BPEL Security

Question

Hi,
In our environment, certain BPEL processes have been security enabled, by using the 'role' property in the bpel.xml and the relevant entries have been made into jazn-data.xml, message-handlers.xml and also when the right credentials are passed, the processes are instantiated correctly.
Problem we are facing is that, we are calling certain stub-processes and also some sub-BPEL processes from the main Process, asychoronously, and we have not enabled security for those processes, as they are called not from outside the BPEL, but from within BPEL processes.
These sub-BPELs also get instantiated correctly, however, when calling back the main Process, it is giving the security error as given below. Is there any configuration which can be set, so that security is not applied when calling sub-BPELs callbacks or what can be the solution for such situations.
Thanks for your help.
Thanks and Regards,
Vijay.
<remoteFault>
<part name="summary" >
<summary>when invoking locally the endpoint 'http://kmackie-pc2.peoplesoft.com:9700/orabpel/default/ROTelcoNewOrder/1.0/DynamicBillingSystem/BillingSystem_Requester', ; nested exception is: ORABPEL-02175 Error while invoking inbound message handler. An error has occurred while attempting to invoke the inbound message handler class "class com.collaxa.cube.security.Authenticator" for the message "". The exception reported was: Could not apply security [username = null] </summary>
</part>
<part name="detail" >
<detail>ORABPEL-02175 Error while invoking inbound message handler. An error has occurred while attempting to invoke the inbound message handler class "class com.collaxa.cube.security.Authenticator" for the message "". The exception reported was: Could not apply security [username = null] </detail>
</part>
</remoteFault>
-----------------------------------------------------------------------------------------------------------

Answer 1

Hi Clemens,
Is there a way to turn off the security authentication for the callback messages. We have secured the BPEL processes and we want the authentication to be done at the instantiation level ; but not at the receipt of call back messages. Is there any configuration setting that we could leverage of?
Regards,
Ravi