Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
WS-SecurityPolicy
open-in-new
<p>WS-Security Policy is a <a href="/facts/Web_Services/qxrwqB3D">web services</a> specification, created by <a href="/facts/IBM/QszA7nwd">IBM</a> and 12 co-authors, that has become an <a href="/facts/OASIS_(organization)/a2r8y7tX">OASIS</a> standard as of version 1.2. It extends the fundamental security protocols specified by the <a href="/facts/WS-Security/T7v5kCJt">WS-Security</a>, <a href="/facts/WS-Trust/19aNR5ae">WS-Trust</a> and <a href="/facts/WS-SecureConversation/UvaawSes">WS-Secure Conversation</a> by offering mechanisms to represent the capabilities and requirements of web services as policies. Security policy assertions are based on the <a href="/facts/WS-Policy/IXYhbXTp">WS-Policy framework</a>. </p><p>Policy assertions can be used to require more generic security attributes like transport layer security <TransportBinding>, message level security <AsymmetricBinding> or timestamps, and specific attributes like token types. </p><p>Most policy assertion can be found in following categories: </p> <ul><li>Protection assertions identify the elements of a message that are required to be signed, encrypted or existent.</li> <li>Token assertions specify allowed token formats (SAML, X509, Username etc.).</li> <li>Security binding assertions control basic security safeguards like transport and message level security, cryptographic algorithm suite and required timestamps.</li> <li>Supporting token assertions add functions like user sign-on using a username token.</li></ul> <p>Policies can be used to drive development tools to generate code with certain capabilities, or may be used at runtime to negotiate the security aspects of web service communication. Policies may be attached to <a href="/facts/WSDL/tQPIot4A">WSDL</a> elements such as service, port, operation and message, as defined in WS Policy Attachment. </p>