N/A

oracle/http_oam_token_service_template

No

No

Yes

No

No

oracle/http_saml20_token_bearer_client_template

oracle/http_saml20_token_bearer_service_template

No

No

Yes

Yes

No

oracle/http_spnego_token_client_template

oracle/http_spnego_token_service_template

No

No

Yes

Yes

No

oracle/wss_http_token_client_template

oracle/wss_http_token_service_template

Yes

No

No

No

No

oracle/wss_username_token_client_template

oracle/wss_username_token_service_template

No

Yes

No

No

No

oracle/wss10_saml_token_client_template

oracle/wss10_saml_token_service_template

No

Yes

No

No

No

oracle/wss10_saml20_token_client_template

oracle/wss10_saml20_token_service_template

No

Yes

No

No

No

oracle/wss11_kerberos_token_client_template

oracle/wss11_kerberos_token_service_template

No

Yes

No

No

No

oracle/http_oauth2_token_client_template

No

Yes

No

No

No

oracle/http_oauth2_token_over_ssl_client_template

-

No

Yes

No

No

No

oracle/oauth2_config_client_template

-

No

Yes

No

No

No

oracle/http_jwt_token_client_template

oracle/http_jwt_token_service_template

No

Yes

No

No

No

oracle/http_jwt_token_over_ssl_client_template

oracle/http_jwt_token_over_ssl_service_template

No

Yes

No

No

No

oracle/wss10_message_protection_client_template

oracle/wss10_message_protection_service_template

No

No

No

Yes

oracle/wss11_message_protection_client_template

oracle/wss11_message_protection_service_template

No

No

No

Yes

oracle/wss_http_token_over_ssl_client_template

oracle/wss_http_token_over_ssl_service_template

Yes

No

Yes

No

oracle/wss_saml_token_bearer_over_ssl_client_template

oracle/wss_saml_token_bearer_over_ssl_service_template

No

Yes

Yes

No

oracle/wss_saml20_token_bearer_over_ssl_client_template

oracle/wss_saml20_token_bearer_over_ssl_service_template

No

Yes

Yes

No

oracle/wss_saml_token_over_ssl_client_template

oracle/wss_saml_token_over_ssl_service_template

No

Yes

Yes

No

oracle/wss_saml20_token_over_ssl_client_template

oracle/wss_saml20_token_over_ssl_service_template

No

Yes

Yes

No

oracle/wss_username_token_over_ssl_client_template

oracle/wss_username_token_over_ssl_service_template

No

Yes

Yes

No

oracle/wss10_saml_hok_token_with_message_protection_client_template

oracle/wss10_saml_hok_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss10_saml_token_with_message_protection_client_template

oracle/wss10_saml_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss10_saml20_token_with_message_protection_client_template

oracle/wss10_saml20_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss10_username_token_with_message_protection_client_template

oracle/wss10_username_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss10_x509_token_with_message_protection_client_template

oracle/wss10_x509_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss11_kerberos_token_with_message_protection_client_template

oracle/wss11_kerberos_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss11_saml_token_with_message_protection_client_template

oracle/wss11_saml_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss11_saml20_token_with_message_protection_client_template

oracle/wss11_saml20_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss11_username_token_with_message_protection_client_template

oracle/wss11_username_token_with_message_protection_service_template

No

Yes

No

Yes

oracle/wss11_x509_token_with_message_protection_client_template

oracle/wss11_x509_token_with_message_protection_service_template

No

Yes

No

Yes

No

No

Yes

No

No

No

Yes

No

Authentication Header—Mechanism

Authentication mechanism.

Valid values include:

• basic—Client authenticates itself by transmitting the username and password.

  Note: It is recommended that you configure SSL when using basic authentication.

• cert—Not supported in this release. Client authenticates itself by transmitting a certificate.

• custom—Not supported in this release. Custom authentication mechanism.

