z

  2014-07 - 04T 10: 29:29.361Z

  2014-07 - 04T 10: 46:09.361Z

  It worked for me using the Soap UI request. So try to add the "wsu:Timestamp" element and pointed out that the value used must be within the tolerance between the client and the server so have a valid value, you have the tolerance depends on how the system is configured for configuration details, refer to . Advanced Administration. Based on tests of strength bully me into JCS his game somewhere about 480 seconds...

  --

  Jani Rautiainen

  Relationship with the developers of Applications in fusion

  https://blogs.Oracle.com/fadevrel/

• Access a secure web service of ADF Mobile Application

  Hello

  We try to create an ADF Mobile application that uses a secure web service located in Oracle EBS (with SOA Suite).

  We use JDeveloper 11 g 11.1.2.4.0

  Initially, create usd a Control(SOAP/REST) Gallery Web Service data and provided the WSDL document. We tried to run on a simulator, but not did not do anything. We have also found a way to provide the user name and password. So we left it there.

  Then we tried to create a Java desktop app to check if it was a problem with our server. In the desktop application, we created a "Web Service Client and Proxy" new gallery followed the steps and used oracle/wss_username_token_client_policy, added the code below to put the username and password and was able to call the service and retrieve data.

  (reqContext.put (BindingProvider.USERNAME_PROPERTY, "DBAKER");

  reqContext.put (BindingProvider.PASSWORD_PROPERTY, "xxxxx");

  So we thought to return to the application the ADF Mobile and creating a "Web Service Client and Proxy" it, but when we built this project, we had the ' annotations are not supported in - source 1.4 "&" generics are not supported in - source 1.4 "errors and found that ADF Mobile does not support beyond Java 1.4" "» (Is that right?)

  We then found the video "to access the secure Services of ADF Mobile Web" by Shay (https://www.youtube.com/watch?v=rk5om3o3Pas) and saw that he was using a login server.

  We wanted to confirm if you use a login server is the right path to access a secure web service of an Oracle ADF Mobile application?

  Are there other ways to do it?

  If we need to create a login server, can provide you links that will put us on the right track in establishing a connection server that can connect to the EBS?

  Thank you.

  The URL must point to a protected page that prompts the user for basic authentication.

  See an example here:

  https://blogs.Oracle.com/Shay/entry/accessing_secure_web_services_from

  As well as the blogs linked at the bottom of this entry.

• ADF Mobile | using secure web services

  
  Hi all

  I'm pretty new to ADF Mobile, I use JDev 11.1.2.4.

  In my Mobile application I want to use the secure web service.

  Here's what I do:

  1. creation of a data control based on the WSDL binding.

  2. get the web service methods in the data control.

  3. during the race, I'm getting that error "oracle.j2ee.ws.client.jaxws.JRFSOAPFaultException: Client from server SOAP fault: Missing < wsse: Security > in the SOAP header.

  When trying to run the WSDL binding in SOAP UI, I need set request username and passwordproperties, then only I will be able to invoke this web service.

  Here, my question is where can I set these properties for the data control to the web service ?

  Please suggest.

  Thank you

  Vieu

  Hi Shay,

  Thank you very much for the reply, I'm able to resolve the problem with the approach mentioned user guide.

  I forgot to set it up for the first time: ADF Mobile allows you to specify a custom provider class in your DataControls.dcx file. This custom class extends oracle.adfinternal.model.adapter.webservice.provider.soap.SOAPProvider . You can use it to specify an implementation of the SoapHeader[] getAdditionalSoapHeaders() method

  Example 9-1 shows how to extend the SOAPProvider and create a custom header has shown in example 9-2

  package provider.ebs.soap;

  Import oracle.adfinternal.model.adapter.webservice.provider.soap.SOAPProvider;

  Import oracle.adfinternal.model.adapter.webservice.provider.soap.SoapHeader;

  SerializableAttribute public class EBSSOAPProvider extends SOAPProvider {}

  SoapHeader public getAdditionalSoapHeaders() {}]

  SoapHeader header [] = SoapHeader News [2];

  SoapHeader token = null;

  SoapHeader user = null;

  SoapHeader pass = null;

  header [0] = new SoapHeader ("http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/",

  "SOAHeader");

  header [0] .addChild (new SoapHeader)

  "http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/,"

  "Responsibility."

  'SYSTEM_ADMINISTRATOR'));

  header [0] .addChild (new SoapHeader)

  "http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/,"

  "RespApplication,"

  'SYSADMIN'));

  header [0] .addChild (new SoapHeader)

  "http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/,"

  "SecurityGroup."

  'STANDARD'));

  header [0] .addChild (new SoapHeader)

  "http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/,"

  "NLSLanguage,"

  'AMERICAN'));

  header [0] .addChild (new SoapHeader)

  "http://xmlns.oracle.com/apps/fnd/soaprovider/plsql/fnd_user_pkg/,"

  "Org_Id."

  "0"));

  header [1] = (new) SoapHeader

  "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd,"

  'Security');

  Token = new (SoapHeader

  "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd,"

  "UsernameToken");

  User = new (SoapHeader

  "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd,"

  "Username."

  "sysadmin");

  pass = new (SoapHeader

  "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd,"

  "Password."

