Service client policy set and bindings collection

Use this page to attach and detach policy sets to an application, a service client, its endpoints, or operations. You can select the default bindings, create new application-specific bindings, or use existing bindings for an attached policy set. You can view or change whether the client uses the policy of the service provider.

This page displays detail information for an application and its associated web service clients, endpoints, and operations. You can view and manage policy set attachments and bindings information using this page.

To view this administrative console page, click Applications > Application Types > WebSphere enterprise applications > service_client_application_instance > Service client policy sets and bindings.

This console page can also be viewed for WS-Notification service clients by clicking one of the following paths:

Service integration > WS-Notification > Services > service_name > [Additional properties] Outbound request policy sets and bindings
Service integration > Buses > bus_name > [Services] WS-Notification services > service_name > [Additional properties] Outbound request policy sets and bindings

Depending on your assigned security role when security is enabled, you might not have access to text entry fields or buttons to create or edit configuration data. Review the administrative roles documentation to learn more about the valid roles for the application server.

Table 1. Button descriptions . Use the buttons to manage policy sets and policy set bindings for a service client, its endpoints, or operations.
Button	Resulting action
Attach Client Policy Set	Click this button to view a list of policy sets available for attachment to the selected service, endpoint, or operation. Select a policy set from the list to attach and it is attached to the selected service, endpoint, or operation. To close the menu list, click Attach Client Policy Set. Best practice: Attach policy sets at the highest level, the EAR server level for example, and let the levels beneath inherit those bindings. This can significantly improve the processing time needed to attach sets to multiple operations. After you attach sets at the highest level, you can then customize the levels beneath by detaching sets or removing bindings from those specific operations.
Detach Client Policy Set	Click this button to detach a policy set from a selected service, endpoint, or operation. After the policy set is detached, if there is no policy set attached to an upper-level service resource, the Attached Client Policy Set column displays None and the Binding column displays Not Applicable. If there is a policy set attached to an upper-level service resource, the Attached Client Policy Set column displays `policy_set_name` (inherited) and the binding used for the upper-level attachment is applied. The binding name is displayed followed by (inherited).
Assign Binding	Click this button to select from a list of available bindings for the selected policy set attachment. All the bindings are listed along with the following options: Default Specifies the default binding for the selected service, endpoint or operation. You can specify client and provider default bindings to be used at the cell level or global security domain level, for a particular server, or for a security domain. The default bindings are used when an application-specific binding has not been assigned to the attachment. When you attach a policy set to a service resource, the binding is initially set to the default. If you do not specifically assign a binding to the attachment point using this Assign Binding action, the default specified at the nearest scope is used. For any policy set attachment, the run time checks to see if the attachment includes a binding. If so, it uses that binding. If not, the run time checks in the following order and uses the first available default binding: Default general bindings for the server Default general bindings for the domain that the server resides Default general bindings for the global security domain New Application Specific Binding Select this option to create a new application-specific binding for the policy set attachments. The new binding you create is used for the selected resources. If you select more than one resource, ensure that all selected resources have the same policy set attached. Client sample Select this option to use the Client sample binding. Client sample V2 Select this option to use the Client sample V2 binding when you are using either the Kerberos V5 WSSecurity default or the TrustServiceKerberosDefault policy sets. Saml Bearer Client sample Select this option to use the Saml Bearer Client sample. The Saml Bearer Client sample extends the Client sample binding to support SAML Bearer token usage scenarios. You can use this sample with any of the SAML bearer token default policy sets. Saml HoK Symmetric Client sample Select this option to use the Saml HoK Symmetric Client sample. The Saml HoK Symmetric Client sample extends the Client sample binding to support SAML holder-of-key (HoK) symmetric key token usage scenarios. You can use this sample with one of the SAML HoK Symmetric key default policy sets: either SAML11 HoK Symmetric WSSecurity default or SAML20 HoK Symmetric WSSecurity default. SHA256 provider sample Select this option to use the SHA256 provider sample. The SHA256 provider sample extends the provider sample binding in the following ways: It adds the SignatureAlgorithm custom property for the SHA256 signature algorithms to all the symmetric and asymmetric sign parts. It contains the SAML bearer token consumers. Modify this binding to meet your security requirements before you use it in a production environment. SHA256 client sample Select this option to use the SHA256 client sample. The SHA256 client sample extends the client sample binding in the following ways: To all the symmetric and asymmetric sign parts, it adds the SignatureAlgorithm custom property for the SHA256 signature algorithms. It contains the SAML bearer token generators. Modify this binding to meet your security requirements before you use it in a production environment. To close the menu list, click Assign Binding. Best practice: Assign bindings at the highest level, the EAR server level for example, and let the levels beneath inherit those bindings. This can significantly improve the processing time needed to attach sets and bindings to multiple operations. After you assign bindings at the highest level, you can then customize the levels beneath by detaching sets or removing bindings from those specific operations.

