<!--
Copyright 2004 Sun Microsystems, Inc. All rights reserved.
SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
-->
<!--
 This server side config file pairs with wss-client-config-2.0.xml on the client 
 and supports the following UseCases:
 Usecase 2: Encrypted UsernameToken
 Usecase 3: Encrypted UsernameToken and MessageBody 
 Usecase 4: Response Encryption Key Learnt from Incoming Message

 Certificate Alias Information :
 1. A certificateAlias under the <xwss:Encrypt> element signifies the certificate
    of the recipient of the message.
 2. A certificateAlias under the <xwss:Sign> element signifies the certificate of the
    sender.
                                                                                                                                               
 NOTE:
                                                                                                                                               
   1. the certificateAlias has the above meaning for all the Sign and Encrypt elements below
   2. there are several Sign and Encrypt elements below and similarly several RequireSignature and
      RequireEncryption elements. Which of them would be actually used at runtime will depend on
      the AuthPolicy passed to the module.
                                                                                                                                               
      For Example : if Auth-Source=Sender then only the <xwss:UsernameToken> elements will be used
      and none of the <xwss:Sign> elements will be used.
      If Auth-Source=Content then the <xwss:Sign> element will be used
                                                                                                                                               
   3.  The different variations of <xwss:Encrypt> elements in this configuration file are to accomodate
       default encryption of the UsernameToken.
                                                                                                                                               
   4.  The actual certificate alias to be used for any Signature operation can be modified during AuthModule
       initialization by setting the alias as the value of "signature.key.alias" property in the Module Options Map.
   5.  The actual certificate alias to be used for any Encrypt operation can be modified during AuthModule
       initialization by setting the alias as the value of "encryption.key.alias" property in the Module Options Map.
                                                                                                                                               
   6. Debug Dumping of Messages can be enabled by setting the "debug" property in the Module Options Map to "true" during
      AuthModule initialization.
   7. The Actual configuration file to be used by an Authmodule can be changed by setting the property "security.config" in
      the Module Options Map to point to the configuration file location.
   8. When the "security.config" property is not set during module initialization then a client auth module will use wss-client-config-2.0.xml
      by default.
   9. When the "security.config" property is not set during module initialization then a server auth module will use wss-server-config-2.0.xml
      by default.

-->
<xwss:SecurityConfiguration xmlns:xwss="http://java.sun.com/xml/ns/xwss/config" 
                            dumpMessages="false">
    <xwss:Timestamp/>
    <xwss:Encrypt>
        <xwss:X509Token certificateAlias="s1as"/>
        <xwss:KeyEncryptionMethod algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
    </xwss:Encrypt>    
    <xwss:Encrypt>
        <xwss:X509Token certificateAlias="s1as"/>
        <xwss:KeyEncryptionMethod algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
    </xwss:Encrypt>
    <xwss:Encrypt>
        <xwss:X509Token certificateAlias="s1as"/>
        <xwss:KeyEncryptionMethod algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
    </xwss:Encrypt>
    <xwss:Encrypt>
        <xwss:X509Token certificateAlias="s1as"/>
        <xwss:KeyEncryptionMethod algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
    </xwss:Encrypt>
    <xwss:Sign>
        <xwss:X509Token certificateAlias="s1as"/>
    </xwss:Sign>
    <xwss:UsernameToken digestPassword="false" useNonce="true"/>

    <xwss:RequireUsernameToken nonceRequired="true" passwordDigestRequired="false"/>      
    <xwss:RequireEncryption>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
    </xwss:RequireEncryption>
    <xwss:RequireEncryption>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
    </xwss:RequireEncryption>
    <xwss:RequireEncryption>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
    </xwss:RequireEncryption>
    <xwss:RequireEncryption>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
        <xwss:Target type="qname">{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken</xwss:Target>
    </xwss:RequireEncryption>
    <xwss:RequireSignature>
        <xwss:Target type="qname">SOAP-BODY</xwss:Target>
    </xwss:RequireSignature>     
</xwss:SecurityConfiguration>
