waf ws security
Use this command to create WS-security rules.
You can use WS-Security rules to do the following:
- Encrypt and decrypt parts of SOAP messages
- Digitally sign parts of SOAP messages
- Verify parts of SOAP messages using digital signatures
Syntax
config waf ws-security rule
edit "<ws-security_rule_name>"
set encryption-algorithm {3EDS | AES-128 | AES-256}
set encryption-part {Element Value | Element Markup}
set key-transport-algorithm {RSA-15 | RSA-OAEP}
set request-operation {Sign Verify & Decrypt | Decrypt | Sign Verify}
set request-security-status {enable | disable}
set response-operation {Sign | Encrypt | Sign & Encrypt | Encrypt & Sign}
set response-security-status {enable | disable}
set signature-algorithm {RSA-SHA-1 | HMAC-SHA-1}
set xml-client-certificate-group <xml-client-certificate_group_str>
set xml-server-certificate <xml-server-certificate_str>
config namespace-mapping
edit waf ws security
next
end
config element-list
edit waf ws security
set direction {request | response}
next
end
next
end
Variable | Description | Default |
Enter a name that can be referenced by other parts of the configuration. | No default. | |
Select the encryption algorithm.
Available only when response-security-status {enable | disable} is
|
|
|
Select which part of the SOAP messages to encrypt.
|
|
|
Select the key transport algorithm.
|
|
|
request-operation {Sign Verify & Decrypt | Decrypt | Sign Verify} |
Select the operation that FortiWeb performs for the encryped SOAP messages from the client.
|
|
Enable to configure FortiWeb to decrypt, sign and verify the encryped SOAP messages from the client. |
|
|
response-operation {Sign | Encrypt | Sign & Encrypt | Encrypt & Sign} |
Select the operation that FortiWeb performs for the SOAP messages returned from the server.
|
|
Enable to configure FortiWeb to encrypt , and sign the SOAP messages returned from the server. |
|
|
Select the signature algorithm.
|
|
|
xml-client-certificate-group <xml-client-certificate_group_str> |
Select the XML client certificate group created from XML Certificate > Client Certifcate Group. Available only when request-operation {Sign Verify & Decrypt | Decrypt | Sign Verify} is Or Available only when response-security-status {enable | disable} is |
No default. |
Select the XML server certificate uploaded from XML Certificate> Server Certifcate. Available only when request-security-status {enable | disable} is
Or Available only when response-security-status {enable | disable} is |
No default. |
|
Enter the index number of an entry to create a namespace mapping. |
No default. |
|
Enter the namespace. |
No default. |
|
Enter a prefix for the namaspace. |
No default. |
|
Enter the index number of an entry to create an element list. |
No default. |
|
Enter an XPath to specify which part of the XML file to process. |
No default. |
|
Select either Request or Response to define in which direction the XPath applies to. |
|