WS Security API

Predefined Classes For WS Security

WSPolicy

Constructor

WSPolicy(mixed policy)

Construct a new WSPolicy Object. Policy can be one of following.

  1. xml string representing the corresponding policy.

  2 dom node representing the corresponding policy.

  3 array
     Array of options can be specified using below syntax.
      i) array("security"=>array of security options)
    

When using WSPolicy, user can use a policy xml file to configue the security options to be used. When the user has a policy file he can create a policy object using an xml string or dom node corresponding to that policy file. This is the encouraged senario. In addition to that, wsf4php security api provide the user to configure some minimum set of security features by using an options array that is accepted by WSPolicy constructor. Following is a description of the avalible options in the options array. Examples will be provided on policy files later in this document.

 

Option Data Type Value Domain Default Value Description
sign string | boolean TRUE | "X509" FALSE Whether to sign the xml message or not.By default signing is not enabled.
If specified "sign"=>TRUE, the body part of the soap message will be signed using X509 Standard. The other avilable option is "Keberose".
Signing will be done on the body part of the message. To sign the other parts of the message, a  policy file should be used.
encrypt string | boolean TRUE | "X509"
FALSE Whether to encrypt the xml message or not. By default encryption is not enabled.
If specified "encrypt"=>TRUE, the body part of the soap message will be encrypted using X509 Standard. The other avilable option is "Keberose".
Encrypting will be done on the body part of the message. To encrypt headers , policy file should be used.
algorithmSuite string corresponds to Security Policy spec  7.1 [Algorithm Suite] definitions
"Basic256Rsa15" The symetric algorithm and asymetric algorithm will be   derived from the algorithm using string. If AlgorithmSuit is not specified the default value "Basic256Rsa15" will be assumed.
layout string "Strict" | "Lax" "Strict" These are defined in WS Security Policy Specification 1.1 section 7.7
includeTimestamp bool TRUE FALSE If specified TRUE and user provided the ttl (time to live ) value when providing security token object , timestamp will be used.
protectionOrder string "EncryptBeforeSigning" | "SignBeforeEncrypt" "EncryptBeforeSigning" Order in which intergrity and confidentiality are applied to the message in cases where both intergrity and confidentiality are required.
useUsernameToken boolean TRUE FALSE If the necessary options are provided with the WSSecurityToken object and "useUsernameToken"=>TRUE , then UsernameToken will be enabled.
securityTokenReference string "IssuerSerial" | "KeyIdentifier"|"EmbeddedToken"
|"Thumbprint"| "Direct"
"Direct"
This option is common for both signing and encription.
If the user wishes to have other options he should provide the appropriate policy file. Direct Reference is treated as the default value.

WSSecurityToken

A PHP level object that logically represents security properties. This object will be used to specify the security properties from client

or service.

WSSecurityToken::__construct(array of options)

Options accepted in the message is specified below.

Option Data Type Value Domain Default Value Description
user string string none Username
certificate string string none User's certificate for sign loaded from thr function get_cert_from_file()
passwordType string "PlainText" |"Digest" Digest Password type used in username token
password string users password used for username token none User's certificate for sign loaded from the function get_cert_from_file()
privateKey string user's private key as a string none User private key loaded from the function get_key_from_file()
receiverCertificate string string 
none Receiver's certificate for encrypt from the function get_cert_from_file()
receiverCertificateFormat string certificate format extension PEM PEM Receiver's certificate format
certificateFormat string certificate format extension PEM PEM user's certificate format
privateKeyFormat string key format extension PEM
PEM
Private key format
ttl
int

  Time in milliseconds
password_callback string string none Name of the password callback function, which is a user defined function accepts the username and returns the password.

Addtions to the WSClient

"policy"=>WSPolicy instance | array containing the incomming policy and outgoing policy as follows. "inpolicy"=>$policy , "outpolicy"=>$policy

"securityToken" => WSSecurityToken instance

 Only a minimal set of securiy is processed as user options. For more complex senarios, user should provide the approriate policy file.

Example WS Security Policy File.

1] sample policy file.

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">- <wsp:ExactlyOne>- <wsp:All>- <sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">- <wsp:Policy>- <sp:InitiatorToken>- <wsp:Policy>- <sp:X509Token sp:IncludeToken="*http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always*">- <wsp:Policy>
  <sp:WssX509V3Token10 />
  </wsp:Policy>
  </sp:X509Token>
  </wsp:Policy>
  </sp:InitiatorToken>- <sp:RecipientToken>- <wsp:Policy>- <sp:X509Token sp:IncludeToken="*http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always*">- <wsp:Policy>
  <sp:WssX509V3Token10 />
  </wsp:Policy>
  </sp:X509Token>
  </wsp:Policy>
  </sp:RecipientToken>- <sp:AlgorithmSuite>- <wsp:Policy>
  <sp:Basic256Rsa15 />
  </wsp:Policy>
  </sp:AlgorithmSuite>- <sp:Layout>- <wsp:Policy>
  <sp:Strict />
  </wsp:Policy>
  </sp:Layout>
  <sp:IncludeTimestamp />
  <sp:EncryptBeforeSigning />
  <sp:OnlySignEntireHeadersAndBody />
  </wsp:Policy>
  </sp:AsymmetricBinding>- <sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">- <wsp:Policy>
  <sp:MustSupportRefIssuerSerial />
  </wsp:Policy>
  </sp:Wss10></wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>