What Is WS-Security (WSS)

SOAP Web Service Tutorials - Herong's Tutorial Examples

∟WS-Security - SOAP Message Security Extension

∟What Is WS-Security (WSS)

This section describes WS-Security (WSS) standard - a SOAP extension standard that defines building blocks to implement SOAP message content integrity and confidentiality.

What Is WS-Security (WSS)? WS-Security is a SOAP extension standard that defines building blocks to implement SOAP message content integrity and confidentiality. WS-Security standard is also referred as "Web Services Security: SOAP Message Security" or "WSS: SOAP Message Security".

The goal of WS-Security is to enable applications to conduct secure SOAP message exchanges and to support:

Multiple security token formats.
Multiple trust domains.
Multiple signature formats.
Multiple encryption technologies.
End-to-end message content security and not just transport-level security.

WS-Security standard was developed by OASIS (Organization for the Advancement of Structured Information Standards). The latest version is WS-Security 1.1.1 released in 2012.

OASIS also developed the following related specifications that describe profiles (specific mechanisms and procedures) on how several security technologies can be used with WS-Security standard:

Web Services Security Username Token Profile Version 1.1.1 - Describes the profile on how the "User Name Token" defined in WS-Security standard can be used as a means of identifying the sender by "username", and optionally using a password (or shared secret, or password equivalent) to authenticate that identity to the web service producer.
Web Services Security X.509 Certificate Token Profile Version 1.1.1 - Describes the profile on how the "Binary Security Token" defined in WS-Security standard can be used to pass "X.509 certificate" for sender authentication, messaging signing and message encryption.
Web Services Security Kerberos Token Profile Version 1.1.1 - Describes the profile on how the "Binary Security Token" defined in WS-Security standard can be used to pass "Kerberos Application Request" for sender authentication and message encryption.
Web Services Security SAML Token Profile Version 1.1.1 - Describes the profile on how the "Security Header" defined in WS-Security standard can be used to pass "SAML Assertion" for sender authentication and message encryption.
Web Services Security Rights Expression Language (REL) Token Profile Version 1.1.1 - Describes the profile on how the "Security Header" defined in WS-Security standard can be used to pass "REL License" for sender authorization to perform a certain action.
Web Services Security SOAP Message with Attachments (SwA) Profile Version 1.1.1 - Describes the profile on how WS-Security standard can be used to secure SOAP attachments for integrity, confidentiality and origin authentication.