• digest—Not supported in this release. Client authenticates itself by transmitting an encrypted password through the use of an MD5 digest.

• jwt—Client authenticates itself using JWT token.

• oam—Client authenticates itself using OAM agent.

• oauth2—Client authenticates using OAuth2 framework.

• saml20-bearer—Client authenticates itself using SAML 2.0 Bearer token.

• spnego—Client authenticates itself using Kerberos SPNEGO.

<orasp:auth-header 
  orasp:mechanism="oauth2"/>

Authentication Header—Header Name

Name of the authentication header.

None

Authentication Header—is-signed

Flag that specifies whether the token is signed.

<orasp:auth-header
orasp:is-signed="false"/>

Authentication Header— is encrypted

Flag that specifies whether the token is encrypted.

<orasp:auth-header
orasp:is-encrypted="false"/>														

audience.uri

Audience restriction. The following conditions are supported:

• If this property is not set, the service URL is used as the audience URI

• If this property is set to NONE (not case sensitive), then the audience URI is set to null.

• If this property is set to a value other than NONE, then the audience URI is set to this value.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="audience.uri" 
orawsp:type="string">
<orawsp:Value/>
<orawsp:DefaultValue>NONE</orawsp:DefaultValue>

authz.code

Optional property for passing the authorization code for the 3-legged OAuth2 use case. (Not supported in this release.)

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="authz.code" 
orawsp:type="string">
<orawsp:Value/>

csf-key

Credential store key that maps to a user name and password in the Oracle Platform Security Services (OPSS) identity store.

Default setting:

<orawsp:Property orawsp:type="string"
 orawsp:contentType="optional" orawsp:name="csf-key">
<orawsp:Value/>

csf.map

Oracle WSM map in the credential store that contains the CSF aliases.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="csf.map" orawsp:type="string"/>

You can override the default, domain-level Oracle WSM map, by specifying an application-level map name as a Value in this property. For example:

<orawsp:Property orawsp:contentType="optional"
   orawsp:name="csf.map" orawsp:type="string"/>
   <orawsp:Value>app-level-mapname.map</orawsp:Value>
</orawsp:Property>

Accessing an application-level map also requires granting credential access and identity permission to the wsm-agent-core.jar.

federated.client.token

Optional property which, by default, specifies that a JWT token is generated for the client using the values of the oauth2.client.csf.key and keystore.sig.csf.key properties.

If set to false, oauth2.client.csf.key is used to generate an Authorization header sent in the client request to the OAuth server.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="federated.client.token" 
orawsp:type="boolean">
<orawsp:Value/>
<orawsp:DefaultValue>true</orawsp:DefaultValue>

include.certificate

When true, the signature certificate and the trusted certificate chain (for CA-issued certificates) are included in JWT token claim. This increases the size of the JWT token, but you do not need to then import the certificate and certificate chain into the service side keystore.

When false, only the thumbprint and alias of the certificate are included in the JWT token.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="include.certificate"
orawsp:type="string">
<orawsp:Value/>
<orawsp:DefaultValue>false</orawsp:DefaultValue>
</orawsp:Property>

issuer.name

Optional property that specifies the issuer name used for the locally-generated JWT token (iss:claim). By default it is www.oracle.com.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="issuer.name" 
orawsp:type="string">
<orawsp:Value/>
<orawsp:DefaultValue>www.oracle.com</orawsp:DefaultValue>

keystore.sig.csf.key

Optional property that specifies the tenant key from the Oracle WSM keystore for signing the locally-created JWT token.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="keystore.sig.csf.key" 
orawsp:type="string">
<orawsp:Value/>

oauth2.client.csf.key

Required property that specifies the key to use to obtain the client username and password.

The value of oauth2.client.csf.key must match the client ID and secret expected by the client profile, as described in "Understanding OAuth Client Profiles Configuration" in Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

If federated.client.token is set to false, oauth2.client.csf.key is used to generate an Authorization header sent in the client request to the OAuth server.

