{"history":[],"article":{"id":"1a9634bd-5227-47bc-ac97-01208fc4827f","title":"WS-SecurityPolicy","slug":"ws-securitypolicy","content":":::summary\n:::\n\n# \n**WS-Security Policy** is a [web services](https://bliptext.com/articles/web-services) specification, created by [IBM](https://bliptext.com/articles/ibm) and 12 co-authors, that has become an [OASIS](https://bliptext.com/articles/oasis-organization) standard as of version 1.2.\nIt extends the fundamental security protocols specified by the [WS-Security](https://bliptext.com/articles/ws-security), [WS-Trust](https://bliptext.com/articles/ws-trust) and [WS-Secure Conversation](https://bliptext.com/articles/ws-secureconversation) by offering mechanisms to represent the capabilities and requirements of web services as policies.\nSecurity policy assertions are based on the [WS-Policy framework](https://bliptext.com/articles/ws-policy).\nPolicy assertions can be used to require more generic security attributes like transport layer security <TransportBinding>, message level security <AsymmetricBinding> or timestamps, and specific attributes like token types.\nMost policy assertion can be found in following categories:\nPolicies can be used to drive development tools to generate code with certain capabilities, or may be used at runtime to negotiate the security aspects of web service communication.\nPolicies may be attached to [WSDL](https://bliptext.com/articles/wsdl) elements such as service, port, operation and message, as defined in WS Policy Attachment.\n\n# Sample Policies\nNamespaces used by the following XML-snippets:\n\n... \nInclude a timestamp:\n\nUse either transport layer security (https) or message level security (XML Dsig/XML Enc):\n\n...\n...\n\nTo define a SAML assertion as security token:\n\n\n...#SAMLV2.0\n\n\nIssued token assertion of providers with reference to the STS and required token format:\n\n\n\nhttp://sampleorg.com/sts\n\n\n\n\nhttp://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID\n\n... \n... \nSpecify that message header and body need to be signed, and attachments are left unsigned:\n ?\n* ... \nspecify that message open source license need to be signed, and hydra security are left unsigned:\n\n?\n*\n... \n\n# Other WS policy languages\nThe term Web Services Security Policy Language is used for two different XML-based languages:","current_revision":null,"created_by":"kACnuQmH5k9Nr5VNVEpVeg7XpvUmMctD","created_at":"2025-01-26T09:46:38.299Z","updated_at":"2025-01-26T09:46:38.299Z","search_vector":"'securitypolici':3 'ws':2 'ws-securitypolici':1","search_content":" \n \n\n# \n**WS-Security Policy** is a [web services](https://bliptext.com/articles/web-services) specification, created by [IBM](https://bliptext.com/articles/ibm) and 12 co-authors, that has become an [OASIS](https://bliptext.com/articles/oasis-organization) standard as of version 1.2.\nIt extends the fundamental security protocols specified by the [WS-Security](https://bliptext.com/articles/ws-security), [WS-Trust](https://bliptext.com/articles/ws-trust) and [WS-Secure Conversation](https://bliptext.com/articles/ws-secureconversation) by offering mechanisms to represent the capabilities and requirements of web services as policies.\nSecurity policy assertions are based on the [WS-Policy framework](https://bliptext.com/articles/ws-policy).\nPolicy assertions can be used to require more generic security attributes like transport layer security <TransportBinding>, message level security <AsymmetricBinding> or timestamps, and specific attributes like token types.\nMost policy assertion can be found in following categories:\nPolicies can be used to drive development tools to generate code with certain capabilities, or may be used at runtime to negotiate the security aspects of web service communication.\nPolicies may be attached to [WSDL](https://bliptext.com/articles/wsdl) elements such as service, port, operation and message, as defined in WS Policy Attachment.\n\n# Sample Policies\nNamespaces used by the following XML-snippets:\n \n... \nInclude a timestamp:\n \nUse either transport layer security (https) or message level security (XML Dsig/XML Enc):\n \n ... \n ... \n \nTo define a SAML assertion as security token:\n \n \n ...#SAMLV2.0 \n \n \nIssued token assertion of providers with reference to the STS and required token format:\n \n \n \n http://sampleorg.com/sts \n \n \n \n \nhttp://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID\n \n... \n... \nSpecify that message header and body need to be signed, and attachments are left unsigned:\n ?\n * ... \nspecify that message open source license need to be signed, and hydra security are left unsigned:\n \n ?\n *\n... \n\n# Other WS policy languages\nThe term Web Services Security Policy Language is used for two different XML-based languages:","revisionCount":0},"hasMore":false,"nextCursor":null}

History