WSPolicy(mixed policy)
Construct a new WSPolicy Object. Policy can be one of following.
1. xml string representing the corresponding policy.
2 dom node representing the corresponding policy.
3 array
Array of options can be specified using below syntax.
i) array("security"=>array of security options)
When using WSPolicy, user can use a policy xml file to configue the security options to be used. When the user has a policy file he can create a policy object using an xml string or dom node corresponding to that policy file. This is the encouraged senario. In addition to that, wsf4php security api provide the user to configure some minimum set of security features by using an options array that is accepted by WSPolicy constructor. Following is a description of the avalible options in the options array. Examples will be provided on policy files later in this document.
Option | Data Type | Value Domain | Default Value | Description |
---|---|---|---|---|
sign | string | boolean | TRUE | "X509" | FALSE |
Whether to sign the xml message or not.By default signing is not enabled.
If specified "sign"=>TRUE, the body part of the soap message will be signed using X509 Standard. The other avilable option is "Keberose". Signing will be done on the body part of the message. To sign the other parts of the message, a policy file should be used. |
encrypt | string | boolean |
TRUE | "X509"
|
FALSE |
Whether to encrypt the xml message or not. By default encryption is not enabled.
If specified "encrypt"=>TRUE, the body part of the soap message will be encrypted using X509 Standard. The other avilable option is "Keberose". Encrypting will be done on the body part of the message. To encrypt headers , policy file should be used. |
algorithmSuite | string |
corresponds to Security Policy spec 7.1 [Algorithm Suite] definitions
|
"Basic256Rsa15" | The symetric algorithm and asymetric algorithm will be derived from the algorithm using string. If AlgorithmSuit is not specified the default value "Basic256Rsa15" will be assumed. |
layout | string | "Strict" | "Lax" | "Strict" | These are defined in WS Security Policy Specification 1.1 section 7.7 |
includeTimestamp | bool | TRUE | FALSE | If specified TRUE and user provided the ttl (time to live ) value when providing security token object , timestamp will be used. |
protectionOrder | string | "EncryptBeforeSigning" | "SignBeforeEncrypt" | "EncryptBeforeSigning" | Order in which intergrity and confidentiality are applied to the message in cases where both intergrity and confidentiality are required. |
useUsernameToken | boolean | TRUE | FALSE | If the necessary options are provided with the WSSecurityToken object and "useUsernameToken"=>TRUE , then UsernameToken will be enabled. |
securityTokenReference | string |
"IssuerSerial" | "KeyIdentifier"|"EmbeddedToken"
|"Thumbprint"| "Direct" |
"Direct"
|
This option is common for both signing and encription.
If the user wishes to have other options he should provide the appropriate policy file. Direct Reference is treated as the default value. |
A PHP level object that logically represents security properties. This object will be used to specify the security properties from client
or service.
WSSecurityToken::__construct(array of options)
Options accepted in the message is specified below.
Option | Data Type | Value Domain | Default Value | Description |
---|---|---|---|---|
user | string | string | none | Username |
certificate | string | string | none | User's certificate for sign loaded from thr function get_cert_from_file() |
passwordType | string | "PlainText" |"Digest" | Digest | Password type used in username token |
password | string | users password used for username token | none | User's certificate for sign loaded from the function get_cert_from_file() |
privateKey | string | user's private key as a string | none | User private key loaded from the function get_key_from_file() |
receiverCertificate | string |
string |
none | Receiver's certificate for encrypt from the function get_cert_from_file() |
receiverCertificateFormat | string | certificate format extension PEM | PEM | Receiver's certificate format |
certificateFormat | string | certificate format extension PEM | PEM | user's certificate format |
privateKeyFormat | string |
key format extension PEM
|
PEM
|
Private key format
|
ttl
|
int
|
|
Time in milliseconds
|
|
password_callback | string | string | none | Name of the password callback function, which is a user defined function accepts the username and returns the password. |
Addtions to the WSClient
"policy"=>WSPolicy instance | array containing the incomming policy and outgoing policy as follows. "inpolicy"=>$policy , "outpolicy"=>$policy
"securityToken" => WSSecurityToken instance
Only a minimal set of securiy is processed as user options. For more complex senarios, user should provide the approriate policy file.
Example WS Security Policy File.
1] sample policy file.
<wsp:Policy
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">- <wsp:ExactlyOne>- <wsp:All>- <sp:AsymmetricBinding
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
">- <wsp:Policy>- <sp:InitiatorToken>- <wsp:Policy>- <sp:X509Token
sp:IncludeToken="*http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always
*">-
<wsp:Policy>
<sp:WssX509V3Token10 />
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:InitiatorToken>- <sp:RecipientToken>-
<wsp:Policy>-
<sp:X509Token sp:IncludeToken="*http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always*">-
<wsp:Policy>
<sp:WssX509V3Token10 />
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:RecipientToken>- <sp:AlgorithmSuite>-
<wsp:Policy>
<sp:Basic256Rsa15 />
</wsp:Policy>
</sp:AlgorithmSuite>- <sp:Layout>-
<wsp:Policy>
<sp:Strict />
</wsp:Policy>
</sp:Layout>
<sp:IncludeTimestamp />
<sp:EncryptBeforeSigning />
<sp:OnlySignEntireHeadersAndBody />
</wsp:Policy>
</sp:AsymmetricBinding>-
<sp:Wss10
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">- <wsp:Policy>
<sp:MustSupportRefIssuerSerial />
</wsp:Policy>
</sp:Wss10></wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>