If you override oauth2.client.csf.key, that value is used. Otherwise, the value of oauth2.client.csf.key in oauth2_config_client_policy is used.

Default setting:

<orawsp:Property orawsp:type="string"
orawsp:contentType="required"
orawsp:name="oauth2.client.csf.key">
<orawsp:Value/>
<orawsp:DefaultValue>NONE</orawsp:DefaultValue>
</orawsp:Property>

oracle.oauth2.service

Optional property that specifies how the default behavior of token issuer and scope are determined. When true, the client ID is used as the issuer of the user and client JWT token for the OAuth2 server. In this case, the value for issuer.name is ignored.

When false, the issuer is determined by issuer.name with the default value of "www.oracle.com".

propagate.identity.context

Optional property that specifies whether the identity context information is propagated as claims in the JWT token.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="propagate.identity.context" 
orawsp:type="string">
<orawsp:Value/>

redirect.uri

Optional property that specifies the redirect URIs that the OAuth server will use to redirect the user-agent to the client once access is granted or denied.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="redirect.uri" 
orawsp:type="string">
<orawsp:Value/>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="reference.priority" 
  orawsp:type="string"/>

scope

Optional property that specifies the scope (as-is) of the OAuth2 request. If present, the scope is included in the OAuth2 token request with the value.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="scope" orawsp:type="string">
<orawsp:Value/>

The scope depends on the value of the oracle.oauth2.service property:

• If oracle.oauth2.service is false (the default), the scope property determines the scope.

• If oracle.oauth2.service is true and scope has no value, (the default), the protocol, host and port (if available) are obtained from the service URL and used.

subject.precedence

Property that specifies the location from which the subject used to create the JWT token should be obtained.

As described in Table 10-2:

• If subject.precedence is set to true, the user name to create the JWT token is obtained only from the authenticated subject.

• If subject.precedence is set to false, the user name to create the JWT token is obtained only from the csf-key property.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="subject.precedence" orawsp:type="string">
  <orawsp:Value>true</orawsp:Value>
</orawsp:Property>

time.in.millis

Support standard NumericDate (seconds after Epoch as unit for values in exp (Expiry) and iat (Issued AT) claims in JWT token.

If true, then milliseconds after Epoch is used. Otherwise, seconds after Epoch is used.

Default setting:

<orawsp:Property orawsp:type="boolean"
 orawsp:contentType="optional"
 orawsp:name="time.in.millis">
<orawsp:Value/>
<orawsp:DefaultValue>true</orawsp:DefaultValue>
</orawsp:Property>

user.attributes

Optional property that specifies whether user attributes are inserted as claims in JWT token.

Specify the attributes to be included as a comma-separated list. For example, attrib1,attrib2. The attribute names you specify must exactly match valid attributes in the configured identity store. The Oracle WSM run time reads the values for these attributes from the configured identity store, and then includes the attributes and their values in the JWT token.

Requires that the Subject is available and subject.precedence is set to true.

A client policy reads the values of the attributes specified using user.attributes from the configured identity store. All valid attribute names and values are used to create JWT claims.

The user.attributes property is supported for a single identity store, and only the first identity store in the list is used. The user must therefore exist and be valid in the identity store used by the configured WebLogic Server Authentication provider. Authentication providers are described in "Configuring an Authentication Provider".

If the identity store you require is not the first identity store, you can specify that additional identity stores be searched. See "Including User Attributes in the Assertion"for more information.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="user.attributes" 
orawsp:type="string">
<orawsp:Value/>

user.roles.include

Optional property that specifies whether the user roles from the subject are included in the JWT token as claims. If set to true, the authenticated user roles are included in the JWT token as private claims.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="user.roles.include" 
orawsp:type="boolean">
<orawsp:Value/>
<orawsp:DefaultValue>false</orawsp:DefaultValue>

user.tenant.name

Reserved for internal use.

