#### To enable message security for application clients

Client providers must have the same message protection policies as the server-side providers with which they interact. This is already the case for the providers configured (but not enabled) when Application Server is installed.

To enable message security for client applications, modify the Application Server specific configuration for the application client container.

1. Stop any client applications that depend on the client container descriptor.

2. In a text editor, open the Sun application client container descriptor, located in domain-dir`/config/sun-acc.xml.`

3. To enable the default client provider in the application client, add the `default-client-provider` attribute to the element to the `message-security-config` element .

   The surrounding code is shown for context and may differ slightly in your installation. Do not change it.

       <client-container>
         <target-server name="your-host" address="your-host"
             port="your-port"/>
         <log-service file="" level="WARNING"/>
         <message-security-config auth-layer="SOAP"
             default-client-provider="ClientProvider">
           <provider-config
               class-name="com.sun.enterprise.security.jauth.ClientAuthModule"
               provider-id="ClientProvider" provider-type="client">
             <request-policy auth-source="sender"/>
             <response-policy/>
               <property name="security.config"
                 value="C:/Sun/AppServer/lib/appclient/wss-client-config.xml"/>
           </provider-config>
         </message-security-config>
       </client-container>

   The message security provider configured in the client container must have access to private keys and trusted certificates. To provide it access, set the values for the following system properties in the application client startup script:

       -Djavax.net.ssl.keyStore

       -Djavax.net.ssl.trustStore

##### See Also

- To enable providers for message security

- To configure a message security provider

- Creating a Message Security Provider

- To delete a message security configuration

- To delete a message security provider

#### Request and Response Policy Configurations

If Authenticate Source is `sender`, then the message contains a `wsse:Security` header with a `wsse:UsernameToken` (with password). If Authenticate Source is content, then the content of the SOAP message body is signed, and the message contains a `wsse:Security` header with the message body signature represented as a `ds`:`Signature`.

If Authenticate Recipient is either `before-content` or `after-content`, the content of the SOAP message body is encrypted and replaced with the resulting `xend:EncryptedData`. The message contains `a wsse:Security` header that contains an `xenc:EncryptedKey`. The `xenc:EncryptedKey` contains the key used to encrypt the SOAP message body. The key is encrypted in the public key of the recipient.

If the Authenticate Source and Authenticate Recipient settings are left blank, then no security policy is specified,and the modules perform no security operations.

The following table shows message protection policy configurations and the resulting message security operations performed by the WS-Security SOAP message security providers for that configuration.

Table 5 Message protection policy based on WS-Security SOAP message security operation

| Authenticate Recipient "before-content" | Authenticate Recipient "after-content"
--- | --- | ---
Authenticate Source "sender" | The content of the SOAP message body is encrypted and replaced with the resulting `xend:EncryptedData`. The message contains `a wsse:Security` header that contains a `wsse:UsernameToken (with password)` and an `xenc:EncryptedKey`. The `xenc:EncryptedKey` contains the key used to encrypt the SOAP message body. The key is encrypted in the public key of the recipient.
Authenticate Source "content" | The content of the SOAP message body is encrypted and replaced with the resulting `xend:EncryptedData`. The `xenc:EncryptedData` is signed. The message contains `a wsse:Security` header that contains an `xenc:EncryptedKey` and a `ds`:`Signature`. The `xenc:EncryptedKey` contains the key used to encrypt the SOAP message body. The key is encrypted in the public key of the recipient. | The content of the SOAP message body is signed, then encrypted, and then replaced with the resulting `xend:EncryptedData`. The message contains a `wsse:Security` header that contains an `xenc:EncryptedKey` and a `ds:Signature`. The `xenc:EncryptedKey` contains the key used to encrypt the SOAP message body. The key is encrypted in the public key of the recipient.