Sun Java System Application Server Platform Edition 8.1 2005Q2 Update 2 Administration Guide

- Previous: Auditing Authentication and Authorization Decisions
- Next: Understanding Users, Groups, Roles, and Realms

### Configuring Message Security

Message Security enables a server to perform end-to-end authentication of web service invocations and responses at the message layer. The Application Server implements message security using message security providers on the SOAP layer. The message security providers provide information such as the type of authentication that is required for the request and response messages. The types of authentication that are supported include the following:

- Sender authentication, including username-password authentication.

- Content authentication, including XML Digital Signatures.

Two message security providers are included with this release. The message security providers can be configured for authentication for the SOAP layer. The providers that can be configured include `ClientProvider` and `ServerProvider`.

Support for message layer security is integrated into the Application Server and its client containers in the form of (pluggable) authentication modules. By default, message layer security is disabled on the Application Server.

Message level security can be configured for the entire Application Server or for specific applications or methods. Configuring message security at the Application Server level is discussed in Overview of Security Chapter 10, Configuring Message Security. Configuring message security at the application level is discussed in the Developer’s Guide chapter titled Securing Applications.

See Also:

- Configuring the Application Server for Message Security

- Securing a Web Service

- To enable providers for message security

- To configure a message security provider

- Creating a Message Security Provider

- To delete a message security configuration

- To delete a message security provider

- To enable message security for application clients

- Previous: Auditing Authentication and Authorization Decisions
- Next: Understanding Users, Groups, Roles, and Realms

- © 2010, Oracle Corporation and/or its affiliates