set.client.id

trusted.issuers

A comma-separated list of trusted issuers for an application that will override the trusted issuers defined at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional"  
  orawsp:name="saml.trusted.issuers" orawsp:type="string">
  <orawsp:Value/>
</orawsp:Property>

csf.map

Oracle WSM map in the credential store that contains the CSF aliases.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="csf.map" orawsp:type="string"/>

keystore.sig.csf.key

The alias and password used for storing the signature key password in the keystore. If specified, the key corresponding to this csf-key is fetched from the keystore and used for signing. This property allows you to specify the signature key on a per-attachment level instead of at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="keystore.sig.csf.key" orawsp:type="string"/>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="reference.priority" orawsp:type="string"/>

propagate.identity.context

Propagates the identity context from the Web service client to the Web service, and then makes it available ("publishes it") to other components for authentication and authorization purposes.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="propagate.identity.context" orawsp:type="string"><orawsp:Value/>

Authentication Header—Mechanism

Authentication mechanism.

Valid values include:

• basic—Client authenticates itself by transmitting the username and password.

  Note: It is recommended that you configure SSL when using basic authentication.

• cert—Not supported in this release. Client authenticates itself by transmitting a certificate.

• custom—Not supported in this release. Custom authentication mechanism.

• digest—Not supported in this release. Client authenticates itself by transmitting an encrypted password through the use of an MD5 digest.

• jwt—Client authenticates itself using JWT token.

• oam—Client authenticates itself using OAM agent.

• oauth2—Client authenticates using OAuth2 framework.

• saml20-bearer—Client authenticates itself using SAML 2.0 Bearer token.

• spnego—Client authenticates itself using Kerberos SPNEGO.

<orasp:auth-header 
  orasp:mechanism="oauth2"/>

Authentication Header—Header Name

Name of the authentication header.

None

Authentication Header—is-signed

Flag that specifies whether the token is signed.

<orasp:auth-header
orasp:is-signed="false"/>

Authentication Header— is encrypted

Flag that specifies whether the token is encrypted.

<orasp:auth-header
orasp:is-encrypted="false"/>

Transport Security

Flag that specifies whether SSL is enabled.

<orasp:auth-header
 orasp:require-tls/>

Transport Security—Mutual Authentication Required

Flag that specifies whether two-way authentication is required.

Valid values include:

• Enabled—The service must authenticate itself to the client, and the client must authenticate itself to the service.

• Disabled—One-way authentication is required. The service must authenticate itself to the client, but the client is not required to authenticate itself to the service.

<orasp:auth-header
  orasp:mutual-auth="false"/>

Transport Security—Include Timestamp

Flag that specifies whether to include a timestamp. A timestamp can be used to prevent replay attacks by identifying an expiration time after which the message is no longer valid.

<orasp:auth-header
orasp:include-timestamp="false"/>

csf.map

Oracle WSM map in the credential store that contains the CSF aliases.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="csf.map" orawsp:type="string"/>

keystore.sig.csf.key

The alias and password used for storing the signature key password in the keystore. If specified, the key corresponding to this csf-key is fetched from the keystore and used for signing. This property allows you to specify the signature key on a per-attachment level instead of at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="keystore.sig.csf.key" orawsp:type="string"/>

propagate.identity.context

Propagates the identity context from the Web service client to the Web service, and then makes it available ("publishes it") to other components for authentication and authorization purposes.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="propagate.identity.context" orawsp:type="string"><orawsp:Value/>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="reference.priority" orawsp:type="string"/>

trusted.issuers

A comma-separated list of trusted issuers for an application that will override the trusted issuers defined at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional"  
  orawsp:name="saml.trusted.issuers" orawsp:type="string">
  <orawsp:Value/>
</orawsp:Property>

token-uri

Required property that specifies the token endpoint of the OAuth2 server.

orasp:token-uri="http://host:port/tokens" 

oauth2.client.csf.key

Required property that specifies the key to use to obtain the client username and password.

