Page History

WS-Security is an extension to the SOAP standard which adds security related features to SOAP messages. This enables messages to be (partially) encrypted and decrypted, their content signed using a digital signature and/or timestamped, in order to guard against request tampering and replay attacks of SOAP messages. Blueriq provides support for this standard in both its exposed SOAP services (using Blueriq as a Service) and the AQ_SoapServiceClient service call, allowing you to achieve end-to-end security for all SOAP processing.

Configuration for AQ_SoapServiceClient

The configuration of AQ_SoapServiceClient allows for the exact same properties as documented above for BAAS webservices, however the request and response properties have been swapped.

Registering an interceptor

An interceptor has to be registered by name using properties, as follows:

blueriq.soap.interceptors.security.MyInterceptorName.request.encryption.enabled=false
blueriq.soap.interceptors.security.MyInterceptorName.request.signature.enabled=false
blueriq.soap.interceptors.security.MyInterceptorName.request.timestamp.enabled=false
blueriq.soap.interceptors.security.MyInterceptorName.response.accept-unsecured-messages=false
blueriq.soap.interceptors.security.MyInterceptorName.response.decryption.enabled=false
blueriq.soap.interceptors.security.MyInterceptorName.response.signature.enabled=false
blueriq.soap.interceptors.security.MyInterceptorName.response.timestamp.enabled=false

In the above example you can see how each WS-Security profile can be enabled/disabled. A profile is disabled by default, so the above enabled  properties are redundant and are only shown to clarify the configuration. Properties that are marked as

General properties

Encryption/Decryption

http://www.w3.org/2001/04/xmlenc#aes128-cbc

Signing

Timestamp

Anchor
keystore-configuration keystore-configuration

Keystore configuration

Since WS-Security is based on symmetric cryptography operations, a public/private key pair is used to encrypt/decrypt and to perform signing and signature validation. These keys have to be stored in a keystore in JKS format (Java KeyStore, .jks extension) or PKCS #12 format (.p12 extension) , which has to be configured as follows:

blueriq.security.keystore.location=file://client.jks
blueriq.security.keystore.password=

Anchor
parts-configuration parts-configuration

Parts configuration

Some WS-Security aspects can be applied to only a subset of the message. The relevant profiles provide a parts  property to configure this, which requires the following syntax:

• multiple part configurations must be separated by a semi-colon

• each value may be preceded by a mode specifier, either {Content} or {Element}. If not specified it defaults to {Content}

• the mode specifier may be followed by a namespace specifier. If omitted, it defaults to the SOAP namespace.

• the value must contain the name of the element which must be encrypted

For example, the value {Content}{http://example.org/paymentv2}CreditCard;{Element}{None}Username has the following meaning:

• the content of the CreditCard element in the http://example.org/paymentv2 namespace will be encrypted. The CreditCard element itself is not encrypted, so any attributes on this element will be in plain text 
• the Username element with no namespace is encrypted. The element itself is also encrypted, so any attributes will not be visible in plain text.