WS-Security, WS-Policy, WS-Trust, etc ... Supported Versions??

Question

Can anyone please point me to the Oracle documentation that details the current supported technology versions for WS-Security, WS-Policy, WS-Trust??

Answer 1

We use WS-Security on SOA 10.1.3.3.0 - the UsernameToken part. But be aware, that UsernameToken is only supported for request messages (calls made to bpel) and not responses. UsernameToken propagation to other web services/processes is possible.
But BPEL can't cope with UsernameToken in SOAP response message if for example you call oc4j web service from bpel. Unfortunately when you enable WS-Security UsernameToken in JDeveloper, it enables it for both output and input messages (then you get mustunderstand error). You have to manually remove <outbound> element from oracle-webservices.xml for it to work after you regenerate your web service.
JDeveloper or BPEL can't generate WS-Policy assertions for WSDL. If you don't know what I mean have a look at generated wsdl with WS-Security in glassfish V2. This means you can't enable WS-Security for web service clients in other IDEs than JDeveloper. But theoretically you can add these WS-Policy assertions to the wsdl yourself or write a WsseMessageHandler implementing SOAPHandler and then adding it to JAX-WS handler chain.