The value of oauth2.client.csf.key must match the client ID and secret expected by the client profile, as described in "Understanding OAuth Client Profiles Configuration" in Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

Default setting:

<orawsp:Property orawsp:type="string"
orawsp:contentType="required"\
orawsp:name="oauth2.client.csf.key">
<orawsp:Value/>
<orawsp:DefaultValue>basic.client.credentials</orawsp:DefaultValue>
</orawsp:Property>

role

SOAP role.

Default setting:

<orawsp:Property orawsp:contentType="constant" 
  orawsp:name="role" orawsp:type="string">
  <orawsp:DefaultValue>
    ultimateReceiver
  </orawsp:DefaultValue>
</orawsp:Property>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
 orawsp:name="reference.priority" orawsp:type="string"/>

token.uri

Optional property to override the token-uri value.

Default setting:

<orawsp:Property orawsp:contentType="optional" orawsp:name="token.uri" orawsp:type="string"><orawsp:Value/><orawsp:DefaultValue>http://host:port/tokens
</orawsp:DefaultValue></orawsp:Property>

Authentication Header—Mechanism

Authentication mechanism.

Valid values include:

• basic—Client authenticates itself by transmitting the username and password.

  Note: It is recommended that you configure SSL when using basic authentication.

• cert—Not supported in this release. Client authenticates itself by transmitting a certificate.

• custom—Not supported in this release. Custom authentication mechanism.

• digest—Not supported in this release. Client authenticates itself by transmitting an encrypted password through the use of an MD5 digest.

• jwt—Client authenticates itself using JWT token.

• oam—Client authenticates itself using OAM agent.

• saml20-bearer—Client authenticates itself using SAML 2.0 Bearer token.

• spnego—Client authenticates itself using Kerberos SPNEGO.

<orasp:auth-header 
  orasp:mechanism="jwt"/>

Authentication Header—Header Name

Name of the authentication header.

None

Authentication Header—algorithm-suite

Algorithm suite used to sign the JWT token.

<orasp:auth-header
orasp:algorithm-suite="Basic256Sha256"/"

Authentication Header—is-signed

Flag that specifies whether the JWT token is signed. The only valid value for JWT policies is: true.

<orasp:auth-header
orasp:is-signed="true"/>

Authentication Header— is encrypted

Flag that specifies whether the JWT token is encrypted.

<orasp:auth-header
orasp:is-encrypted="false"/>

audience.uri

Audience restriction. The following conditions are supported:

• If this property is not set, the service URL is used as the audience URI

• If this property is set to NONE (not case sensitive), then the audience URI is set to null.

• If this property is set to a value other than NONE, then the audience URI is set to this value.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="audience.uri" orawsp:type="string">
  <orawsp:Value/>
</orawsp:Property>

csf-key

Credential Store Key that maps to a username and password in the Oracle Platform Security Services (OPSS) identity store.

Default setting:

<orawsp:Property orawsp:contentType="optional"
   orawsp:name="csf-key" orawsp:type="string">
   <orawsp:Value>basic.credentials</orawsp:Value>
</orawsp:Property>

csf.map

Oracle WSM map in the credential store that contains the CSF aliases.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="csf.map" orawsp:type="string"/>

issuer.name

Name of the JWT issuer. The default value is www.oracle.com.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="issuer.name" orawsp:type="string">
  <orawsp:Value>www.oracle.com</orawsp:Value>
</orawsp:Property>

keystore.sig.csf.key

The alias and password used for storing the signature key password in the keystore. If specified, the key corresponding to this csf-key is fetched from the keystore and used for signing. This property allows you to specify the signature key on a per-attachment level instead of at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="keystore.sig.csf.key" orawsp:type="string"/>

propagate.identity.context

Propagates the identity context from the Web service client to the Web service, and then makes it available ("publishes it") to other components for authentication and authorization purposes.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="propagate.identity.context" orawsp:type="string"><orawsp:Value/>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="reference.priority" orawsp:type="string"/>

subject.precedence

Property that specifies the location from which the subject used to create the JWT token should be obtained.

