1 WS-Policy

2 What’s the Problem? To use a web service a client needs more information than is provided in WSDL file. Examples: –Does service support WS-Security? If so: What encryption algorithm does it expect (or prefer)? Must messages be signed? –What character encoding is used? –What version of SOAP is supported? A policy is a set of conditions expected by a service. WS-Policy provides an XML based declarative mechanism for expressing a policy that can be –integrated with WSDL or attached as a tModel in UDDI –enforced by web services infrastructure

3 Policy Expression A policy expression is a set of policy assertions A policy assertion expresses a specific characteristic of a service –Standard sets of assertions are defined (as schemas) –Others will be developed A policy subject is the resource described by a policy assertion A policy attachment binds an expression to a subject –Separate standard: WS-PolicyAttachment –Defines how to reference WS-Policy expressions from XML documents (e.g., WSDL, UDDI)

4 Policy Expression <wsp:Policy xmlns:wsp=“…policy ns…” xmlns:wsu=“…utility ns…” wsu:Id=“…URI …” Name=“…local_name…” targetNamespace=“target” > expression can be referred to with URI or as {target}local_name

5 Policy Assertion tag from a particular (presumably standard) assertion namespace attributes defined in WS-Policy possible values: -Required -Rejected -Optional -Others… if several alternatives are allowed, then preference is expressed as a number between 0 and 100 Extensibility: Policies in different areas will be standardized and introduced through unique namespaces

6 Example <wsp:Policy xmlns:wsp=“…wspolicy ns…” xmlns:wsse=“…securityPolicy ns…” > wsse:Kerberosv5ST standard for security policy is WS-SecurityPolicy assertions

7 Example <wsp:Policy xmlns:wsp=“…wspolicy ns…” xmlns:wsse=“…securityPolicy ns…” > wsse:Kerberosv5ST operators: All ExactlyOne OneOrMore (nesting allowed)

8 WS-PolicyAssertions Standard for general policy assertions: –Character encoding –Natural language –Specification version –Constraint on message structure Default is Xpath expression count(wsp:GetHeader(.)/wsse:Security) = 1 count(wsp:GetBody(.)/*) = 1 one security header block body has 1 child