ws-security-authentication.md

description
This page provides the technical details of the WS Security Authentication policy

WS Security Authentication

{% hint style="warning" %} This feature requires Gravitee's Enterprise Edition. {% endhint %}

Overview

You can use the wssecurity-authentication policy to manage the security of SOAP API calls. The policy compares the username and password sent in the soap header to an APIM user to determine if the user credentials are valid.

To use the policy in an API, you need to:

• Configure an LDAP, inline, or http resource for your API plan, which specifies where the APIM users are stored
• Configure a WS-Security authentication policy for the API flows

{% hint style="info" %} LDAP, inline and http resources are not part of the default APIM configuration, so you must download these resource plugins here. {% endhint %}

Functional and implementation information for the wssecurity-authentication policy is organized into the following sections:

• Examples
• Configuration
• Compatibility Matrix
• Errors

Examples

{% hint style="warning" %} This policy can be applied to v2 APIs and v4 HTTP proxy APIs. It cannot be applied to v4 message APIs or v4 TCP proxy APIs. {% endhint %}

{% tabs %} {% tab title="HTTP proxy API example" %} In the example below, the policy will extract foo & bar from the payload.

{% code title="Default response" %}

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header>
        <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2003/06/secext">
            <wsse:UsernameToken>
                <wsse:Username>foo</wsse:Username>
                <wsse:Password>bar</wsse:Password>
            </wsse:UsernameToken>
        </wsse:Security>
    </soap:Header>
    <soap:Body>
        ...
    </soap:Body>
</soap:Envelope>

{% endcode %} {% endtab %} {% endtabs %}

Configuration

Sample policy configuration:

{% code title="Sample Configuration" %}

{
  "name": "Custom name",
  "description": "Manage the security of SOAP API calls",
  "policy": "policy-wssecurity-authentication",
  "configuration": {
   "authenticationProviders" : [ "authProvider" ]
  }
}

{% endcode %}

Phases

The phases checked below are supported by the wssecurity-authentication policy:

v2 Phases	Compatible?	v4 Phases	Compatible?
onRequest	false	onRequest	false
onResponse	false	onResponse	false
onRequestContent	true	onMessageRequest	false
onResponseContent	false	onMessageResponse	false

Options

The wssecurity-authentication policy can be configured with the following options:

Property	Required	Description	Type	Options
authenticationProviders	false	List the authentication providers	list of strings	N/a

Compatibility matrix

The following is the compatibility matrix for APIM and the wssecurity-authentication policy:

Plugin Version	Supported APIM versions
2.x	3.x
3.x	4.0+

Errors

There are no out-of-the-box errors returned by this policy.