  "sysadmin");

  Header [1]. AddChild (Token);

  token.addChild (user);

  token.addChild (pass);

  Returns the header;

  }

  }

  Kind regards

  Vieira

• Secure Web Service client

  Hello.
  I'm trying to create a Proxy Web Service using JDeveloper (client). The goal is to connect to a secure external web service.
  Provided by the service web WSDL contains no information on security policy.
  I decided to give it a try, so, since "Configuration of the customer strategy" page "Editor of Proxy" window I selected "oracle/wss_username_token_client_policy.
  The problem is that I have found a way to define the user name and the password. If I get an error like this:
  
  BASS: WSM-00078 powers in policy configuration is incorrect.
  SEVERE: WSM-00016 name username/password credentials or certificates null are missing.
  SEVERE: WSM-00005 error in sending the request.
  SEVERE: WSM-07607 failure in the execution of the assertion executor wss-username-token class oracle.wsm.security.policy.scenario.executor.WssUsernameTokenScenarioExecutor {http://schemas.oracle.com/ws/2006/01/securitypolicy}.
  SEVERE: WSM-07602 failure in execution of WS-Policy because of the exception.
  SERIOUS: Failure WSM - 07501 Oracle WSM Agent processRequest, category = security, function = agent.function.client, = null, composite application = null, modelObj = EVPQuery, political = oracle/wss_username_token_client_policy policyVersion = null, assertionName = {http://schemas.oracle.com/ws/2006/01/securitypolicy} username-wss-token.
  oracle.wsm.common.sdk.WSMException: WSM-00015: the user name is missing.
  at oracle.wsm.security.policy.scenario.executor.WssUsernameTokenScenarioExecutor.sendRequest(WssUsernameTokenScenarioExecutor.java:219)
  at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:545)
  at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
  at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:608)
  at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion (WSPolicyRuntime
  ...
  
  The code is something like this:
  
  Private Shared EVPQuery_Service eVPQuery_Service;
  
  Public Shared Sub main (String [] args)
  {
  eVPQuery_Service = new EVPQuery_Service();
  SecurityPolicyFeature [] = securityFeatures
  new SecurityPolicyFeature [] {new SecurityPolicyFeature("oracle/wss_username_token_client_policy")};
  EVPQuery eVPQuery = eVPQuery_Service.getEVPQuery (securityFeatures);
  EVPPersonQueryCriteria crit = new EVPPersonQueryCriteria();
  crit.setCnpNumber ("something");
  crit.setCountyCD ("something");
  Res EVPPersonQueryResult;
  Add your code to call the desired methods.
  try {}
  RES = eVPQuery.queryPerson (written);
  } catch (SableEVPQueryException e) {}
  System.out.println (e.getMessage ());
  }
  }
  
  I am looking for a solution pass the user name and the password for the web service.
  I'm here after six hours of searching, so if my question is stupid, please forgive me.
  
  Thank you

  Hello

  The chances are very slim that you will be able to get this to work since you don't really know how the service has been obtained.
  But since you want to do a test with the user name token policy, you can try with the code below:
  .
  Public Shared Sub main (String [] args)
  {
  class1Service = new Class1Service();
  SecurityPolicyFeature [] = securityFeatures
  new SecurityPolicyFeature [] {new SecurityPolicyFeature("oracle/wss_username_token_client_policy")};
  Class1, class1 = class1Service.getClass1Port (securityFeatures);
  Add your code to call the desired methods.
  Card reqContext = (class1) .getRequestContext ((BindingProvider));
  reqContext.put (BindingProvider.USERNAME_PROPERTY,">" ");
  reqContext.put (BindingProvider.PASSWORD_PROPERTY,">" ");
  System.out.println (Class1.SayHello ("SecureCall"));

  }

  Thank you
  Vishal

• WebService + secure jms (Web Service on the JMS trans).

  Apologize as this post is in the forum of webservice as well but since it's related to both jms I put it here as well.
  
  I have a web service that uses JMS (@WLJmsTransport Web Service via the JMS transport)
  
  and everything seems to be ok, but I don't know how to use this function if the JMS is secure.
  
  Security added on JMS queue what other things I should do for the webservice access the queue?
  
  (where I specify credentials?)
  
  @WebService (serviceName = "ASyncService", targetNamespace = "http://axyz.org/notification/v1", endpointInterface ="
  axyz.notification.ASyncPort')
  @WLJmsTransport (= "warn" contextPath, serviceUri = "async_event", portName = "ASyncServicePort", line = "Events", connectionFactory = "cnfct_receiver")
  
  Thank you!

  Hello

  You can use the annotation @weblogic.jws.security.RolesAllowed in your WebService. This annotation works well with JAXRPC WebService.

  Thank you
  Jay SenSharma
  http://jaysensharma.WordPress.com/2010/01/27/jaxrpc-service-with-wljmstransport/

• Secure Web Service call

  Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - production
  PL/SQL Release 10.2.0.2.0 - Production
  
  Hello
  Is it possible to contact a secure Web service (ws-security) with pl/sql code?
  I can communicate with a https without problem, but I don't see how I can do for the ws-security header.
  
  Thanks in advance.

  Unfortunately, WS-Security is not supported with the Oracle DBWS utility legend, right now. However, we have a very high improvement gravity request filed for this internallt - so it's probably in one of the upcoming releases soon.

  In the meantime, you may want to consider going back to using UTL_HTTP for it where you can create your own custom SOAP (WS-Security headers in this case) headers-, but keep in mind that UTL_HTTP can be used with types only very basic of Web Services with simple data types, methods, etc. Another and a better solution would be to have a 'bridge' Web Service (via the SSL protocol, perhaps) who speaks to your main Web Service using WS-Security. This WS bridge can then be invoked by your database using the utility DBWS legend.

  HTH,
  Yogesh