If subject.precedence is set to true, the user name to create the JWT token is obtained only from the authenticated Subject. If subject.precedence is set to false, the user name to create the JWT token is obtained only from the csf-key username property.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="subject.precedence" orawsp:type="string">
  <orawsp:Value>true</orawsp:Value>
</orawsp:Property>

user.attributes

List of user attributes for the authenticated user to be included in the JWT token.

Specify the attributes to be included as a comma-separated list. For example, attrib1,attrib2. The attribute names you specify must exactly match valid attributes in the configured identity store. The Oracle WSM run time reads the values for these attributes from the configured identity store, and then includes the attributes and their values in the JWT token.

Requires that the Subject is available and subject.precedence is set to true.

A client policy reads the values of the attributes specified using user.attributes from the configured identity store. All valid attribute names and values are used to create JWT claims.

The user.attributes property is supported for a single identity store, and only the first identity store in the list is used. The user must therefore exist and be valid in the identity store used by the configured WebLogic Server Authentication provider. Authentication providers are described in "Configuring an Authentication Provider".

If the identity store you require is not the first identity store, you can specify that additional identity stores be searched. See "Including User Attributes in the Assertion" for more information.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="user.attributes" orawsp:type="string"/>

user.roles.include

User roles to be included in the JWT token. If set to true, the authenticated user roles are included in the JWT token as private claims. The default is false.

Default setting:

<orawsp:Property orawsp:contentType="optional"   
  orawsp:name="user.roles.include" orawsp:type="string">
  <orawsp:Value>false</orawsp:Value>
</orawsp:Property>

user.tenant.name

Reserved for internal use.

Authentication Header—Mechanism

Authentication mechanism.

Valid values include:

• basic—Client authenticates itself by transmitting the username and password.

  Note: It is recommended that you configure SSL when using basic authentication.

• cert—Not supported in this release. Client authenticates itself by transmitting a certificate.

• custom—Not supported in this release. Custom authentication mechanism.

• digest—Not supported in this release. Client authenticates itself by transmitting an encrypted password through the use of an MD5 digest.

• jwt—Client authenticates itself using JWT token.

• oam—Client authenticates itself using OAM agent.

• saml20-bearer—Client authenticates itself using SAML 2.0 Bearer token.

• spnego—Client authenticates itself using Kerberos SPNEGO.

<orasp:auth-header 
  orasp:mechanism="jwt"/>

Authentication Header—Header Name

Name of the authentication header.

None

Authentication Header—algorithm-suite

Flag that specifies the algorithm suite used to sign the JWT token.

<orasp:auth-header
orasp:algorithm-suite="Basic256Sha256"/"

Authentication Header—is-signed

Flag that specifies whether the JWT token is signed. The only valid value for JWT policies is: true.

<orasp:auth-header
orasp:is-signed="true"/>

Authentication Header— is encrypted

Flag that specifies whether the JWT token is encrypted.

<orasp:auth-header
orasp:is-encrypted="false"/>

Transport Security

Flag that specifies whether SSL is enabled.

<orasp:auth-header
 orasp:require-tls/>

Transport Security—Mutual Authentication Required

Flag that specifies whether two-way authentication is required.

Valid values include:

• Enabled—The service must authenticate itself to the client, and the client must authenticate itself to the service.

• Disabled—One-way authentication is required. The service must authenticate itself to the client, but the client is not required to authenticate itself to the service.

<orasp:auth-header
  orasp:mutual-auth="false"/>

Transport Security—Include Timestamp

Flag that specifies whether to include a timestamp. A timestamp can be used to prevent replay attacks by identifying an expiration time after which the message is no longer valid.

<orasp:auth-header
orasp:include-timestamp="false"/>

audience.uri

Audience restriction. The following conditions are supported:

• If this property is not set, the service URL is used as the audience URI

• If this property is set to NONE (not case sensitive), then the audience URI is set to null.

