Try OpenEdge Now
skip to main content
Managed Adapters Guide
Web Service Managed Adapter : Using the Web Service Adapter : Configuring the Web Service Adapter : Defining the security settings
Defining the security settings
The Web Service adapter uses Apache WSS4J to provide support for Web Service security specifications that include: UserName Tokens, Timestamps, SAML Tokens, Digital signatures, and Message encryption.
Expand the Security Settings panel to display all the Security Settings features. By default, this panel is open, and the User Name and Password boxes are blank. However, if the Web service you are invoking requires your authentication to access the service or for run-time http authentication, enter the User Name and Password to your Web server in the WSDL HTTP Authentication section or the Runtime HTTP Authentication section.
You can also choose one of the following options for run-time http authentication:
*UserName Token: You must provide a username.wsdd file that is available in the system classpath.
*SAML Token: SAML, or Security Assertion Markup Language, is a XML-based framework that ensures communications transmitted over Web Services are secure. You must provide a SAML file with a *.wsdd extension that is available in the system classpath.
If the Web Service you invoke expects SAML Tokens, provide the following client WSSD (Web Service Deployment Descriptor), which meets Apache WSS4J requirements. This client-deploy.wsdd file has the following format:
<service name="STPing">
<handler type="">
<parameter name="action" value="Timestamp SAMLTokenUnsigned"/>
<parameter name="samlPropFile" value="keys/"/>
The name of the client-deploy.wsdd file must be unique across the Business Process Server installation and available in the application server classpath. A OEBPS_HOME\WebService\config folder is added to the system classpath of the Portal and EJB servers. All *.wsdd files are maintained in this folder.
*Other: For advanced users who want to make use of SAML, digital signatures, and encryption. You must use an actual file name with a *.wsdd extension that is compliant with wss4j requirements. This *.wsdd file must be available in the system classpath.
*To provide the details of the web service from the server-config.xml, select the Read from server-config.xml checkbox and enter the server alias in the ServerAlias text box. Using this checkbox, the users can enable reading the Authentication details and Endpoint URL from the server-config.xml
The server-config.xml should have configuration properties in the below mentioned format:

<Server name="WebServiceServer">
<SuperUser password="Password" encrypted="false">UserName</SuperUser>
<Description>Default Server Configuration for WebService Server.</Description>
<Property key="AuthenticationType" value="UserNameToken/SamlToken/Other/HTTP/NTLM" />
<Property key="Value" value="path to token file" />
In the above example, the two parameters AuthenticationType and Value are used for different types of authentication. The following table provides the different authentication types and their corresponding values:
Authentication Type
UserName Token
Path to username.wsdd file
SAML Token
Path to saml file with *.wsdd extension
Path to file with *.wsdd extension
Not required (“SuperUser” property is used for authentication)
Not required (“SuperUser” property is used for authentication).
However, the username must be "domain\userName" for the Web Service adapter to run.
* Supporting passing of session tokens to Web Services
* Setting session token cookies from dataslot