Application/Service/Endpoint/Operation

Specifies the name of the application and the associated service client, endpoints, or operations. For WS-Notification service clients, the first entry is associated with the WS-Notification service, not an application.

Attached Client Policy Set

Specifies the policy set that is attached to the application, service clients, endpoints, or operations.

The Attached Client Policy Set column can contain the following values:

None. No policy set is attached directly, or is attached at an upper level.
policy_set_name. The name of the policy set that is directly attached, for example, WS-I RSP.
policy_set_name (inherited). A policy set is not directly attached to the resource, but a policy set is attached to a higher-level resource.

When the value in the column is a link, click the link to view or change settings about the attached policy set.

Policies Applied

Specifies the policies that are applied to the resource. This column is not applicable and is not shown for WS-Notification service clients.

The Policies Applied column can contain the following values:

None. No policies are applied to the application or service. This is the default setting if there is no policy set attached to the client.
Client only. The client policy set is applied to the application or service. This is the default setting if a policy set is attached to the client.
Provider only. The policy configuration of the service provider is applied to the application or service, as long as the client can support those policies.
Client and provider. A policy that is based on both the client policy set and the policy of the service provider is applied to the application or service.

When the value in the column is a link, click the link to view or change settings about how the policies are applied.

For a service, if the value in the column is a link followed by the word inherited in parentheses, this shows a setting that is inherited from the parent application. You can click the link to change the setting for the service.

For an endpoint or operation, the value is not a link and it is followed by the word inherited in parentheses. The setting is inherited from the parent application or service and you cannot change it.

Binding

Specifies the name of the binding associated with a policy set.

The Binding column can contain the following values:

Not applicable. There is no policy set attached, either directly or to a higher-level service resource.
Binding_name or Default. The binding name is displayed if a policy set is attached directly and an application-specific binding or a general binding is assigned, for example, MyBindings1. Default is displayed if a policy set is attached directly but the service resource uses the default bindings.
Binding_name (inherited) or Default (inherited). A service resource inherits the bindings from an attachment to a higher-level resource.

When the value in the Binding column is a link, click the link to view or change settings about the binding.

About policy set bindings

In this release, there are two types of bindings: application-specific bindings and general bindings.

Application-specific bindings

You can create application-specific bindings only at a policy set attachment point. These bindings are specific to, and constrained by, the characteristics of the defined policy. Application-specific bindings can provide configuration for advanced policy requirements such as multiple signatures; however, these bindings are reusable only within an application. Also, application-specific bindings have very limited reuse across policy sets.

When you create an application-specific binding for a policy set attachment, the binding begins in a completely unconfigured state. You must add each policy, such as WS-Security or HTTP transport, that you want to override the default binding, and fully configure the bindings for each policy that you add. For WS-Security policy, some high level configuration attributes such as TokenConsumer, TokenGenerator, SigningInfo, or EncryptionInfo might be obtained from the default bindings if they are not configured in the application-specific bindings.

For service providers, you can create application-specific bindings only by selecting Assign Binding > New Application Specific Binding, on the Service providers policy sets and bindings collection page, for service provider resources that have an attached policy set. Similarly, for service clients, you can create application-specific bindings only by selecting Assign Binding > New Application Specific Binding, on the Service clients policy sets and bindings collection page, for service client resources that have an attached policy set.

General bindings

You can configure general bindings to be used across a range of policy sets and they can be reused across applications and for trust service attachments. Although general bindings are highly reusable, they cannot provide configuration for advanced policy requirements such as multiple signatures. There are two types of general bindings: general provider policy set bindings and general client policy set bindings.

You can create general provider policy set bindings by clicking Services > Policy sets > General provider policy set bindings > New in the general provider policy sets panel, or by clicking Services > Policy sets > General client policy set bindings > New in the general client policy set and bindings panel. For details about defining and managing service client or provider bindings, see the related links. General provider policy set bindings might also be used for trust service attachments.