• If this property is set to a value other than NONE, then the audience URI is set to this value.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="audience.uri" orawsp:type="string">
  <orawsp:Value/>
</orawsp:Property>

csf.map

Oracle WSM map in the credential store that contains the CSF aliases.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="csf.map" orawsp:type="string"/>

csf-key

Credential Store Key that maps to a username and password in the Oracle Platform Security Services (OPSS) identity store.

Default setting:

<orawsp:Property orawsp:contentType="optional"
   orawsp:name="csf-key" orawsp:type="string">
   <orawsp:Value>basic.credentials</orawsp:Value>
</orawsp:Property>

issuer.name

Name of the JWT issuer. The default value is www.oracle.com.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="issuer.name" orawsp:type="string">
  <orawsp:Value>www.oracle.com</orawsp:Value>
</orawsp:Property>

keystore.sig.csf.key

The alias and password used for storing the signature key password in the keystore. If specified, the key corresponding to this csf-key is fetched from the keystore and used for signing. This property allows you to specify the signature key on a per-attachment level instead of at the domain level.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="keystore.sig.csf.key" orawsp:type="string"/>

propagate.identity.context

Propagates the identity context from the Web service client to the Web service, and then makes it available ("publishes it") to other components for authentication and authorization purposes.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="propagate.identity.context" orawsp:type="string"><orawsp:Value/>

reference.priority

Optional property that specifies the priority of the policy attachment. When specified for an attached policy, the effective set of policies algorithm allows the policy with the highest integer value priority to take precedence over a conflicting policy attachment, irrespective of its scope.

The value of reference.priority can be any number between(-2³¹) and (2³¹ - 1). The higher the number, the higher the priority assigned during effective policy calculation. Any policy that does not have a value or a non-numeric value is treated as having a value of 0. If the value is set to any of the words "yes", "true", or "on", the value is set to 1.

For more information, see "Specifying the Priority of a Policy Attachment".

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="reference.priority" orawsp:type="string"/>

subject.precedence

Property that specifies the location from which the subject used to create the JWT token should be obtained.

If subject.precedence is set to true, the user name to create the JWT token is obtained only from the authenticated Subject. If subject.precedence is set to false, the user name to create the JWT token is obtained only from the csf-key username property.

Default setting:

<orawsp:Property orawsp:contentType="optional" 
  orawsp:name="subject.precedence" orawsp:type="string">
  <orawsp:Value>true</orawsp:Value>
</orawsp:Property>

user.attributes

List of user attributes for the authenticated user to be included in the JWT token.

Specify the attributes to be included as a comma-separated list. For example, attrib1,attrib2. The attribute names you specify must exactly match valid attributes in the configured identity store. The Oracle WSM run time reads the values for these attributes from the configured identity store, and then includes the attributes and their values in the JWT token.

Requires that the Subject is available and subject.precedence is set to true.

A client policy reads the values of the attributes specified using user.attributes from the configured identity store. All valid attribute names and values are used to create JWT claims.

The user.attributes property is supported for a single identity store, and only the first identity store in the list is used. The user must therefore exist and be valid in the identity store used by the configured WebLogic Server Authentication provider. Authentication providers are described in "Configuring an Authentication Provider".

If the identity store you require is not the first identity store, you can specify that additional identity stores be searched. See "Including User Attributes in the Assertion" for more information.

Default setting:

<orawsp:Property orawsp:contentType="optional"
 orawsp:name="user.attributes" orawsp:type="string"/>

user.roles.include

User roles to be included in the JWT token. If set to true, the authenticated user roles are included in the JWT token as private claims. The default is false.

Default setting:

<orawsp:Property orawsp:contentType="optional"   
  orawsp:name="user.roles.include" orawsp:type="string">
  <orawsp:Value>false</orawsp:Value>
</orawsp:Property>

user.tenant.name

Reserved for use internal use.