Introduction to WS-Policy
by H. Fırat Güvence
Web Service Policy

Outline
• What is WS?
• What is WS-Policy?
• Why is WS-Policy needed?
• Conceptual Placement in WS
• Technical Specification
• Vendors / Tools
• Conclusion
• Q&A

What is WS (Web Service)?
• XML
▫ SOAP
 XML formatted message in order to exchange
information among applications or services.
▫ WSDL
 SOAP is a protocol in order to exchange information
through defined services by WSDL
 currently the most common language for describing the
'how' and 'where' a Web service exchanges messages
• Web services are being successfully used for
interoperable solutions across various industries

WS-Policy
• Extends SOAP, XML Schema, WSDL and offer
mechanisms to represent the capabilities and
requirements of Web services as Policies
▫ representing whether and how a message must be
secured
▫ whether and how a message must be delivered
reliably
▫ whether a message must flow a transaction, etc

Why?
• Provider/Requester Security
• SOAP Data Optimization
• Header element
▫ Word of mouth?
▫ Documentation?
▫ WSDL?
• Automated tools will evaluate WSDL and
generate policy-aware client and engages the WS
in the way of how the WS wants.

Conceptual Placement in WS
• In WSDL and SOAP
• It can be thought of as choice of wire(s) how they
may speak to each other for security,
optimization, transaction.

Technical Specifications
• Simple Language
▫ Four elements
 Policy
 All
 ExactlyOne
 PolicyReference
▫ One attribute
 wsp:Optional

Technical Specifications cont’d
• Cenk(Web service developer) is building a client
application that retrieves real time stock quote
information from IMKB.
• IMKB supplies real time data using Web
services.

Technical Specifications cont’d
<soap:Envelope>
<soap:Header>
<wsa:To>http://stock.contoso.com/realquote</wsa:To>
<wsa:Action>http://stock.contoso.com/GetRealQuote</wsa:Action>
</soap:Header>
<soap:Body>...</soap:Body>
</soap:Envelope>
<Policy>
<wsap:UsingAddressing />
</Policy>
policy assertion

Technical Specifications cont’d
<soap:Envelope>
<soap:Header>
<wss:Security soap:mustUnderstand="1" >
<wsu:Timestamp u:Id="_0">
<wsu:Created>2006-01-19T02:49:53.914Z</u:Created>
<wsu:Expires>2006-01-19T02:54:53.914Z</u:Expires>
</wsu:Timestamp>
</wss:Security>
<wsa:To>http://real.contoso.com/quote</wsa:To>
<wsa:Action>http://real.contoso.com/GetRealQuote</wsa:Action>
</soap:Header>
<soap:Body>...</soap:Body>
</soap:Envelope>
<Policy>
<wsap:UsingAddressing />
<sp:TransportBinding>...</sp:TransportBinding>
</Policy>

Technical Specifications cont’d
• Assertion
▫ A piece of service metadata
▫ Identifies a domain specific behavior
(requirement)
 Web Services Security Policy
 Web Services Reliable Messaging Policy
 And so forth

Technical Specifications cont’d
• Assertion con’d
▫ 3 policy operators for combining policy assertions:
 Policy
 All and
 ExactlyOne
▫ Policy operator is a synonym for All
<All>
<wsap:UsingAddressing />
<sp:TransportBinding>...</sp:TransportBinding>
</All>

Technical Specifications cont’d
• Assertion con’d
<All>
<wsap:UsingAddressing />
<sp:TransportBinding>...</sp:TransportBinding>
</All>
<ExactlyOne>
<sp:TransportBinding>...</sp:TransportBinding>
<sp:AsymmetricBinding>...</sp:AsymmetricBinding >
</ExactlyOne>
<All>
<wsap:UsingAddressing />
<ExactlyOne>
<sp:TransportBinding>...</sp:TransportBinding>
<sp:AsymmetricBinding>...</sp:AsymmetricBinding >
</ExactlyOne>
</All>

Technical Specifications cont’d
• Assertion con’d
<All>
<mtom:OptimizedMimeSerialization wsp:Optional=”true”/>
<wsap:UsingAddressing />
<ExactlyOne>
<sp:TransportBinding>...</sp:TransportBinding>
<sp:AsymmetricBinding>...</sp:AsymmetricBinding >
</ExactlyOne>
</All>

Technical Specifications cont’d
▫ References, naming policies
<Policy wsu:Id=”common”>
<mtom:OptimizedMimeSerialization wsp:Optional=”true”/>
<wsap:UsingAddressing />
</Policy>
…
<PolicyReference URI=”#common”/>

Technical Specifications cont’d
▫ Attaching to WSDL
<wsdl:binding name="SecureBinding“ type="tns:RealTimeDataInterface" >
<PolicyReference URI="#secure" />
<wsdl:operation name="GetRealQuote" >…</wsdl:operation>
…
</wsdl:binding>

Vendors / Tools
• Apache Foundation, Axis2/Java
http://ws.apache.org/axis2/1_2/WS_policy.html
• Java demo based on CXF WS-Policy framework in
Apache CXF
http://www.java2s.com/Code/Java/Web-Services-
SOA/ThisdemoshowshowtheCXFWSPolicyframewo
rkinApacheCXFusesWSDL11Policyattachmentstoen
abletheuseofWSAddressing.htm
• Microsoft is already supporting WS-* technologies
http://msdn.microsoft.com/en-
us/library/ms996940.aspx

Conclusion
• Simple language
• Providers represent capabilities and requirements
• Policy-aware tools understand policy expressions
and engage behaviors automatically
• Hides complexity
• Automates Web service interactions
• Enables secure, reliable and transacted Web services
• Need for new policies! Open and new software
market for policies !

Q&A
•?

Thank You
• H. Fırat Güvence
▫ hguvence@gmail.com

References
• http://msdn.microsoft.com/en-
us/library/ms996497.aspx
• Introduction to SOAP, 2009, H. Firat Guvence
• Specs http://www.w3.org/Submission/WS-
Policy/