# OpenAM Administration Guide
Chapter 6. Configuring Policy Agent Profiles

Sidebar | Prev | Up | Next

## 6.7. Configuring Web Service Provider Policy Agents

This section covers Web Service Provider (WSP) properties. WSPs both validate incoming web service requests from Web Service Clients (WSC), and also secure outgoing responses sent back to WSCs.

After creating a WSP profile, you access WSP properties in the OpenAM console under Access Control > `Realm Name` > Agents > Web Service Provider > `Agent Name`.

General properties

Group

  For assigning the agent to a previously configured agent group in order to inherit selected properties from the group.

Password

  Agent password used when creating the password file and when installing the agent.

Status

  Status of the agent configuration.

Universal Identifier

  OpenAM identifier for the agent configuration.

Security properties

Security Mechanism

  Specifies the mechanisms allowed to validate the web service request.

Authentication Chain

  Specifies which OpenAM authentication chain consumes the credentials from the web service request to authenticate the WSC.

Token Conversion Type

  Specifies how to covert the incoming token before issuing requests to other WSPs.

Preserve Security Headers in Message

  Yes means the agent preserves SOAP security headers from the request for subsequent processing.

Detect Message Replay

  Yes means the agent checks whether the request is a replay of an earlier request, and if so, rejects the request.

Detect User Token Replay

  Yes means the agent checks whether the user token is a replay from an earlier requests, and if so, rejects the request.

Private Key Type

  Specifies the type of key, such as `PublicKey`, used to verify the request signature.

Liberty Service Type URN

  Specifies the Universal Resource Name for the Liberty service type used for lookups.

DNS Claim

  Specifies a Uniform Resource Identitier shared by the WSP and WSC.

Credential for User Token

  Specifies the user name and password credentials compared with the user name security token in a request.

SAML Configuration properties

SAML Attribute Mapping

  Maps SAML attribute names from the incoming request to attribute names as retrieved from the SSOToken or the identity repository, used to have the Security Token Service generate an appropriate SAML assertion.

SAML NameID Mapper Plugin

  Specifies the class name of a plugin used to perform SAML account mapping.

SAML Attributes Namespace

  Identifies the attribute name space used when generating SAML assertions.

Include Memberships

  Yes means the agent includes the principal's membership as a SAML attribute.

Signing and Encryption properties

Is Request Signature Verified

  Yes means verify signatures in requests.

Is Response Signed Enabled

  Yes means the agent signs the specified parts of the response with its x509 certificate.

Signing Reference Type

  Specifies how the x509 certificate used to sign responses is referenced in the response.

Is Request Decrypted

  Yes means do decrypt the specified parts of incoming requests.

Is Response Encrypted

  Yes means do encrypt the outgoing response.

Encryption Algorithm

  Specifies whether to use Advanced Encryption Standard, corresponding to an Encryption Strength of 128, 192, or 256, or to use Triple DES with a key length of 0, 112, or 168.

Encryption Strength

  Specifies the key length used for encryption.

Key Store properties

Public Key Alias of Web Service Client

  Specifies the alias of the certificate in the key store used to verify request signatures and encrypt responses.

Private Key Alias

  Specifies the alias of the certificate in the key store used to sign responses and decrypt requests.

Key Store Usage

  If you use your own, custom key store, specify how to access it here.

End Points properties

Web Service Security Proxy End Point

  If the WSC sends requests through a web service proxy, specify that as the end point here.

Web Service End Point

  Specifies the end point to which the WSC sends requests.

Kerberos Configuration properties

Kerberos Domain Server

  Specifies the fully qualified domain name of the Kerberos Distribution Center service.

Kerberos Domain

  Specifies the Kerberos Distribution Center domain name. For Windows environments this is the domain controller domain name.

Kerberos Service Principal

  Specifies the Kerberos principal used by OpenAM, using the form `HTTP/`openam-fqdn`@`krb-domain``, where `openam-fqdn` is the fully qualified domain name for OpenAM, and `krb-domain` is the Kerberos Domain.

Kerberos Key Tab File

  Specifies the Kerberos keytab file using the form ``openam-host`.HTTP.keytab`, where `openam-host` is the host name for OpenAM.

Verify Kerberos Signature

  Yes means the agent signs the Kerberos token.