Sun Java System Application Server Platform Edition 8.1 2005Q2 Update 2 Developer's Guide

- Previous: message-destination-name
- Next: message-security-config

## message-security

Specifies message security requirements.

- If the grandparent element is webservice-endpoint, these requirements pertain to request and response messages of the endpoint.

- If the grandparent element is port-info, these requirements pertain to the port of the referenced service.

### Superelements

message-security-binding (`sun-web.xml`, `sun-ejb-jar.xml`, `sun-application-client.xml`)

### Subelements

The following table describes subelements for the `message-security` element.

Table A–67 `message-security` Subelements

Element | Required | Description
--- | --- | ---
message | one or more | Specifies the methods or operations to which message security requirements apply.
request-protection | zero or one | Defines the authentication policy requirements of the application’s request processing.
response-protection | zero or one | Defines the authentication policy requirements of the application’s response processing.

### message-security-binding

Specifies a custom authentication provider binding for a parent webservice-endpoint or port-info element in one or both of these ways:

- By binding to a specific provider

- By specifying the message security requirements enforced by the provider

### Superelements

webservice-endpoint, port-info (`sun-web.xml`, `sun-ejb-jar.xml`, `sun-application-client.xml`)

### Subelements

The following table describes subelements for the `message-security-binding` element.

Table A–68 `message-security-binding` Subelements

Element | Required | Description
--- | --- | ---
message-security | zero or more | Specifies message security requirements.

### Attributes

The following table describes attributes for the `message-security-binding` element.

Table A–69 `message-security-binding` Attributes

Attribute | Default | Description
--- | --- | ---
`auth-layer` | none | Specifies the message layer at which authentication is performed. The value must be `SOAP`.
`provider-id` | none | (optional) Specifies the authentication provider used to satisfy application-specific message security requirements. If this attribute is not specified, a default provider is used, if it is defined for the message layer. if no default provider is defined, authentication requirements defined in the `message-security-binding` are not enforced.

- Previous: message-destination-name
- Next: message-security-config

- © 2010, Oracle Corporation and/or its affiliates