Integration Server 10.5 | Web Services Developer’s Guide | Securing Web Services Using WS-SecurityPolicy | Policies Based on WS-SecurityPolicy that Integration Server Provides | SAMLAuthentication_Encryption.policy
 
SAMLAuthentication_Encryption.policy
The SAMLAuthentication_Encryption policy uses a SAML token to provide client authentication, uses asymmetric binding to encrypt messages to ensure message confidentiality, and includes a Timestamp token to guard against replay attacks. This policy does not enforce signatures.
Important:
Before you can use this policy, you must edit the policy file in the Software AG_directory \IntegrationServer\instances\instance_name\config\wss\policies directory and fill in the address of Secure Token Service (STS).
Note:
The SAMLAuthentication_Encryption policy is intended for only provider web service descriptors.
When the policy is attached to:
Message type
To enforce the policy, Integration Server...
Provider web service descriptor
inbound request
*Requires a SAML token in the security header. Integration Server authenticates the sender of the inbound request messages using the client certificate from the SAML token.
*Requires a signed Timestamp token in the security header, which Integration Server validates to ensure against replay attacks.
*Requires that the SOAP body of the inbound request be encrypted and decrypts the SOAP body. For the resolution order that Integration Server uses to determine the private key it uses for decryption, see Web Service Provider: Request (Inbound Security) Detailed Usage and Resolution Order.
outbound response
*Adds a signed Timestamp token to the security header. Integration Server determines the timestamp expiration date to specify using the WS Security Properties of the endpoint alias or by using watt.server.ws.security server configuration parameters. For more information, see webMethods Integration Server Administrator’s Guide. Integration Server signs the Timestamp token using the its private key.
*Encrypts the SOAP body of the outbound response message using the server’s certificate. For the resolution order that Integration Server uses to determine the certificate it uses for encryption, see Web Service Provider: Response (Outbound Security) Detailed Usage and Resolution Order.