When building the custom assertion executor, ensure that the following JAR files are in your CLASSPATH:

• wsm-policy-core.jar

• wsm-agent-core.jar

• oracle.logging-utils_11.1.1.jar (located at oracle_common/modules/oracle.wsm.common_12.1.2, oracle_common/modules/oracle.wsm.common_12.1.2, and oracle_common/modules respectively)

If necessary, add these files to your CLASSPATH.

The following example shows a custom assertion executor that you can use to validate the IP address of the request to the web service. If the IP address of the request is invalid, a FAULT_FAILED_CHECK exception is thrown.

package sampleassertion;

import oracle.wsm.common.sdk.IContext; 
import oracle.wsm.common.sdk.IMessageContext; 
import oracle.wsm.common.sdk.IResult; 
import oracle.wsm.common.sdk.Result; 
import oracle.wsm.common.sdk.WSMException; 
import oracle.wsm.policy.model.IAssertionBindings; 
import oracle.wsm.policy.model.IConfig; 
import oracle.wsm.policy.model.IPropertySet; 
import oracle.wsm.policy.model.ISimpleOracleAssertion; 
import oracle.wsm.policy.model.impl.SimpleAssertion; 
import oracle.wsm.policyengine.impl.AssertionExecutor; 

public class IpAssertionExecutor extends AssertionExecutor { 
    public IpAssertionExecutor() { 
    } 
    public void destroy() { 
    } 

    public void init(oracle.wsm.policy.model.IAssertion assertion,
                     oracle.wsm.policyengine.IExecutionContext econtext,
                     oracle.wsm.common.sdk.IContext context) { 
        this.assertion = assertion; 
        this.econtext = econtext; 
    } 
    public oracle.wsm.policyengine.IExecutionContext getExecutionContext() { 
        return this.econtext; 
    } 
    public boolean isAssertionEnabled() { 
        return ((ISimpleOracleAssertion)this.assertion).isEnforced(); 
    } 
    public String getAssertionName() { 
        return this.assertion.getQName().toString();
    } 

    /** 
     * @param context 
     * @return 
     */ 
    public IResult execute(IContext context) throws WSMException { 
        try { 
            IAssertionBindings bindings = 
                ((SimpleAssertion)(this.assertion)).getBindings(); 
            IConfig config = bindings.getConfigs().get(0); 
            IPropertySet propertyset = config.getPropertySets().get(0); 
            String valid_ips = 
                propertyset.getPropertyByName("valid_ips").getValue(); 
            String ipAddr = ((IMessageContext)context).getRemoteAddr(); 
            IResult result = new Result();
            if (valid_ips != null && valid_ips.trim().length() > 0) { 
                String[] valid_ips_array = valid_ips.split(","); 
                boolean isPresent = false; 
                for (String valid_ip : valid_ips_array) { 
                    if (ipAddr.equals(valid_ip.trim())) { 
                        isPresent = true; 
                    } 
                } 
                if (isPresent) { 
                    result.setStatus(IResult.SUCCEEDED); 
                } else { 
                  result.setStatus(IResult.FAILED); 
                  result.setFault(new WSMException(WSMException.FAULT_FAILED_CHECK)); 
                } 
            } else { 
                result.setStatus(IResult.SUCCEEDED); 
            } 
            return result;
        } catch (Exception e) { 
            throw new WSMException(WSMException.FAULT_FAILED_CHECK, e); 
        } 
    } 

    public oracle.wsm.common.sdk.IResult postExecute(oracle.wsm.common.sdk.IContext p1) {
        IResult result = new Result(); 
        result.setStatus(IResult.SUCCEEDED); 
        return result; 
    } 
}

You can run the following sample code, to determine client or service inside custom assertion executor.

String function = (String) getExecutionContext().getProperty("agent.function"); // WSMExecutionConstants.AGENT_FUNCTION
if (function != null)
isService = function.equals("agent.function.service") // WSMExecutionConstants.AGENT_FUNCTION_VAL_SERVICE

For more information about the APIs that are available to you for developing your own custom assertion executor, see the Java API Reference for Oracle Web Services Manager.

Custom Assertions Schema Reference describes the schema that you can use to construct your custom policy file and custom assertion.

The following example defines the oracle/ip_assertion_policy custom policy file. The assertion defines a comma-separated list of IP addresses that are valid for a request.

<?xml version = '1.0' encoding = 'UTF-8'?>
 
<wsp:Policy xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy" 
   xmlns:orasp="http://schemas.oracle.com/ws/2006/01/securitypolicy"
   orawsp:status="enabled" 
   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" orawsp:category="security" 
   orawsp:attachTo="binding.server" wsu:Id="ip_assertion_policy"
   xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" 
   xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
   wsp:Name="oracle/ip_assertion_policy">
      <orasp:ipAssertion orawsp:Silent="true" orawsp:Enforced="true" 
         orawsp:name="WSSecurity IpAssertion Validator" orawsp:category="security/authentication">
            <orawsp:bindings>
                  <orawsp:Config orawsp:name="ipassertion" orawsp:configType="declarative">
                        <orawsp:PropertySet orawsp:name="valid_ips">
                              <orawsp:Property orawsp:name="valid_ips" orawsp:type="string" 
                               orawsp:contentType="constant">
                                    <orawsp:Value>127.0.0.1,192.168.1.1</orawsp:Value>
                              </orawsp:Property>
                        </orawsp:PropertySet>
                   </orawsp:Config>
             </orawsp:bindings>
      </orasp:ipAssertion>
</wsp:Policy>

To use this custom policy file with a RESTful web service and client endpoints, you must add the provides attribute to the orasp:ipAssertion element, as follows:

<orasp:ipAssertion orawsp:Silent="true" orawsp:Enforced="true"
    orawsp:name="WSSecurity IpAssertion Validator"
    orawsp:category="security/authentication"
    orawsp:provides="{http://schemas.oracle.com/ws/2006/01/policy}REST_HTTP">
</orasp:ipAssertion>

The following topics explain this further:

• Specifying the Custom Assertion Executor in the Custom Policy File

• Specifying the Custom Assertion Executor in the policy-config.xml File

You can use Oracle JDeveloper, other IDE, or the jar tool to generate the JAR file.

Perform the following steps to deploy custom assertion using the WLST command:

1. Invoke the WLST command located at ORACLE_HOME/oracle_common/common/bin/wlst.sh (UNIX) or ORACLE_HOME\oracle_common\common\bin\wlst.cmd (Windows).

2. Run the appendToExtensionLoader command to add the custom assertion jar to servers specified by target list:

   appendToExtensionLoader('path to custom-assertion.jar’, ‘comma separated targets')

   For example:

   connect('demouser', 'demopassword', 't3://localhost:7001')  
   appendToExtensionLoader(‘/user/home/customAssertion.jar’, ‘server1,server2,server3')

You can also add the custom assertion JAR manually to your CLASSPATH by performing the following steps:

For information about starting and stopping WebLogic Server, see Starting and Stopping Oracle WebLogic Server Instances in Administering Oracle Fusion Middleware.

Create a web service using the information described in "Roadmap for Implementing WebLogic Web Services" in Understanding WebLogic Web Services for Oracle WebLogic Server.

Attach the custom policy to the web service, as described in "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.