OWSM Custom Assertion for OSB RESTful Proxy Service

Question

Hello,
I have implemented a Custom OWSM Assertion to authenticate requests with a custom token placed in a HTTP header. I can assign this assertion to a SOAP proxy service as a security policy. However I am not able to assign the very same policy to a Restful JSON service (Proxy service defined as messaging service with text message type). I am getting this error:
[OSB Kernel:398128]One of the Web service policy attached is not allowed on service default/RESTful because the service binding does not support it
My policy:
<wsp:Policy xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy"
    xmlns:custom="http://custom"
    orawsp:status="enabled"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" orawsp:category="security"
    orawsp:attachTo="binding.server" wsu:Id="http_customtoken_authentication_policy"
    xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
    wsp:Name="custom/http_customtoken_authentication_policy">
    <custom:customTokenHttpAuthentication
        orawsp:Silent="true" orawsp:Enforced="true"
        orawsp:name="Http custom token Authentication" orawsp:category="security/authentication" >
        <orawsp:bindings>
            <orawsp:Config orawsp:name="authenticationassertion"
                orawsp:configType="declarative">
                <orawsp:PropertySet orawsp:name="headerName">
                    <orawsp:Property orawsp:name="headerName"
                        orawsp:type="string" orawsp:contentType="constant">
                        <orawsp:Value>CustomToke</orawsp:Value>
                    </orawsp:Property>
                </orawsp:PropertySet>
            </orawsp:Config>
        </orawsp:bindings>
    </custom:customTokenHttpAuthentication>
</wsp:Policy>
My OSB version is OSB 11g PS6 and in this version, OWSM policies are supported for Restful services. Interesting is, that the built-in policy oracle/http_basic_auth_over_ssl_service_policy can be assigned to my Restful service. Do you know a solution for the problem, how can I assign my custom assertion to the Restful service? Anything special is needed in the policy definition?
Thanks.
Marian

Answer 1

Hi Vinoth,
The users/groups are picked up from the LDAP configured in Security Realms->myRealm->Providers
You basically have 2 options:
- You can configure your LDAP in Providers
- Use the DefaultAuthenticator that weblogic provides you by default.
If you do not want to configure an LDAP, and want to use weblogic's default, then all you have to do is add users and groups in Security Realms->myRealm->Users and Groups
Do mark this as useful or answered, if this has helped.