Web Services Policy (WS-Policy) is a standards-based framework for defining a Web services security constraints and requirements. It expresses security constraints and requirements in a collection of XML STATEMENTS called policies, each of which contains one or more assertions. In Oracle Service Bus, WS-Policy assertions are used to specify a Web services requirements for digital signatures and encryption, along with the security algorithms and authentication mechanisms that it requires.

WS-Policy policies MAY be included directly in a WSDL document or included by reference, and a WSDL document may import other WSDL documents that contain or refer to WS-Policy policies. An XML file that contains these policies can be used by multiple proxy services or business services.

The WebLogic Web Services runtime environment recognizes two types of WS-Policy statements:

•  Concrete WS-Policy statements: specify the security TOKENS that are used for authentication, encryption, and digital signatures. These WS-Policy statements are created if the type of authentication REQUIRED (such as using X.509 or SAML tokens), multiple private key and CERTIFICATE pairs from the keystore used for encryption and digital signatures, are known at run-time.
•  Abstract WS-Policy statements: that do not specify security tokens.

Web Services Policy (WS-Policy) is a standards-based framework for defining a Web services security constraints and requirements. It expresses security constraints and requirements in a collection of XML statements called policies, each of which contains one or more assertions. In Oracle Service Bus, WS-Policy assertions are used to specify a Web services requirements for digital signatures and encryption, along with the security algorithms and authentication mechanisms that it requires.

WS-Policy policies may be included directly in a WSDL document or included by reference, and a WSDL document may import other WSDL documents that contain or refer to WS-Policy policies. An XML file that contains these policies can be used by multiple proxy services or business services.

The WebLogic Web Services runtime environment recognizes two types of WS-Policy statements: