OIM 11g R2 Requests Lifecycle Management API’s

Introduction

OIM 11g R2 being such a comprehensive provisioning solution, it provides API’s for almost every aspect of functionality available in the product. This makes it a little difficult to decide which examples are needed the most in the documentation. Fortunately, the documentation does supply samples that can definitely serve as a foundation for more complex pieces of code. Some of the API’s I found developers using more often than others are the ones related to the operations associated with users’ requests for resources. Amongst those the following API’s are mostly required:

• Request Creation/Submission
• Request History Data Access
• Child Table Data Manipulation
• Approval Information Data Access

This blog post will include a few samples on how to accomplish each one of the above mentioned operations within the context of a use case described shortly. The intent is to provide some useful API’s code samples that customers and partners can use to write their own custom code that requires such functionality.

Securing WebLogic WebServices with Oracle Entitlements Server and Oracle Web Services Manager

In a way this post is actuall an update on a few previous posts. The first is an update on the custom assertions for OWSM. I've been making some changes, and now the latest revision - revision 41 - is pretty solid. I've also published the JavaDoc and will continue to add more documentation as time permits. The second is on the OES and OWSM custom assertion from OOW2009. This is really the focus of this post...how to use this assertion to secure the services with OES and OWSM, but its is worth noting that the new version of this assertion, does use the OWSMAC framework. It definately greatly simplifed the development effort. For people who are interested in the new custom assertion, here's a link to the code.

Overview

This solution uses OES 10gR3CP4 protecting a JAX-WS webservice running inside of WLS 10.3.2 (11gR1SP). The domain is a JRF domain, which means that I can use OWSM to protect the web-service. I installed and configured the WLS SM and used the config tool to create a scoped application - scoped in this case means that I'm going to use the entitlementsadministration GUI - apps and orgs. I created in Eclipse the worlds simplest Web Service and deployed it. The webservice is nothing more than a "helloWorld". Once deployed, I could use the WLS admin console to define the policies for web-service.



Notice that I applied two policies...and authentication policy using oracle/wss10_saml_token_service_policy, and then the custom policy owsmac/owsmac_oes_AuthorizationPolicy. NOTE: The oracle/wss10_saml_token_service_policy has no message protection and has to be used in a production environment in conjunction with network or transport security. You'll see why when you look at the sample messages.

Why use OES Custom Assertion for OWSM?

Since the endpoint that we're protecing in a JAX-WS webservice, it is protected by the WLS SM by default. As we discussed previously, the container first checks the access controls policy for the URL and then the WebService. With OWSM in the picture, the sequence is:

• URL Authorization Check - the resource is type=>url<, application=sample_service, contextPath=/sample_service, uri=/Service1Service, httpMethod=GET. You can do authorization only on the URL of the endpoint. Nothing in the body
  
• Call OWSM - calls OES Custom Assertion - we'll discuss more in a second what you can do
  
• WebServices Authorization Check - the resource is type=>webservices<, application=sample_service, contextPath=/sample_service, webService=Service1Port, method=hello, signature={java.lang.String}. Notice you have a lot more information like the Port and the operation as well as the signature of the method. Also, if you use attribute retriever in OES, you should be able to access a lot of the relevent appContext elements. The list is pretty expansive.
  

This means that without doing any custom work, you get two cracks at the request, and with OES in place and the WLS SM, there is quite a bit you can do. So why use the OES OWSM custom assertion? These are the additional use cases I've come up with:

• You don't want to use OES to secure the WLS resources - when I did this solution last year at OOW, I installed the WLS SM, but also had the DefaultAuthorizer and used the OES Adjudicator to pull the two together. In this case, OES won't get called for URL and Webservices resource types
  
• Policy Based access to SOAP:Body and SOAP:Env - If you use OOTB WLS SM to secure web-services, then you have to code a custom attribute retriever to operate on the SOAP Message. This means that if there are changes, then you'll need to re-code. The approach of having the XPath defined in the OES policy allows for changes to be made w/o coding
  
• You want to update the message - In the updated version of the OES Custom Assertion, you can write policy that updates the values. What is the use case for this - outbound datamasking at the perimeter. For example, you can't control what the web service is going to return, but you want to make sure that the contents don't expose any PII. You can write a policy that will mask it.
  
• You want to do authorization on the response - This is related to the previous point, but it allows you to do one more authorization check based upon the information in the response. This makes sense if the authorization cannot be determined until after invoking the operation. These really only makes sense in read operations, since the authorization failure is happending "presumably" after the transaction has been committed.
  

If you have any of the use cases above, read on and I'll explain a little more about the policies in OES.

Modelling the Policies for the OES Custom Assertion

The OES custom assertion works with 4 actions - request_lookup, execute_request, response_lookup, and execute_response. They are performed in that order. All of the magic happens in the responses (i.e. report_as function in the constraints). The values of the report_as in the lookup phases are assumed to be XPath queries that should be performed. The resulting values are then sent down in the execute phase. If the user is granted access, any report_as values returned that reference the attributes passed in are assumed to be updates which the OWSM assertion then applies.


For example, the constraint report_as("hello_out","*****") in the execute_response method will replace the value of the hello_out attribute (defined as the XPath in the response_lookup privilege) with ****.

I used the Vordel SOAP Box to test, including the creation of the unsigned SAML assertion required by the oracle/wss10_saml_token_service_policy. Basically, the policies allow any requests except if the hello in message is abc or if the response is Hello abcd - which means that the input of abcd will cause authorization to fail. Otherwise, the response is masked with ****. I also DENY any requests is the authentication method in the SAML assertion is urn:oasis:names:tc:SAML:1.0:am:unspecified. The XPath can be used on either the header of the body of the SOAP message.



I've included below the export from PolicyIX. It shows all of the authorization policies in detail.

Reference: Policy Export For Sample Application

<?xml version="1.0" encoding="UTF-8"?>
<xb:policy_propagation xmlns:xb="http://policypropagation.ales.com/xmlbean">
    <xb:policy_propagation_data_v2>
        <xb:scopes>
            <xb:application_entry value="RootOrg!defaultOrg!sample_service" boundSSM="oes10gR3cp4wlsssm">
                <xb:admin_roles>
                    <xb:admin_role_entry value="AppAdmin" isPrimary="true" description="Primary Application Admin Role of current Application">
                        <xb:admin_role_privileges>
                            <xb:admin_role_privilege_entry object="action" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="authorizationPolicy" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="authorizationPolicyReport" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="directory" action="adminview"/>
                            <xb:admin_role_privilege_entry object="extension" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="group" action="adminview"/>
                            <xb:admin_role_privilege_entry object="policyDistribution" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="policySimulator" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="resource" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="role" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="rolePolicy" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="rolePolicyReport" action="adminmanage"/>
                            <xb:admin_role_privilege_entry object="user" action="adminview"/>
                        </xb:admin_role_privileges>
                    </xb:admin_role_entry>
                </xb:admin_roles>
                <xb:resources>
                    <xb:resource_entry value="//resources/SOAPMessage" isVirtualResoureAllowed="true"/>
                    <xb:resource_entry value="//resources/SOAPMessage/Service1Service" isVirtualResoureAllowed="true"/>
                    <xb:resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port" isVirtualResoureAllowed="true"/>
                    <xb:resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello" isVirtualResoureAllowed="true"/>
                    <xb:resource_entry value="//resources/url" isVirtualResoureAllowed="true"/>
                    <xb:resource_entry value="//resources/webservices" isVirtualResoureAllowed="true"/>
                </xb:resources>
                <xb:actions>
                    <xb:action_entry value="any"/>
                    <xb:action_entry value="execute_request"/>
                    <xb:action_entry value="execute_response"/>
                    <xb:action_entry value="request_lookup"/>
                    <xb:action_entry value="response_lookup"/>
                </xb:actions>
                <xb:dynamic_attributes>
                    <xb:dynamic_attribute_entry name="auth_method" type="string"/>
                    <xb:dynamic_attribute_entry name="hello_in" type="string"/>
                    <xb:dynamic_attribute_entry name="hello_out" type="string"/>
                </xb:dynamic_attributes>
                <xb:roles>
                    <xb:role_entry value="Anonymous" parent=""/>
                </xb:roles>
                <xb:policies>
                    <xb:membership_rule_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_roles>
                            <xb:policy_role_entry value="Anonymous"/>
                        </xb:policy_roles>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/url"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                    </xb:membership_rule_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="deny"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="execute_response"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="sys_defined ( hello_out ) and hello_out = &quot;Hello abcd&quot;"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="deny"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="execute_request"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="sys_defined ( hello_in ) and hello_in = &quot;abc&quot;"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="deny"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="execute_request"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="sys_defined ( auth_method ) and auth_method = &quot;urn:oasis:names:tc:SAML:1.0:am:unspecified&quot;"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="response_lookup"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="report_as ( &quot;hello_out&quot; , &quot;body:.//tns:helloResponse/return&quot; )"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="any"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/url"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="request_lookup"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="report_as ( &quot;hello_in&quot; , &quot;body:.//tns:hello/arg0&quot; )"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="request_lookup"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="report_as ( &quot;auth_method&quot; , &quot;header:.//saml:AuthenticationStatement/@AuthenticationMethod&quot; )"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="execute_request"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage/Service1Service/Service1Port/hello"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                        <xb:policy_constraint value="sys_defined ( hello_in ) and report_as ( &quot;hello_in&quot; , &quot;*****&quot; )"/>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="execute_response"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/SOAPMessage"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                    </xb:authorization_policy_entry>
                    <xb:authorization_policy_entry>
                        <xb:policy_effect value="grant"/>
                        <xb:policy_actions>
                            <xb:policy_action_entry value="any"/>
                        </xb:policy_actions>
                        <xb:policy_resources>
                            <xb:policy_resource_entry value="//resources/webservices"/>
                        </xb:policy_resources>
                        <xb:policy_subjects>
                            <xb:policy_group_entry name="allusers" directory="defaultUsers" scope="RootOrg!defaultOrg"/>
                        </xb:policy_subjects>
                    </xb:authorization_policy_entry>
                </xb:policies>
            </xb:application_entry>
        </xb:scopes>
        <xb:security_configuration_data>
            <xb:scms>
                <xb:scm_entry name="adminconfig">
                    <xb:ssms>
                        <xb:ssm_entry name="asiadmin"/>
                        <xb:ssm_entry name="oes10gR3cp4wlsssm"/>
                    </xb:ssms>
                </xb:scm_entry>
            </xb:scms>
        </xb:security_configuration_data>
    </xb:policy_propagation_data_v2>
</xb:policy_propagation>

Do I Need to Secure My Service?

I sometimes get asked by customers whether they need any security at all for their “internal services”. I wanted to take a post to examine this subject.

Let’s take the simplest case possible from a security vantage point: a synchronous web service being called from a limited number of trusted internal clients (let’s say web applications). Because the web service is synchronous we don’t have to worry about the request sitting in a queue unprotected. Likewise, because the web service is being called from a limited number of internal clients we might be inclined to care less, if at all, about ensuring that users/clients are authorized to call the service. Finally, we will assume that there is no requirement to authenticate a “user” of the client invoking the service.

At the same time we will assume that the service is a “high value” service such that exposing it to the “outside” without security would be a mistake.

So, does such a service need security?

I think to answer this question we have to look at all the possible security concerns for such a service and how they can be addressed with or without explicit security. Usually, when a customer implies that their service doesn’t mean security what they are really saying is that the boundaries of their physical network providing all the security they need. So, let’s look and see to what extent that may be true.

The security concerns for an internal, synchronous service are as follows:

1) Client trust: ensuring that only authorized users/clients are invoking the service.

There are two types of potentially unauthorized clients to worry about, internal clients and external clients.

To protect against external client access physical network boundaries may be sufficient.
However, in my experience an increasing number of customers are not comfortable relying on their physical network.

Without additional security, the only protection against unauthorized internal access to your services is the trust and good will of the users that have access internally.

Two-way SSL is a straight forward, easy to deploy security solution that you can add to your web service that provides strong protection against all types of unauthorized client access. Note though, that one-way SSL does nothing to help with this case.

2) Service trust: ensuring that the service being invoked by consumers of the service is authentic; that it is not a Trojan horse service.

The physical network does provide some level of protection here in that a malicious Trojan service would have to be accompanied by IP address spoofing or DNS hacking to do damage. The greater danger might be the standing up and advertising of an unauthorized service for a SOA phishing attack.

Here SSL (technically just one-way) can help ensure that only authorized services are being called by clients.

3) Message integrity: ensuring the message has not been tampered with.

The physical network can limit the potential for capture, alter, and replay attacks to internal users but SSL can be added to eliminate all risk associated with capturing messages over the wire.

4) Message confidentiality: ensuring that the information in the message cannot be intercepted and read.

The physical network can limit the potential for message capture to internal users but SSL can be used to eliminate all risk of capture over the wire.

5) Tracking and reporting: ensuring that the ability exists to track specific requests/transactions to a specific user/client.

Without additional steps the only tracking mechanism provided by the physical network is the IP address of the client which may or may not be of use.

When you add 2-way SSL with each client getting a unique client certificate, you now have definitive record of which client made which request.

6) Identity propagation
If there is a requirement to propagate the identity of the user of a web application onto the web service then there is potentially additional security required.

Given the assumptions made at the beginning that the consumers of our service are trusted internal clients, we will assume that we can trust them to propagate whatever identity they want. Still, the propagation has to be done in some fashion.

Here we have 3 options:
1) The identity could be added through a custom HTTP header. This is easy on the client and secure if we trust the client and are using 2-way SSL at the transport (the header can be encrypted with symmetric cryptography for added security). On the downside it is very non-standard and will most likely require some custom work on the service side to accept an identity from a custom header.

2) The use of a real WSS Security header such as a SAML assertion. Using SAML with the bearer confirmation method (http://fusionsecurity.blogspot.com/2009/09/bearer-confirmation-method-huh-what-is.html) provides a more standard way of propagating a user identity. With bearer, no messy signing or encryption is required and given our assumptions the security of bearer is probably sufficient if 2-way SSL is being used. The only gotcha is you have to have client and server side stacks that can both “speak” SAML bearer.

3) Many customers ask/talk about just putting the user identity in the body of the message. In many ways this is the easiest thing to do. I also think it makes sense if the business logic of the service will actually make use of the user identity information; as would be the case for a “process insurance selection” or “purchase ticket” service. The only thing to understand is that putting user identity information in the message body means including it in the schema and explicitly coding how to retrieve it in the service. If you rely on WSS security for user propagation then the user identity can be left out of the schema and the service can be coded just to get the identity from the container.

When identity propagation comes up in these conversations, the discussion usually centers on using SAML vs. just putting the user info in the message body. The key deciding factors here are whether the user info will be used by the business logic of the service, whether you want to include the user info in the schema or not, and whether you are comfortable with the code of the service itself retrieving the user identity from the message or whether you’d rather rely on getting the user identity from the container.

Summary
On a very restrictive physical network where trust in the users that have access to the network is very high, it may be OK to deploy a high value web service without additional security. However, most of the time it is a good idea to utilize 2-way SSL to provide strong transport level security.
If identity propagation is required a judgment call needs to be made on how to propagate the identity and whether or not to do so through transport security, WSS message level security, or just in the body of the message.

Dynamic OWSM Policy and Policy Overrides for WLS, OSB and SOA Suite

First all, great job by Alex in his inaugural post on the blog.. I really think the OES-OVD combination solves a lot of interesting problems.

I've been spending a lot of time lately working on OSB and OWSM. As people probably know, 11gR1 OSB is released, and you can now use OWSM to secure both proxy and business services.. You have been able for a while to use OWSM for WLS JAX-WS services and of course you can use it to secure SOA Suite composites and BPEL processes. I really like, and customers really like, the idea of being able to centrally manage WS-Security policy from one place. I also like the fact that there is now a single web-services stack across all of these products that OOTB interoperates with eachother. If you want to know why this is a real improvement, I refer you to the OSB to WLS + SAML post. Also, OWSM has native WS-Security Kerberos Token profile...and I have gotten it to work very nicely with WCF (a post for another time).

Given all this, I've been sharpening my pencil on how to write custom assertions (policies) in OWSM 11g. As people will recall, I did an OES+OWSM custom assertion at OOW 2009, and to be honest, that was really the last time I looked at it. My recollection from that time, and my recent experience was that it was a little challenging. Writing the custom assertions is very similar to writing the custom SSPI plugins. Its the type of thing that you don't do that often, and when you do, once you can get the build script going and some decent samples, its not too bad. So, my contribution to this effort can be found at https://owsm-11g-custom-assertions.samplecode.oracle.com/wiki/. In addition to the OES+OWSM assertion from last year, I added a new project called OWSMAC - OWSM Annotations Compiler. What I tried to do was look at what was challenging in working with the custom assertions and try to make it really, really simple.

These are a few of things that OWSMAC does:

• Automatically generate policy and assertion XML
  
• Simplified XPath processing
  
• Dynamic Reloading - no need to reboot the server after each little change
  
• Consistent and predictable lifecycle
  
• Programmatic selection of policy and overrides
  

I'm putting the cart before the horse here, as I've not really fully documented or "javadoc-ed" the project, but I have been able to solve a pretty interesting use case that a couple of customers have been interested in, so I wanted to share it now. I suggest that people join the project for updates on OWSMAC.

Dynamic Policy Selection

The scenario is that from an intermediary (likely OSB or SOA Suite composite) the request to the business service/reference requires message level security, but the specifics of the actual policy depend on some state - information in the message, or the location (network) of the destination or different targets have different security requirements - some partners want SAML and others want Username and Password. WS-SecurityPolicy once again is not sufficient or particularly helpful. You need to be able to determine the policy dynamically. I've done this through one of the samples in OWSMAC - DynamicClientPolicy

package owsmac.test;

import java.util.Map;

import javax.xml.soap.SOAPMessage;

import oracle.wsm.common.sdk.IContext;

import owsmac.annotations.Assertion;
import owsmac.annotations.AttachTo;
import owsmac.annotations.Category;
import owsmac.annotations.CustomMethod;
import owsmac.annotations.Executor;
import owsmac.annotations.MessageContextPropertyValue;
import owsmac.annotations.PolicyNameValue;

import oracle.wsm.security.util.SecurityConstants.ClientConstants;
import javax.xml.ws.BindingProvider;

import oracle.wsm.common.sdk.ISOAPBindingMessageContext;
import oracle.wsm.policyengine.IExecutionContext;

import owsmac.annotations.DestroyMethod;
import owsmac.annotations.ExecutionContext;
import owsmac.annotations.FaultMethod;
import owsmac.annotations.InitMethod;
import owsmac.annotations.PolicyPropertyValue;
import owsmac.annotations.Property;

@Assertion(displayName = "A dynamic client policy", customType = Assertion.CustomType.policy, category = Category.security, attachTo = AttachTo.binding_client)
@Executor(category = Category.security_authentication)    
public class DynamicClientPolicy {
    
    @PolicyNameValue()
    public String selectedPolicy;
    
    @PolicyPropertyValue(name="csf-key",policyNameValue="selectedPolicy")
    //@MessageContextPropertyValue(name = ClientConstants.WSS_CSF_KEY)
    public String csfKey;
    
    @MessageContextPropertyValue(name = "javax.xml.ws.service.endpoint.address")
    public String address;
    
    @MessageContextPropertyValue(name = BindingProvider.USERNAME_PROPERTY)
    public String samlUsername;
    
    @MessageContextPropertyValue(name = "oracle.wsm.subject.precedence")
    public String useSubjectPrecedence;
    
    @Property(value = "localhost:389")
    public static String LDAP_SERVER;
    
    public static @ExecutionContext
    IExecutionContext eCtx;
    
    @InitMethod
    public static void init() {
        System.out.println("In Init: "+eCtx.getAllProperties());
        System.out.println("In Init: The LDAP Server is "+LDAP_SERVER);
    }
    
    @DestroyMethod()
    public static void destroy() {
        System.out.println("Destroyed Dynamic Client Policy");
    }
    
 
    @FaultMethod()
    public boolean onFault(IContext context) throws Exception {
        
        ISOAPBindingMessageContext soapContext = (ISOAPBindingMessageContext)context;
        
        SOAPMessage message = soapContext.getFault();
        
        return true;
    }
    
    @CustomMethod(extendsPolicyNameValue="selectedPolicy")
    public boolean selectPolicy(IContext context) throws Exception {
        
        
        this.getPolicyFromContext(context);
        
        return true;
    }
    
    /**
     * This is where the custom logic goes for selecting the policy
     * @param content
     */
    private void getPolicyFromContext(IContext context) {
        
            System.out.println("In the getContext.....");
            Map<String,Object> properties = context.getAllProperties();
            
            for (String property: properties.keySet()) {
              
                Object value = properties.get(property);
                
                System.out.println(property+"=>"+value);
              
            }
            
            System.out.println("The address is "+this.address);
            
            if (this.address!=null && address.indexOf("UNT")!=-1) {
            
              this.selectedPolicy = "oracle/wss_username_token_client_policy";
              this.csfKey = "josh.creds";
              
            } else {
              
              this.selectedPolicy = "oracle/wss_saml_token_bearer_over_ssl_client_policy";
              this.samlUsername = "foobar";
              this.useSubjectPrecedence = "false";
              
            }
            
            System.out.println("The selected policy is "+this.selectedPolicy+" and user="+this.samlUsername);
            
        
        
    }
   
}

The whole idea of OWSMAC is to allow people to use POJOs to build the assertions and let everything else happen "magically". I'll draw your attention to the selectPolicy method. This method has the @CustomMethod annotation with extendsPolicyNameValue. This basically means call this method, and when your done go invoke the policy stored in the field referenced in extendsPolicyNameValue. So, in this method, you can set the name of the policy and then also set additional policy overrides or programmatic overrides (these being the same as the properties for JAX-WS clients).

In the sample, we're just looking at the address (endpointURI) and then either invoking UNT - specifying the csf-key of the user or calling SAML and specifying the name of the user to include in the SAML assertion. In the SAML case, there is also something interesting going on - we're using 11gR1 PS SAML Identity Switching. Notice in order to this we're basically setting two properties - BindingProvider.USERNAME_PROPERTY and oracle.wsm.subject.precedence. The former is the name of the user (which doesn't have to exist in the user directory) and the latter is a flag that tells OWSM not to use the identity in the subject for the SAML assertion. Now, in order to perform identity switching, you need to grant a permission. The documentation is not particularly clear. The permission you need to grant is oracle.wsm.security.WSIdentityPermission resource=<composite name> assert. In the text box, you enter resource=<appname> not <appname>.

This is the simple composite that illustrates the scenario.



The references are to WLS web-services protected by OWSM service policies.



The policy file that gets generated by OWSMAC is then uploaded into EM to create a custom policy.



And then attach the policy to the references to the SAML and UNT services. You can also attach the same policy in OSB

Summary

In an ideal world, there would be no need to this type of programmatic extension of the core policy model. The standards would be precise and comprehensive and all of the OOTB policies would never need to be changed. But with our experience with SSPI and the WLS core security model, there are always occasions where customer requirements fall into that 20%, so its good to know that there are ways to simply extend the core product functionality. I like the simplicity of OWSM and the binding of configuration and policy is broadly very useful. Invariably there will be scenarios like the one above, where more dynamic behavior is required. My plan going forward it to continue to use the annotations model with the OWSMAC samples to illustrate how to execute these types of scenarios. I'm looking for additional samples to prove out or ideally some help developing and shaping the project, for everyone's benefit. Who's with me?

References

Creating Custom Assertions

Oracle Entitlement Server (OES) Web Services SM Demystified

First of all - Happy New Decade - and welcome to the future!

Now, after some well deserved time off, back to it. I was recently visiting with a customer and they asked me for the WSDL associated with the Web Services SM for OES. Seems like a simple request, but what I quickly figured out was that there is no really simple way to get the WSDL (navigating to http://mywssm:8555/someservicename?WSDL). Simpler is definitely better, so this post is not a full-throated defense of how the WebServices SM works, but rather an opportunity to discuss some of the features of the OES client libraries and the PDPProxy specifically. For those who just want to see the WSDL, here it is. I've also included the schema, here. They can also be found in SSM_HOME/webservice-ssm/instance/instancename/config.

Three different SMs - One API - PDP Proxy

There are many different Security Modules (SM) that OES supports but they essentially fall into two categories - centralized or embedded. In the centralized model, applications are making remote calls out to the actual SM service running centrally. OES supports two protocols for centralized SMs - SOAP and RMI. These are affectionately reffered to as the WebServices SM and the RMI SM. In the embededded model, application make calls to the services OES and the authorization enginer is co-located (runs in the same Java process) as the application. This is the Java SM (though when running inside of WLS its called the WLS SM or in WebSphere the WebSphere SM etc.).

When deploying OES into Java applications, you may not know up-front which of the 3 main types of SMs make sense. Initially, you may want to use the WebServices SM because SOAP is a standard and works nicely with the rest of the SOA infrastructure. You may then move to the RMI SM because you need a binary protocol to meet performance requirements. Finally, to get maximium performance, you move to the embedded model and the Java SM. This evolution of SM deployment is natural and to be expected. What would be unatural and unexpected is to have to recode the application just because you were choosing a different SM deployment model. This is the driving thought behind the single Java API.

This is from the SSM_HOME/webservice-ssm/examples/JavaAPIExample/src/java\com\bea\security\examples\JavaAPIExample.java

 protected static SecurityRuntime initializeSSM(String configId) {
    SecurityRuntime rt = null;

    // Initialize this applications configuration
    System.out.print("Initializing the Security Runtime ... ");
    AppConfig cfg = new AppConfig("Java API Example Application");

    cfg.useConfiguration(configId);

    // Add this application naming definitions to the config
    try {
      cfg.addNameAuthorityDefinitionFile("exampleNames.xml");
    } catch (FileNotFoundException fnfExc) {
      System.out.println(fnfExc.getLocalizedMessage());
      return rt;
    }

    // Initialize the security runtime
    try {
      SecurityRuntime.initialize(cfg);
    } catch (ParameterException pExc) {
      // We could not get the policy domain
      System.out.println(pExc.getLocalizedMessage());
      return rt;
    }
    catch (Throwable e) {
      e.printStackTrace();
      return rt;
    }

    // Get an instance of the runtime
    rt = SecurityRuntime.getInstance();
    System.out.println("Initialized");
    
    return rt;
  }

  protected static PolicyDomain tryGetPolicyDomain(SecurityRuntime rt, String configId) {
    PolicyDomain pd = null;

    try {
      pd = rt.getPolicyDomain(configId);
      System.out.println("Retrieved Policy Domain");
    } catch (ParameterException pExc) {
        // We could not get the policy domain
      System.out.println(pExc.getLocalizedMessage());
    }

    return pd;
  }

  protected static AuthenticationService tryGetAuthenticationService(PolicyDomain pd) {
    AuthenticationService atnSvc = null;

    try {
      atnSvc = (AuthenticationService)pd.getService(ServiceType.AUTHENTICATION);
      System.out.println("Retrieved Authentication Service");
    } catch (ServiceNotAvailableException naExc) {
      // We could not fetch the service
      System.out.println(naExc.getLocalizedMessage());
    }
    return atnSvc;
  }

  protected static AuthorizationService tryGetAuthorizationService(PolicyDomain pd) {
    AuthorizationService atzSvc = null;

    try {
      atzSvc = (AuthorizationService) pd.getService(ServiceType.AUTHORIZATION);
      System.out.println("Retrieved Authorization Service");
    } catch (ServiceNotAvailableException naExc) {
      // We could not fetch the service
      System.out.println(naExc.getLocalizedMessage());
    }
    return atzSvc;
  }

So, the idea is that the SM is just a collection of services - authentication, authorization, roles, audit, credential mapping. These services are accessible from a named configuration called a PolicyDomain. You can see more details of the Java API from the product documentation.. What is interesting is that if you examined the JavaAPIExample from SSM_HOME/java-ssm/examples/JavaAPIExample/src/java\com\bea\security\examples\JavaAPIExample.java, you would see the exact same code. From an API perspective, the type of SM (embedded or centralized) or the protocol (SOAP or RMI) is completely encapsulated.

All of this "magic" is done via what is called the PDPProxy configuration. When an instance of the SM is created with the ConfigTool, a directory is created SSM_HOME/SSM_TYPE/instance/instance-name/config/pdpproxy. In this directory is all of the information (libraries and config), that a client needs to communicate with the SM. At runtime, the Java API looks for a system property -Dpdp.configuration.properties.location to point it to the correct config.


The specific libraries will vary depending on the SM type (axis SOAP library is used for Web Service SM). There is a common configuration file called PDPProxyConfiguration.properties.

# SSM configuration id
SSMConfigID=dt

# Transport indicates underlying transport 
# to be used to communicate with the PDP - JAVA / WS / RMI
PDPTransport=WS

# Comma separated list of PDP host & port information. 
# For example this could be end point URLs could be,
# http://localhost:9200, or https://localhost:9200
PDPAddress=http://oamwindows:8225

There is more in the file, but this gives the general idea. You can change the PDPTransport and in the case of web-service SM, you define the URL.

Details on the Web Service SM

The basic API pattern is to get a named PolicyDomain and then access the services as needed. The question is, how do you apply this pattern to WebServices? Instead of simply listing each SOAP endpoint in a WSDL, OES uses the concept of the ServiceRegistry. This is basically a service that a client can call to get the location of the other services. With that information in hand, access to the underlying services - authentication, authorization, etc is pretty straight forward. I've included the SOAP Request/Response for the ServiceRegistry which is located at http://WS SM URL/ServiceRegistry.

Service Registry Request

<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><locateService xmlns="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd"><ServiceType>ALES_AUTHORIZATION</ServiceType><SsmId>dt</SsmId></locateService></soapenv:Body></soapenv:Envelope>

Service Registry Response

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Body>
<locateServiceResponse xmlns="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd">
<locateServiceResponse>http://oamwindows:8225/Authorization</locateServiceResponse>
</locateServiceResponse>
</soapenv:Body>
</soapenv:Envelope>

Is this better that just exposing ?WSDL

Personally, I'm not a big fan of "discoverable" security services. For example, I don't like the idea of adding XACML to WS-Policy and making it readily available. Interoperability of WS-Policy as people know from reading this blog is a sore topic for me. In general, I'm OK with a little security by obscurity in this case. Also, in the context of the overall strategy of OES to simplify access via a single Java API, I think this is a good idea, and is in fact easier then using your own tooling to write a SOAP client. And finally, since this pattern is not obvious, OES does certify and provide its own clients for common platforms like MSFT .net.

---

Reference: WSDL and Schema for Web Services SM

SSM-SOAPWS.wsdl

<?xml version="1.0" encoding="UTF-8"?>

<wsdl:definitions

    name="SSM-SOAP-WebService"

    targetNamespace="http://security.bea.com/ssmws/ssm-ws-1.0.wsdl"

    xmlns="http://www.w3.org/2001/XMLSchema"

    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"

    xmlns:ssm="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd"

    xmlns:tns="http://security.bea.com/ssmws/ssm-ws-1.0.wsdl"

    xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"

    xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines SOAP WebService public interface for SSM component.</wsdl:documentation>



<!-- WSDL Types Section -->

    <wsdl:types>



  <xsd:import namespace="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd" schemaLocation="ssm-soap-types.xsd"/>



    </wsdl:types>



<!-- WSDL Messages Section -->

    

    <wsdl:message name="serviceFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports a generic server-side error.</wsdl:documentation>

        <wsdl:part element="ssm:serviceFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Generic error information</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="authenticationFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports an authentication error.</wsdl:documentation>

        <wsdl:part element="ssm:authenticationFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authentication error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="authorizationFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports an authorization error.</wsdl:documentation>

        <wsdl:part element="ssm:authorizationFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="credentialMappingFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports a credential mapping error.</wsdl:documentation>

        <wsdl:part element="ssm:credentialMappingFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Credential mapping error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="roleMappingFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports a role mapping error.</wsdl:documentation>

        <wsdl:part element="ssm:roleMappingFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Role mapping error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="auditingFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports an auduting error.</wsdl:documentation>

        <wsdl:part element="ssm:auditingFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Auditing error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="registryFault">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Reports a registry error.</wsdl:documentation>

        <wsdl:part element="ssm:registryFailure" name="fault">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Registry error information.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    

    <wsdl:message name="authenticateRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to authenticate a user. Accepts any credential type supported by the authentication provider or a response to an earlier authentication challenge, and, optionally, the type of requested identity assertion that represents the identity and application context of the authenticated user.</wsdl:documentation>

        <wsdl:part element="ssm:authenticate" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for authenticate operation</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="authenticateResponse">

<wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user's authentication. Returns either the requested identity assertion token, an authentication challenge, or additional context requests, if a challenge is required by the specific authentication provider or the authentication protocol.</wsdl:documentation>

        <wsdl:part element="ssm:authenticateResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies authentication response</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="assertIdentityRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to assert user's identity. Accepts any supported identity assertion type or a response to an earlier authentication challenge, and, optionally, the type of requested identity assertion that represents the identity and application context of the authenticated user.</wsdl:documentation>

        <wsdl:part element="ssm:assertIdentity" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for assertIdentity operation</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="assertIdentityResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user's authentication. Returns either the requested identity assertion token, an authentication challenge, or additional context requests, if required by the specific authentication provider or the authentication protocol.</wsdl:documentation>

        <wsdl:part element="ssm:assertIdentityResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies authentication response</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="getServiceTypeRequest">

       <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to get service type. Takes an empty request.</wsdl:documentation>

        <wsdl:part element="ssm:getServiceType" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for getServiceType operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="getServiceTypeResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response containing service's type. Returns a structure that contains the service. The Web Services SSM supports five security service types: authentication, auditing, authorization, credential mapping, and role mapping.</wsdl:documentation>

        <wsdl:part element="ssm:getServiceTypeResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains the service type.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="getVersionRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to get service version. Takes an empty request.</wsdl:documentation>

        <wsdl:part element="ssm:getVersion" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the getVersion operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="getVersionResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response containing service version. Returns a structure that contains the version of the service.</wsdl:documentation>

        <wsdl:part element="ssm:getVersionResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains the service version.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAssertionTokenSupportedRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to check for of the assertion token type. Accepts the token type of the identity assertion token that represents the identity of the authenticated user.</wsdl:documentation>

        <wsdl:part element="ssm:isAssertionTokenSupported" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isAssertionTokenSupported operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAssertionTokenSupportedResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response about assertion token support. Returns a Boolean value (true or false) to indicate whether this token is supported by this instance of the Security Service Module.</wsdl:documentation>

        <wsdl:part element="ssm:isAssertionTokenSupportedResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Indicates whether an token type is supported.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isCompatibleRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to check service compatibility. Accepts service version information. You use this method to determine whether the version of the service interface specified in the web services client is compatible with the current version of the service interface in the instance of the Security Service Module.</wsdl:documentation>

        <wsdl:part element="ssm:isCompatible" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isCompatible operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isCompatibleResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response about service compatibility. Returns compatibility information.</wsdl:documentation>

        <wsdl:part element="ssm:isCompatibleResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Specifies service's compatibility.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="validateIdentityRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to verify assertion token. Accepts any supported identity assertion type that represents the identity of the authenticated user.</wsdl:documentation>

        <wsdl:part element="ssm:validateIdentity" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for validateIdentity operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="validateIdentityResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response about assertion token validity. Returns a structure with a Boolean value (true or false) that indicates the authenticity of the token.</wsdl:documentation>

        <wsdl:part element="ssm:validateIdentityResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Specifies assertion token's validity.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAccessAllowedRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to authorize user access. Accepts a supported type of an identity assertion token, and a runtime resource and action structures. Optionally, it can accept type of the requested identity assertion token, (representing the authenticated user's identity), application context, and authorization direction parameters.</wsdl:documentation>

        <wsdl:part element="ssm:isAccessAllowed" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isAccessAllowed operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAccessAllowedResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user authorization. Returns the authorization decision (optionally accompanied by the time-to-live (TTL) value), an identity Assertion token, and a list of user roles, or, if required by the authorization provider, additional context requests.</wsdl:documentation>

        <wsdl:part element="ssm:isAccessAllowedResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies authorization response.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="isAccessAllowedDebugRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug request to authorize user access. Accepts a supported type of an identity assertion token, and a runtime resource and action structures. Optionally, it can accept type of the requested identity assertion token, (representing the authenticated user's identity), application context.</wsdl:documentation>

        <wsdl:part element="ssm:isAccessAllowedDebug" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isAccessAllowed_Debug operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAccessAllowedDebugResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug response from user authorization. Returns the authorization decision, evaluation debug information, (optionally accompanied by the time-to-live (TTL) value), an identity Assertion token, and a list of user roles, or, if required by the authorization provider, additional context requests.</wsdl:documentation>

        <wsdl:part element="ssm:isAccessAllowedDebugResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies debug authorization response.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getRolesDebugRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug request for user roles. Accepts a supported type of an identity token, and, optionally, runtime resource and action structures and an application context.</wsdl:documentation>

        <wsdl:part element="ssm:getRolesDebug" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for getRoles operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getRolesDebugResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug response with user roles. Returns either a list of user roles associated for the identity or, if such is required by the Role Mapping provider, additional context requests and evaluation debug information. If the identity provided is invalid or not properly authenticated, this method returns a SOAP fault.</wsdl:documentation>

        <wsdl:part element="ssm:getRolesDebugResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains the requested user roles.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="isBulkAccessAllowedRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to bulk authorize user access. Accepts a supported type of an identity assertion token, and a list of runtime resource and action structures. Optionally, it can accept type of the requested identity assertion token, (representing the authenticated user's identity), application context, and authorization direction parameters.</wsdl:documentation>

        <wsdl:part element="ssm:isBulkAccessAllowed" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isBulkAccessAllowed operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isBulkAccessAllowedResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user authorization. Returns a list of the following information, the authorization decision (optionally accompanied by the time-to-live (TTL) value), an identity Assertion token, and a list of user roles, or, if required by the authorization provider, additional context requests.</wsdl:documentation>

        <wsdl:part element="ssm:isBulkAccessAllowedResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies bulk authorization response.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="isChildResourceAccessAllowedRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to bulk authorize (child resources) user access. Accepts a supported type of an identity assertion token, and a runtime resource and action structures. Optionally, it can accept type of the requested identity assertion token, (representing the authenticated user's identity), application context, and authorization direction parameters.</wsdl:documentation>

        <wsdl:part element="ssm:isChildResourceAccessAllowed" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the isChildResourceAccessAllowed operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isChildResourceAccessAllowedResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user authorization. Returns a list of the following information, authorization decision (optionally accompanied by the time-to-live (TTL) value), an identity Assertion token, and a list of user roles, or, if required by the authorization provider, additional context requests.</wsdl:documentation>

        <wsdl:part element="ssm:isChildResourceAccessAllowedResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies bulk authorization (child resources) response.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="queryActionsOnResourceRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to query actions on resource. Accepts a supported type of an identity assertion token, and a runtime resource. Optionally, it can accept requested actions, application context parameters.</wsdl:documentation>

        <wsdl:part element="ssm:queryActionsOnResource" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the queryActionsOnResource operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="queryActionsOnResourceResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user authorization. Returns the allowed and denied actions</wsdl:documentation>

        <wsdl:part element="ssm:queryActionsOnResourceResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies query actions on resource response.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="queryActionsOnChildResourceRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to query actions on resource clipping node and all child resource nodes. Accepts a supported type of an identity assertion token, and a runtime resource clipping node. Optionally, it can accept requested actions, application context parameters.</wsdl:documentation>

        <wsdl:part element="ssm:queryActionsOnChildResource" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the queryActionsOnChildResource operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="queryActionsOnChildResourceResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response from user authorization. Returns the allowed and denied actions for the resource and the children of that resource</wsdl:documentation>

        <wsdl:part element="ssm:queryActionsOnChildResourceResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies response for query actions on resource clipping node and all child resource nodes.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="isAuthenticationRequiredRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to check whether a resource is protected. Accepts a runtime resource and a runtime action.</wsdl:documentation>

        <wsdl:part element="ssm:isAuthenticationRequired" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for isAuthenticationRequired operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="isAuthenticationRequiredResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response whether authentication is required. Returns a Boolean value (true or false) that indicates whether authentication is require to access this resource. The web services client uses this method to test whether privileges are required to access a particular resource.</wsdl:documentation>

        <wsdl:part element="ssm:isAuthenticationRequiredResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Identifies authentication requirements for a resource.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getCredentialsRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for credentials mapping. Accepts a supported type of an identity assertion token and a list of requested credential types. Optionally, this method can accept an identity assertion token that represents the identity of a different user and a runtime resource structure, which includes the requested resource and action and the application context.</wsdl:documentation>

        <wsdl:part element="ssm:getCredentials" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for the getCredentials operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getCredentialsResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with requested credentials. Returns either a list of requested user credentials, identity assertion tokens, or, if required by the ALES Credential Mapping provider, context requests.</wsdl:documentation>

        <wsdl:part element="ssm:getCredentialsResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains the requested user credentials.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getRolesRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for user roles. Accepts a supported type of an identity token, and, optionally, runtime resource and action structures and an application context.</wsdl:documentation>

        <wsdl:part element="ssm:getRoles" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for getRoles operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getRolesResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with user roles. Returns either a list of user roles associated for the identity or, if such is required by the Role Mapping provider, additional context requests. If the identity provided is invalid or not properly authenticated, this method returns a SOAP fault.</wsdl:documentation>

        <wsdl:part element="ssm:getRolesResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains the requested user roles.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="recordEventRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to record auditing message. Accepts an audit record, and, optionally, an identity assertion token, representing the auditing user, and an application context. Returns either an empty response or, if required by the provider, additional context requests.</wsdl:documentation>

        <wsdl:part element="ssm:recordEvent" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for recordEvent operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="recordEventResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Returns a Boolean value (true or false) confirming recording an audit event.</wsdl:documentation>

        <wsdl:part element="ssm:recordEventResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains True or false.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="locateServiceRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service URL. Accepts the requested service type and SSM Configuration ID of the Web Services SSM that provides the service.</wsdl:documentation>

        <wsdl:part element="ssm:locateService" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for locateService operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="locateServiceResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service's URL. Returns the fully qualified URL for the endpoint of the requested service.</wsdl:documentation>

        <wsdl:part element="ssm:locateServiceResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains requested service's URL.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="doesServiceExistRequest">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to check the existence of the service. Accepts the requested service type and SSM Configuration ID of the Web Services Security Service Module that provides the service.</wsdl:documentation>

        <wsdl:part element="ssm:doesServiceExist" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input parameters for doesServiceExist operation.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="doesServiceExistResponse">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response inidicating whether the service exists.  Returns a Boolean value (true or false) that indicates whether the service exists and can be requested.</wsdl:documentation>

        <wsdl:part element="ssm:doesServiceExistResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Contains True or false.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>   

    <wsdl:message name="getParameterValueRequest">

        <wsdl:part element="ssm:getParameterValue" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Name of the requested parameter.</wsdl:documentation>

        </wsdl:part>

    </wsdl:message>

    <wsdl:message name="getParameterValueResponse">

        <wsdl:part element="ssm:getParameterValueResponse" name="parameters">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">The requested parameter value.</wsdl:documentation>

        </wsdl:part>        

    </wsdl:message>    



<!-- WSDL Ports Section -->

    

    <wsdl:portType name="AuthenticationPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines authentication operations.</wsdl:documentation>

        <wsdl:operation name="authenticate">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the authentication method.</wsdl:documentation>

            <wsdl:input message="tns:authenticateRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authentication request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:authenticateResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authentication response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authenticationFault" message="tns:authenticationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="assertIdentity">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the identity assertion method.</wsdl:documentation>

            <wsdl:input message="tns:assertIdentityRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Assertion request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:assertIdentityResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Assertion response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authenticationFault" message="tns:authenticationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isAssertionTokenSupported">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether an assertion token type is supported.</wsdl:documentation>

            <wsdl:input message="tns:isAssertionTokenSupportedRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for support check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isAssertionTokenSupportedResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating token type support.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authenticationFault" message="tns:authenticationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="validateIdentity">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Validates identity token.</wsdl:documentation>

            <wsdl:input message="tns:validateIdentityRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for validating identity token.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:validateIdentityResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating token validity.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service type.</wsdl:documentation>

            <wsdl:input message="tns:getServiceTypeRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service type.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getServiceTypeResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service type.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service version.</wsdl:documentation>

            <wsdl:input message="tns:getVersionRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service version.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getVersionResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service version.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether the service version is compatible.</wsdl:documentation>

            <wsdl:input message="tns:isCompatibleRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for compatibility check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isCompatibleResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating compatibility.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="AuthorizationPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines authorization operations.</wsdl:documentation>

        <wsdl:operation name="isAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the access control method.</wsdl:documentation>

            <wsdl:input message="tns:isAccessAllowedRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isAccessAllowedResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isAccessAllowed_Debug">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the debug access control method.</wsdl:documentation>

            <wsdl:input message="tns:isAccessAllowedDebugRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug Authorization request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isAccessAllowedDebugResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug Authorization response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isBulkAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the access control method.</wsdl:documentation>

            <wsdl:input message="tns:isBulkAccessAllowedRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isBulkAccessAllowedResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isChildResourceAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the access control method.</wsdl:documentation>

            <wsdl:input message="tns:isChildResourceAccessAllowedRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isChildResourceAccessAllowedResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Authorization response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isAuthenticationRequired">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether authentication is required on a resource.</wsdl:documentation>

            <wsdl:input message="tns:isAuthenticationRequiredRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request to check resource protection.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isAuthenticationRequiredResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating whether a resource is protected.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service type.</wsdl:documentation>

            <wsdl:input message="tns:getServiceTypeRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service type.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getServiceTypeResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service type.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service version.</wsdl:documentation>

            <wsdl:input message="tns:getVersionRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service version.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getVersionResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service version.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether the service version is compatible.</wsdl:documentation>

            <wsdl:input message="tns:isCompatibleRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for compatibility check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isCompatibleResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating compatibility.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="queryActionsOnResource">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the query actions on resource method.</wsdl:documentation>

            <wsdl:input message="tns:queryActionsOnResourceRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Query actions on resource request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:queryActionsOnResourceResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Query actions on resource response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

        <wsdl:operation name="queryActionsOnChildResource">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the query actions on child resource method.</wsdl:documentation>

            <wsdl:input message="tns:queryActionsOnChildResourceRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Query actions on child resource request input.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:queryActionsOnChildResourceResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Query actions on child resource response result.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="authorizationFault" message="tns:authorizationFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="CredentialMappingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines credential mapping operations.</wsdl:documentation>

        <wsdl:operation name="getCredentials">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the method for mapping credentials.</wsdl:documentation>

            <wsdl:input message="tns:getCredentialsRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for credentials maping.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getCredentialsResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Credential mapping results.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="credentialMappingFault" message="tns:credentialMappingFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service type.</wsdl:documentation>

            <wsdl:input message="tns:getServiceTypeRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service type.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getServiceTypeResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with service type.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service version.</wsdl:documentation>

            <wsdl:input message="tns:getVersionRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for the service version.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getVersionResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service version.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether the service version is compatible.</wsdl:documentation>

            <wsdl:input message="tns:isCompatibleRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for compatibility check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isCompatibleResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating compatibility.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="RoleMappingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the role mapping operations.</wsdl:documentation>

        <wsdl:operation name="getRoles">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the method for mapping roles.</wsdl:documentation>

            <wsdl:input message="tns:getRolesRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for roles maping.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getRolesResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Role mapping results.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="roleMappingFault" message="tns:roleMappingFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getRoles_Debug">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the debug method for mapping roles.</wsdl:documentation>

            <wsdl:input message="tns:getRolesDebugRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for debug roles maping.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getRolesDebugResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Debug role mapping results.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="roleMappingFault" message="tns:roleMappingFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service type.</wsdl:documentation>

            <wsdl:input message="tns:getServiceTypeRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for the service type.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getServiceTypeResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service type.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service version.</wsdl:documentation>

            <wsdl:input message="tns:getVersionRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for the service version.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getVersionResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service version.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether the service version is compatible.</wsdl:documentation>

            <wsdl:input message="tns:isCompatibleRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for compatibility check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isCompatibleResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating compatibility.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="AuditingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines auditing operations.</wsdl:documentation>

        <wsdl:operation name="recordEvent">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the method for recording an audit event.</wsdl:documentation>

            <wsdl:input message="tns:recordEventRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input for recording an audit event.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:recordEventResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with true or false.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="auditingFault" message="tns:auditingFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service type.</wsdl:documentation>

            <wsdl:input message="tns:getServiceTypeRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for the service type.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getServiceTypeResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service type.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains the service version.</wsdl:documentation>

            <wsdl:input message="tns:getVersionRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for the service version.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getVersionResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service version.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether the service version is compatible.</wsdl:documentation>

            <wsdl:input message="tns:isCompatibleRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for a compatibility check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:isCompatibleResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response indicating compatibility.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="ServiceRegistryPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the service registry operations.</wsdl:documentation>

        <wsdl:operation name="locateService">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the method for locating a service by service type.</wsdl:documentation>

            <wsdl:input message="tns:locateServiceRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Input for locating a service.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:locateServiceResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with the service URL.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="registryFault" message="tns:registryFault" /> 

        </wsdl:operation>

        <wsdl:operation name="doesServiceExist">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Checks whether a service of this service type exists.</wsdl:documentation>

            <wsdl:input message="tns:doesServiceExistRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Request for service check.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:doesServiceExistResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Response with true or false.</wsdl:documentation>

            </wsdl:output>

   <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

   <wsdl:fault name="registryFault" message="tns:registryFault" /> 

        </wsdl:operation>

    </wsdl:portType>

    <wsdl:portType name="ManagementPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines management operations.</wsdl:documentation>

        <wsdl:operation name="getParameterValue">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Obtains value of a requested parameter</wsdl:documentation>

            <wsdl:input message="tns:getParameterValueRequest">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Name of the requested parameter.</wsdl:documentation>

            </wsdl:input>

            <wsdl:output message="tns:getParameterValueResponse">

                <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">The requested parameter value.</wsdl:documentation>

            </wsdl:output>

            <wsdl:fault name="serviceFault" message="tns:serviceFault" /> 

            <wsdl:fault name="credentialMappingFault" message="tns:credentialMappingFault" /> 

        </wsdl:operation>

    </wsdl:portType>    



<!-- WSDL Bindings Section -->

    

    <wsdl:binding name="AuthenticationBinding" type="tns:AuthenticationPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Authentication</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="authenticate">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the authentication method</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#authenticate"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authenticationFault">

                <soap:fault name="authenticationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="assertIdentity">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the assertIdentity method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#assertIdentity"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authenticationFault">

                <soap:fault name="authenticationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isAssertionTokenSupported">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isAssertionTokenSupported method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#isAssertionTokenSupported"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authenticationFault">

                <soap:fault name="authenticationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="validateIdentity">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the validateIdentity method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#validateIdentity"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getServiceType method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#getServiceType"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getVersion method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#getVersion"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isCompatible method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authentication#isCompatible"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="AuthorizationBinding" type="tns:AuthorizationPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Authorization</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="isAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the isAccessAllowed method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isAccessAllowed"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isAccessAllowed_Debug">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the isAccessAllowed_Debug method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isAccessAllowed_Debug"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isBulkAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the isBulkAccessAllowed method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isBulkAccessAllowed"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isChildResourceAccessAllowed">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the isChildResourceAccessAllowed method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isChildResourceAccessAllowed"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isAuthenticationRequired">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isAuthenticationRequired method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isAuthenticationRequired"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getServiceType method.s</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#getServiceType"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getVersion method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#getVersion"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isCompatible method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#isCompatible"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="queryActionsOnResource">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the queryActionsOnResource method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#queryActionsOnResource"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="queryActionsOnChildResource">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines binding for the queryActionsOnChildResource method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Authorization#queryActionsOnChildResource"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="authorizationFault">

                <soap:fault name="authorizationFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="CredentialMappingBinding" type="tns:CredentialMappingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Credential mapping</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="getCredentials">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getCredentials method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:CredentialMapping#getCredentials"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="credentialMappingFault">

                <soap:fault name="credentialMappingFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getServiceType method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:CredentialMapping#getServiceType"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getVersion method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:CredentialMapping#getVersion"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isCompatible method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:CredentialMapping#isCompatible"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="RoleMappingBinding" type="tns:RoleMappingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Role mapping</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="getRoles">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getRoles method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:RoleMapping#getRoles"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="roleMappingFault">

