StaticGround

From the BEA site: WS Security

"

Web Services Security Specifications

• WS-Security describes how to attach signature and encryption headers to SOAP messages. In addition, it describes how to attach security tokens, including binary security tokens such as X.509 certificates and Kerberos tickets, to messages.
  
• WS-Policy represents a set of specifications that describe the capabilities and constraints of the security (and other business) policies on intermediaries and endpoints (e.g. required security tokens, supported encryption algorithms, privacy rules) and how to associate policies with services and endpoints.
  
• WS-Trust describes a framework for trust models that enables Web services to securely interoperate by requesting, issuing, and exchanging security tokens.
  
• WS-Privacy will describe a model for how Web services and requestors state privacy preferences and organizational privacy practice statements.
  
• WS-SecureConversation describes how to manage and authenticate message exchanges between parties, including security context exchanges and establishing and deriving session keys.
  
• WS-Federation describes how to manage and broker the trust relationships in a heterogeneous federated environment, including support for federated identities, sharing of attributes, and management of pseudonyms.
  
• WS-Authorization will describe how to manage authorization data and authorization policies.
  

Additionally, several other key Web services specifications complete the foundation layer of specifications:

• WS-Addressing describes how to specify identification and addressing information for messages.
  
• WS-MetadataExchange describes how to exchange metadata such as WS-Policy information and WSDL between services and endpoints.
  
• WS-ReliableMessaging describes how to ensure reliable delivery of messages in the presence of unreliable networks.
  
• WS-Transactions and WS-Coordination describe how to enable transacted operations as part of Web service message exchanges.
  

The combination of the specifications above and interoperability profiles will enable customers to easily build interoperable secure reliable transacted Web services that integrate within and across federations by composing federation and security specifications with other Web services specifications. "