Automating Security with Policies in Web Services - Adjusting Policy Details (Encrypting a usernameToken)

In this step, you're going to adjust both policy statements to enforce/require encrypting the UsernameToken that contains the plain text password. 

1. Open policyCache.config in the PolicyInvoiceClient project.
   
2. Locate the first <Confidentiality> element and update the <MessageParts> child element to contain the wse:UsernameToken() message part as illustrated here:
   
   ...
   <wssp:Confidentiality wsp:Usage="wsp:Required"> 
     <wssp:KeyInfo> 
       <wssp:SecurityToken>
        ... 
       </wssp:SecurityToken>  
     </wssp:KeyInfo> 
     <wssp:MessageParts Dialect= "wsp:Body">http://schemas.xmlsoap.org/ 2002/12/wsse#part">wsp:
   Body()
         wse:UsernameToken()</wssp:MessageParts> </wssp:Confidentiality>
   ...
   
3. Save policyCache.config.
   
4. Run PolicyInvoiceClient and test invoking an operation. Verify that everything works.
   
5. Open OutputTrace.webinfo in the PolicyInvoiceClient output directory (bin) and verify that the UsernameToken element is now encrypted. 
   
6. Click File | Close Solution.
   
   Note: by using policies, you've been able to implement the same security features from the first two exercises without having to write any code.

Please check back next week for the continuation of this article.

Comments On: Automating Security with Policies in Web Services

· We hope you found this exercise from MSDN Virtual Labs to be educational and...   >>> Post your comment now!