                <soap:fault name="roleMappingFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getRoles_Debug">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getRoles_Debug method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:RoleMapping#getRoles_Debug"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="roleMappingFault">

                <soap:fault name="roleMappingFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getServiceType method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:RoleMapping#getServiceType"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getVersion method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:RoleMapping#getVersion"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isCompatible method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:RoleMapping#isCompatible"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="AuditingBinding" type="tns:AuditingPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Auditing</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="recordEvent">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the recordEvent method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Auditing#recordEvent"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="auditingFault">

                <soap:fault name="auditingFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getServiceType">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the  binding for the getServiceType method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Auditing#getServiceType"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="getVersion">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getVersion method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Auditing#getVersion"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="isCompatible">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the isCompatible method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Auditing#isCompatible"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="ServiceRegistryBinding" type="tns:ServiceRegistryPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Service manager</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="locateService">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the locateService method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:ServiceRegistry#locateService"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="registryFault">

                <soap:fault name="registryFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

        <wsdl:operation name="doesServiceExist">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the doesServiceExist method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:ServiceRegistry#doesServiceExist"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

            <wsdl:fault name="registryFault">

                <soap:fault name="registryFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>

    <wsdl:binding name="ManagementBinding" type="tns:ManagementPort">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">SOAP/HTTP binding for Management</wsdl:documentation>

        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

        <wsdl:operation name="getParameterValue">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines the binding for the getParameterValue method.</wsdl:documentation>

            <soap:operation soapAction="security:ssmws:Management#getParameterValue"/>

            <wsdl:input>

                <soap:body use="literal"/>

            </wsdl:input>

            <wsdl:output>

                <soap:body use="literal"/>

            </wsdl:output>

            <wsdl:fault name="serviceFault">

                <soap:fault name="serviceFault" use="literal"/>

            </wsdl:fault>

        </wsdl:operation>

    </wsdl:binding>    

        

<!-- WSDL Services Section -->

    

    <wsdl:service name="Ssmws">

        <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Defines an instance of SSM Web Service</wsdl:documentation>

        <wsdl:port binding="tns:AuthenticationBinding" name="Authentication">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the Authentication Web service on the specified HTTP port.</wsdl:documentation>

            <soap:address location="http://Authentication"/>

        </wsdl:port>

        <wsdl:port binding="tns:AuthorizationBinding" name="Authorization">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the Authorization Web service on the specified HTTP port</wsdl:documentation>

            <soap:address location="http://Authorization"/>

        </wsdl:port>

        <wsdl:port binding="tns:CredentialMappingBinding" name="CredentialMapping">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the CredentialMapping web service on the specified HTTP port.</wsdl:documentation>

            <soap:address location="http://CredentialMapping"/>

        </wsdl:port>

        <wsdl:port binding="tns:RoleMappingBinding" name="RoleMapping">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the RoleMapping web service on the specified HTTP port.</wsdl:documentation>

            <soap:address location="http://RoleMapping"/>

        </wsdl:port>

        <wsdl:port binding="tns:AuditingBinding" name="Auditing">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the Auditing web service on the specified HTTP port.</wsdl:documentation>

            <soap:address location="http://Auditing"/>

        </wsdl:port>

        <wsdl:port binding="tns:ServiceRegistryBinding" name="ServiceRegistry">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the ServiceRegistry web service on the specified HTTP port.</wsdl:documentation>

            <soap:address location="http://ServiceRegistry"/>

        </wsdl:port>

        <wsdl:port binding="tns:ManagementBinding" name="Management">

            <wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Exposes the management Web service on the specified HTTP port</wsdl:documentation>

            <soap:address location="http://Management"/>           

        </wsdl:port>

    </wsdl:service>



</wsdl:definitions>  

ssm-soap-types.xsd

<?xml version="1.0" encoding="UTF-8"?>



<!--

Main SSM schema; it defines all relevant data structures used in the SSM's public SOAP interface

NOTE: All elements in type declarations are local (no 'ref' attributes) for gSOAP compatibility

-->



<xsd:schema

    attributeFormDefault="unqualified"

    elementFormDefault="qualified"

    targetNamespace="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd"

    version="0.1"

    xmlns="http://www.w3.org/2001/XMLSchema"

    xmlns:ssm="http://security.bea.com/ssmws/ssm-soap-types-1.0.xsd"

    xmlns:xsd="http://www.w3.org/2001/XMLSchema">



    <xsd:simpleType name="ServiceTypeEnum">

        <xsd:annotation>

            <xsd:documentation>One of the defined SSM services</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_AUDIT"/>

            <xsd:enumeration value="ALES_AUTHENTICATION"/>

            <xsd:enumeration value="ALES_AUTHORIZATION"/>

            <xsd:enumeration value="ALES_CREDENTIAL"/>

            <xsd:enumeration value="ALES_ROLE"/>

            <xsd:enumeration value="ALES_MANAGEMENT"/>

        </xsd:restriction>

    </xsd:simpleType>

    <xsd:simpleType name="ServiceCompatibilityEnum">

        <xsd:annotation>

            <xsd:documentation>Defines service compatibility results</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_NOT_COMPATIBLE"/>

            <xsd:enumeration value="ALES_COMPATIBLE"/>

            <xsd:enumeration value="ALES_COMPATIBLE_DEPRECATED"/>

            <xsd:enumeration value="ALES_COMPATIBLE_UNKNOWN"/>

        </xsd:restriction>

    </xsd:simpleType>

    <xsd:simpleType name="AtzDirectionEnum">

        <xsd:annotation>

            <xsd:documentation>Specifies authorization direction</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_ONCE"/>

            <xsd:enumeration value="ALES_POST"/>

            <xsd:enumeration value="ALES_PRIOR"/>

        </xsd:restriction>

    </xsd:simpleType>

    <xsd:simpleType name="AuditSeverityEnum">

        <xsd:annotation>

            <xsd:documentation>Specifies severity of an audit record</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_AUDIT_FAILURE"/>

            <xsd:enumeration value="ALES_ERROR"/>

            <xsd:enumeration value="ALES_FAILURE"/>

            <xsd:enumeration value="ALES_INFORMATIONAL"/>

            <xsd:enumeration value="ALES_SUCCESS"/>

            <xsd:enumeration value="ALES_WARNING"/>

        </xsd:restriction>

    </xsd:simpleType>           

    <xsd:simpleType name="TokenEncodingEnum">

        <xsd:annotation>

            <xsd:documentation>Specifies acceptable token encoding</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_BASE64"/>

        </xsd:restriction>

    </xsd:simpleType>           

    <xsd:simpleType name="CredentialMethodEnum">

        <xsd:annotation>

            <xsd:documentation>Specifies a supported method of gathering credentials</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <xsd:enumeration value="ALES_CHOICE"/>

            <xsd:enumeration value="ALES_CONFIRMATION"/>

            <xsd:enumeration value="ALES_LANGUAGE"/>

            <xsd:enumeration value="ALES_NAME"/>

            <xsd:enumeration value="ALES_PASSWORD"/>

            <xsd:enumeration value="ALES_TEXTINPUT"/>

            <xsd:enumeration value="ALES_TEXTOUTPUT"/>

        </xsd:restriction>

    </xsd:simpleType>           

    <xsd:simpleType name="CredentialTypeType">

        <xsd:annotation>

            <xsd:documentation>Describes names for supported credential types. It can be any non-empty string consisting of any number of alphanumeric characters and separators '.',':','_'</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

      <xsd:pattern value="[A-Za-z][A-Za-z0-9_:\.]*"/>

        </xsd:restriction>

    </xsd:simpleType>    

    <xsd:simpleType name="SAMLAssertionType">

        <xsd:annotation>

            <xsd:documentation>Represents an element for SAML Identity Assertion.</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

            <maxLength value='32768'/>

        </xsd:restriction>

    </xsd:simpleType>

 <xsd:simpleType name="ALESIdentityAssertionType">

        <xsd:annotation>

            <xsd:documentation>Represents an element for proprietary ALES Identity Assertion.</xsd:documentation>

        </xsd:annotation>

        <xsd:restriction base="xsd:string">

         <maxLength value='4096'/>

        </xsd:restriction>

 </xsd:simpleType>

    <xsd:complexType name="IdentityAssertionType">

        <xsd:annotation>

            <xsd:documentation>

              An acceptable user's identity assertion token with an extensibility element.

              Name of the passed element should match one of the registered credential types.

              Encoding rules are determined by the token type. 

