Web Services security, or to be more precise, SOAP message security, identifies and provides solutions for general computer security threats as well as threats unique to Web services.
WSO2 Carbon supports WS Security, WS-Policy and WS-Security Policy specifications. These specifications define a behavioral model for Web services. A requirement for one Web service may not be valid for another. Thus defining service-specific requirements might be necessary.
The WSO2 SOA platform provides important security features to your service. By default, the security features are disabled. You should explicitly enable the security feature.
Understanding the exact security requirements should be the first step you should take when planning to secure your Web services. For an example, you may have to consider what security aspects are important to your service, whether it is the integrity, confidentiality, or both.
Figure 1: Enabling security
A list of available security scenarios is displayed. In addition to that, an option is provided to select a custom security policy from Registry.
Figure 2: Selecting Default Security Scenarios
Figure 3: Referring to a policy from Registry
Figure 4: Activate security - User Groups
Figure 5: Activate Security - Selecting Key Stores
If you are applying security scenario 16 (Kerberos Token based security) you have to associate your service with a service principal. Security scenario 16 is only applicable if you have a "Key Distribution Center (KDC)" and an "Authentication Server (AS)" in your environment. Commonly you can find KDC and an AS in a LDAP Directory server.
2 configuration files are used to specify Kerberos related parameters. They are,Usually above files are located at {server installation directory}/repository/conf directory.
After selecting scenario 16, you will be asked to fill information about service principal to associate web service with. There you need to specify service principal name and service principal password. Service principal must be already defined in the LDAP Directory server.
Following picture depicts this behavior,
Figure 6: Activate Security - Kerberos security policy
Figure 7: Activate Security - Custom policies
This function is used to disable Security from a particular service.
Note: All default security scenarios are described in the wizard.