The Web Services Secure Conversation Language (WS-SecureConversation) specification defines extensions that build on Web Services Security (WS-Security) 1.1 and 1.0 and Web Services Trust Language (WS-Trust) to provide secure communication across one or more messages. Specifically, this specification defines mechanisms for establishing and sharing security contexts, and deriving keys from established security contexts (or any shared secret).

Link to the specification document: http://docs.oasis-open.org/ws-sx/ws-secureconversation/v1.4/os/ws-secureconversation-1.4-spec-os.doc

A particularly important use of WS-SecureConversation is to provide security for WS-ReliableMessaging (WS-RM) policies, as described in "Using WS-SecureConversation With WS-ReliableMessaging" in Understanding Oracle Web Services Manager. When you attach both a WS-SecureConversation policy and a WS-RM policy, the WS-RM policy benefits from the use of secure conversation to prevent sequence attacks.

You can also attach a WS-SecureConversation policy to an asynchronous web service either with or without a WS-RM policy. The following combinations are possible:

• WS-RM policy and a WS-SecureConversation policy

• Asynchronous web service, a WS-RM policy, and a WS-SecureConversation policy

For more information on secure conversation and when you might want to use it, see "Understanding Secure Conversation" in Understanding Oracle Web Services Manager.

In most cases, you do not need to perform any WS-SecureConversation-specific configuration other than creating a policy and enabling secure conversation.

If you use the preconfigured WS-SecureConversation policies described in OWSM Policies Supported for WS-SecureConversation, WS-SecureConversation is already enabled. All of the other configuration that is needed is the same as for the policy without WS-SecureConversation.

If you configure WS-SecureConversation, you must configure it for both the web service and client policies. This is because the OWSM client and server agents participate in the handshake process to establish the Security Context Token (SCT) used to secure the conversation. The OWSM client sends the RST (Request Security Token) to the service, which then returns the RSTR (Request Security Token Response) containing the SCT.

The OWSM security policies described in OWSM Policies Supported for WS-SecureConversation, include a configuration setting that allows you to enable and configure WS-SecureConversation for that policy. You may find that using these preconfigured policies makes your security tasks easier to view at a glance and manage.

In addition, policies based on many of the predefined assertion templates also support WS-SecureConversation. See Oracle Web Services Manager Predefined Assertion Templates for additional information.

This section contains the following topics:

• Configuring Secure Conversation Using Fusion Middleware Control

• Configuring Secure Conversation Using WLST

You can attach a WS-SecureConversation policy at design time by using the annotations API.

@PortableWebService 
@oracle.webservices.annotations.SecurityPolicy(
"oracle/wss11_username_token_with_message_protection_wssc_service_policy")
 
public class TestService { 
 
...... } 

@PortableWebService 
@PolicySet(references=
{@PolicyReference(value="oracle/wss11_username_token_with_message_protection_wssc_service_policy"), 
  @PolicyReference(value="oracle/wsrm11_policy")
}) 
 
public class TestService { 
 
...... } 

Each client and web service can specify one or more (one per port) persistence providers, which can be either the Coherence provider or the in-memory provider.

For more information, see "Persistence" in Understanding Oracle Web Services Manager.

This section contains the following topics:

• Overview of Persistence

• Configuring Persistence for a Web Service

• Configuring Persistence for a Client

OWSM maintains the client and server secure conversation session information based on a computed Session ID. OWSM (via an internal session mechanism) computes the Session ID at runtime for each message, and associates one or more requests to a session.

This is described in "WS-SecureConversation Architecture".

The session ID is generally reused if:

• A subsequent request comes from the same client and the session ID has not already been freed. (If the session ID has already been freed, a new session ID is created.)

• The sc.token.lifetime property has not expired.

Once created, Secure Conversation session ID's are not removed automatically until the underlying Java virtual machine used to start the WebLogic Server instance shuts down.

The session management WLST commands provide a way for you to free up the session ID's on the server in the following situations:

• You detect any issue with server performance and you want to free up the resources on the server.

• The SCT token has expired. There is an expiration time displayed by the getWebServiceSessionInfo() command. If the SCT token has expired, you can remove the session ID.

OWSM provides the following WLST commands that you can use to manage Secure Conversation sessions.

• listWebServiceSessionNames() — Lists the names of all sessions visible within the instance of a running server. The returned names are appropriate for use as the name parameter in subsequent calls to getWebServiceSessionInfo(String) and removeWebServiceSession(String) commands.

  For example:

  wls:/base_domain/serverConfig> listWebServiceSessionNames()
  215d0d4a5ebbc3fec662f46adedc5bc74ecbc87b
  

• getWebServiceSessionInfo() — Given a session name, get a data object representing current information for that session. The returned information is as follows.

  • name

  • creation time

  • last update time

  • expiration time

  • KeyInfo[] user-defined keys, where KeyInfo is keyName and keyValue.

    For example:

    wls:/base_domain/serverConfig>
    getWebServiceSessionInfo('215d0d4a5ebbc3fec662f46adedc5bc74ecbc87b')
    Name: 215d0d4a5ebbc3fec662f46adedc5bc74ecbc87b
    Creation time: Mon Nov 04 17:47:39 PST 2013
    Last update time: Mon Nov 04 17:47:42 PST 2013
    Expiration time: Mon Nov 04 18:17:41 PST 2013
    Key info: [oracle.wsm.security.secconv.util.property.SCT, 0x0000014225F1A1260AE4F30351FD1544DC10ED14201988C8CFEDFDBE8E0E4B09
    ]

• listWebServiceSessionNamesForKey() — Lists the names of all sessions identified by keyName and keyValue.

  The returned names are appropriate for use as the name parameter in subsequent calls to getWebServiceSessionInfo(String) and removeWebServiceSession(String) commands.

  For example:

  wls:/base_domain/serverConfig>
  listWebServiceSessionNamesForKey('oracle.wsm.security.secconv.util.property.SCT',
  '0x0000014225F1A1260AE4F30351FD1544DC10ED14201988C8CFEDFDBE8E0E4B09')
  215d0d4a5ebbc3fec662f46adedc5bc74ecbc87b
  

• removeWebServiceSession() — Given a session name, removes the session object associated with that session name.

  For example:

  wls:/base_domain/serverConfig>
  removeWebServiceSession('215d0d4a5ebbc3fec662f46adedc5bc74ecbc87b')
  

For more information about the WLST commands and their arguments, see "Session Management WLST Commands" in WLST Command Reference for WebLogic Server.