ADF Mobile - Securing REST Web Services

Question

Hi,
I've developed some REST web services for my ADF Mobile app to use. They work fine but I'm having trouble securing them. According to the developer guide:
http://docs.oracle.com/cd/E35521_01/doc.111230/e24475/amxwebservices.htm#CHDGFCGD
10.5.2 How to Enable Access to REST-Based Web Services
Since only one security policy is supported for REST-based web services, ADF Mobile automatically adds oracle/wss_http_token_over_ssl_client_policy for REST web service over HTTPS, or oracle/wss_http_token_client_policy for REST web service over HTTP protocol to enable Oracle Web Services Manager (OWSM) Lite Mobile ADF Application Agent to inject a proper security header.
..so I'm trying to attach the policy oracle/wss_http_token_service_policy to the web service, but deploying it to Weblogic results in the below stack trace.
I'm trying to attach the policy in JDeveloper by selecting the service class in the java structure pane, then in the Property Inspector, using the "Web Services extension" section to select the policy.
I'm guessing I've missed a step, but can't find what. Or I'm doing completely the wrong thing. Either way, any help in resolving would be very much appreciated.
Rich.
weblogic.application.ModuleException: [HTTP:101216]Servlet: "CDRestServicePort" failed to preload on startup in Web application: "RestServices".
javax.xml.rpc.JAXRPCException: oracle.wsm.common.sdk.WSMException: WSM-07508 : Oracle WSM Agent initialization failed due to PolicySet validation errors: WSM-07617 Policy: oracle/wss_http_token_service_policy contains unsupported assertions. 
, with PolicySet=PolicySet [timestamp=Mon Oct 21 13:53:23 BST 2013, subjectPattern=ResourcePattern [pattern=/DefaultDomain/DefaultServer/SOAPServices/WEBs/RestServices.war/WLSWEBSERVICEs/CDRestServiceService/PORTs/CDRestServicePort, subjectType=WLS_SERVICE, terms={PORT=CDRestServicePort, IMPLEMENTATION=WEB, SUBJECT_TYPE=WLS_SERVICE, SERVICE=CDRestServiceService, MODULE=RestServices.war, APPLICATION=SOAPServices, DOMAIN=DefaultDomain, SERVER=DefaultServer}], domainExpression=http://restws.westbourne/#wsdl.endpoint(CDRestServiceService/CDRestServicePort), polmap={oracle/wss_http_token_service_policy={Policy[wsp:http://schemas.xmlsoap.org/ws/2004/09/policy][oralgp:http://schemas.oracle.com/ws/2006/01/loggingpolicy][local-optimization:off][provides:{http://docs.oasis-open.org/ns/opencsa/sca/200903}authentication, {http://docs.oasis-open.org/ns/opencsa/sca/200903}clientAuthentication, {http://docs.oasis-open.org/ns/opencsa/sca/200903}clientAuthentication.transport][status:enabled][xmlns:http://schemas.xmlsoap.org/ws/2004/09/policy][wsu:http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd][Id:wss_http_token_service_policy][displayName:i18n:oracle.wsm.resources.policydescription.PolicyDescriptionBundle_oracle/wss_http_token_service_policy_PolyDispNameKey][orawsp:http://schemas.oracle.com/ws/2006/01/policy][orasp:http://schemas.oracle.com/ws/2006/01/securitypolicy][description:i18n:oracle.wsm.resources.policydescription.PolicyDescriptionBundle_oracle/wss_http_token_service_policy_PolyDescKey][attachTo:binding.server][Name:oracle/wss_http_token_service_policy][xsi:http://www.w3.org/2001/XMLSchema-instance][category:security][{LogAssertion[Logging][{AssertionBindings[{Config[name:Log Message1_properties][{PropertySet[name:standard-security-properties][{Property[type:string][contentType:optional][name:reference.priority]}]}]}]}][{MessageLog[ Request = all][ Response =all]}]}][{HttpSecurityScenario[http-security][Silent:true][name:Http Security][Enforced:true][category:security/authentication][{AssertionBindings[{Config[name:HttpConfig][configType:declarative][{PropertySet[name:standard-security-properties][{Property[type:string][contentType:constant][name:realm][Value:owsm]}][{Property[type:string][contentType:constant][name:role][Value:ultimateReceiver]}][{Property[type:string][contentType:optional][name:reference.priority]}]}]}]}]}][{LogAssertion[Logging][{AssertionBindings[{Config[name:Log Message2_properties][{PropertySet[name:standard-security-properties][{Property[type:string][contentType:optional][name:reference.priority]}]}]}]}][{MessageLog[ Request = all][ Response =all]}]}]}}}, constraintedDataMap={ConstraintGroup [terms=[], size=0, weight=0]=ConstraintedData [status=FAILURE, localoptimization=null, validationErrors=[Error Code:WSM-07617 Error Context:Policy], overrides=[], polRefs=[PolicyReference [policyURI=oracle/wss_http_token_service_policy, polRefQName={http://schemas.xmlsoap.org/ws/2004/09/policy}PolicyReference, version=-1, attributes={{http://schemas.oracle.com/ws/2006/01/policy}status=enabled, {http://schemas.oracle.com/ws/2006/01/policy}category=security}, overrideProps=null]]]}, locked=true]
  at oracle.wsm.agent.handler.wls.WSMAgentHook.handleException(WSMAgentHook.java:462)
  at oracle.wsm.agent.handler.wls.WSMAgentHook.init(WSMAgentHook.java:274)
  at weblogic.wsee.jaxws.framework.jaxrpc.TubeFactory.newHandler(TubeFactory.java:108)
  at weblogic.wsee.jaxws.framework.jaxrpc.TubeFactory.createServer(TubeFactory.java:81)
  at weblogic.wsee.jaxws.WLSTubelineAssemblerFactory$TubelineAssemblerImpl.createServer(WLSTubelineAssemblerFactory.java:216)
  at com.sun.xml.ws.server.WSEndpointImpl.<init>(WSEndpointImpl.java:213)
  at weblogic.wsee.jaxws.WLSContainer$WLSEndpointFactory$WLSEndpointImpl.<init>(WLSContainer.java:623)

Answer 1

Hi,
so have you "Oracle Web Services Manager (OWSM) Lite Mobile ADF Application Agent" installed? Sounds this is a pre-requisite for this work
Frank