            </xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

   <xsd:any namespace="##any" maxOccurs="1" minOccurs="0" processContents="strict" />

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="CredentialType">

        <xsd:annotation>

            <xsd:documentation>Additionals types of credentials</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="0" name="Info" type="xsd:string"/>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="Value" type="xsd:string"/>

        </xsd:sequence>

        <xsd:attribute name="Type" type="ssm:CredentialMethodEnum"/>

<!--        

        <xsd:anyAttribute namespace="##other" processContents="lax"/>

-->        

    </xsd:complexType>

    <xsd:complexType name="IdentityCredentialType">

        <xsd:annotation>

            <xsd:documentation>Acceptable user's credentials</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="Credential" type="ssm:CredentialType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="IdentityRoleType">

        <xsd:annotation>

            <xsd:documentation>Represents a role assigned to an identity</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="Name" type="xsd:QName"/>

            <xsd:element maxOccurs="1" minOccurs="0" name="Description" type="xsd:string"/>

        </xsd:sequence>

<!--        

  <xsd:anyAttribute namespace="##other" processContents="lax"/> 

-->

    </xsd:complexType>            

    <xsd:complexType name="IdentityRolesType">

        <xsd:annotation>

            <xsd:documentation>Represents a role collection</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="Roles" type="ssm:IdentityRoleType"/>

         <xsd:element maxOccurs="1" minOccurs="0" name="RolesTtlAdvice" type="xsd:int"/>

        </xsd:sequence>

    </xsd:complexType>            

    <xsd:complexType name="CredentialTypesType">

        <xsd:annotation>

            <xsd:documentation>Array of credential types</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="CredentialType" type="ssm:CredentialTypeType"/>

        </xsd:sequence>

    </xsd:complexType>

 <xsd:complexType name="ChallengeType">

        <xsd:annotation>

            <xsd:documentation>Challenge for authentication handshake</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="1" name="ChallengeCode" type="xsd:NCName"/>

            <xsd:element maxOccurs="1" minOccurs="0" name="ChallengeState" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="0" name="Blob" type="xsd:base64Binary"/>

        </xsd:all>

<!--        

        <xsd:attribute name="Algorithm" type="xsd:QName" use="optional"/>

        <xsd:anyAttribute namespace="##other" processContents="lax"/>

-->

 </xsd:complexType>            

    <xsd:complexType name="ContextRequestsType">

        <xsd:annotation>

            <xsd:documentation>Array of context challenges</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="ContextAttribute" type="xsd:QName"/>

        </xsd:sequence>

<!--        

        <xsd:anyAttribute namespace="##other" processContents="lax"/>

-->    

    </xsd:complexType>

 <xsd:simpleType name="IpType">

        <xsd:annotation>

            <xsd:documentation>This type represents an IP address XXX.XXX.XXX.XXX</xsd:documentation>

        </xsd:annotation>

   <xsd:restriction base="xsd:string">

     <xsd:pattern value="(\d{1,3}\.){3}\d{1,3}"/>

   </xsd:restriction>

 </xsd:simpleType> 

    <xsd:complexType name="ContextRecordType">

        <xsd:annotation>

            <xsd:documentation>Name/value pair to pass context data</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="RecordName" type="xsd:QName"/>

         <xsd:choice>

             <xsd:element maxOccurs="1" minOccurs="1" name="StringValue" type="xsd:string"/>

             <xsd:element maxOccurs="1" minOccurs="1" name="BoolValue" type="xsd:boolean"/>

             <xsd:element maxOccurs="1" minOccurs="1" name="DateTimeValue" type="xsd:dateTime"/>

             <xsd:element maxOccurs="1" minOccurs="1" name="TimeValue" type="xsd:time"/>

             <xsd:element maxOccurs="1" minOccurs="1" name="IntValue" type="xsd:int"/>

             <xsd:element maxOccurs="1" minOccurs="1" name="IpValue"  type="ssm:IpType"/>

         </xsd:choice>

        </xsd:sequence>

<!--        

        <xsd:anyAttribute namespace="##other" processContents="lax"/>

-->    

    </xsd:complexType>

    <xsd:complexType name="ContextType">

        <xsd:annotation>

            <xsd:documentation>Structure for passing context data</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="Record" type="ssm:ContextRecordType"/>

        </xsd:sequence>

<!--        

        <xsd:attribute name="Type" type="xsd:QName" use="optional"/>

        <xsd:anyAttribute namespace="##other" processContents="lax"/>

-->

    </xsd:complexType>

    <xsd:complexType name="ServiceVersionType">

        <xsd:annotation>

            <xsd:documentation>Used to pass service version information</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="1" name="MajorVersion" type="xsd:int"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="MinorVersion" type="xsd:int"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="PatchLevel" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Version" type="xsd:long"/>

        </xsd:all>

    </xsd:complexType>

    <xsd:complexType name="EmptyAttributedType">

        <xsd:annotation>

            <xsd:documentation>Specifies an empty type with any attribute</xsd:documentation>

        </xsd:annotation>

<!--        

  <xsd:anyAttribute namespace="##any" processContents="lax"/> 

-->

    </xsd:complexType>

    <xsd:complexType name="RuntimeActionType">

        <xsd:annotation>

            <xsd:documentation>Represents a runtime action</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="1" name="ActionString" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="AuthorityName" type="xsd:string"/>

        </xsd:all>

    </xsd:complexType>

    <xsd:complexType name="RuntimeResourceType">

        <xsd:annotation>

            <xsd:documentation>Represents a runtime resource</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="1" name="ResourceString" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="AuthorityName" type="xsd:string"/>

        </xsd:all>

    </xsd:complexType>

    <xsd:complexType name="AuditRecordType">

        <xsd:annotation>

            <xsd:documentation>Represents an audit record</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="1" name="AuthorityName" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Severity" type="ssm:AuditSeverityEnum"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Message" type="xsd:string"/>

        </xsd:all>

    </xsd:complexType>

    <xsd:complexType name="FaultInfoType">

        <xsd:annotation>

            <xsd:documentation>Represents a server-side error</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

            <xsd:element maxOccurs="1" minOccurs="0" name="Description" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="0" name="TextInfo" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="0" name="BinInfo" type="xsd:base64Binary"/>

        </xsd:all>

    </xsd:complexType>

    <xsd:complexType name="AtzDecisionDataType">

        <xsd:annotation>

            <xsd:documentation>Represents data accompanying authorization decisions</xsd:documentation>

        </xsd:annotation>

        <xsd:all>

          <xsd:element maxOccurs="1" minOccurs="0" name="AtzTtlAdvice" type="xsd:int"/>

             <xsd:element maxOccurs="1" minOccurs="0" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

                <xsd:element maxOccurs="1" minOccurs="0" name="IdentityRoles" type="ssm:IdentityRolesType"/>

             <xsd:element maxOccurs="1" minOccurs="0" name="Responses" type="ssm:ContextType"/>

        </xsd:all>

    </xsd:complexType>    

    

<!-- Types for "wrapped" document style 

 NOTE: nillable="true" is used instead of minOccurs="0" to indicate optional elements. This is done to accomodate buggy

 implementation of optional parameters in Axis 1.1

-->

    <xsd:complexType name="IsCompatibleType">

        <xsd:annotation>

            <xsd:documentation>Service compatibility check request's wrapper</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="ServiceVersion" type="ssm:ServiceVersionType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthenticateType">

        <xsd:annotation>

            <xsd:documentation>Authentication request's wrapper</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityCredential" type="ssm:IdentityCredentialType"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AssertIdentityType">

        <xsd:annotation>

            <xsd:documentation>Identity assertion request's wrapper</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="IsAssertionTokenSupportedType">

        <xsd:annotation>

            <xsd:documentation>Token type check request's wrapper</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="AssertionCredentialType" type="ssm:CredentialTypeType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="ValidateIdentityType">

        <xsd:annotation>

            <xsd:documentation>Token validation request's wrapper</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

        </xsd:sequence>

    </xsd:complexType>            

    <xsd:complexType name="IsAccessAllowedType">

        <xsd:annotation>

            <xsd:documentation>Authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AtzDirection" type="ssm:AtzDirectionEnum"/>

        </xsd:sequence>

    </xsd:complexType>



    <xsd:complexType name="IsChildResourceAccessAllowedType">

        <xsd:annotation>

            <xsd:documentation>Authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="ResourceAction" type="ssm:ResourceActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>

 

    <xsd:complexType name="ResourceActionType">

        <xsd:annotation>

            <xsd:documentation>Resource Action Pair</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

        </xsd:sequence>

    </xsd:complexType>



    <xsd:complexType name="IsBulkAccessAllowedType">

        <xsd:annotation>

            <xsd:documentation>Bulk Authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="unbounded" minOccurs="1" name="ResourceAction" type="ssm:ResourceActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>



    <xsd:complexType name="IsAuthenticationRequiredType">

        <xsd:annotation>

            <xsd:documentation>Request to check whether resource is protected</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="GetCredentialsType">

        <xsd:annotation>

            <xsd:documentation>Credential mapping request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="RequestedCredentialTypes" type="ssm:CredentialTypesType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>            

    <xsd:complexType name="GetRolesType">

        <xsd:annotation>

            <xsd:documentation>Request for user roles</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>            

    <xsd:complexType name="RecordEventType">

        <xsd:annotation>

            <xsd:documentation>Auditing request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="AuditRecord" type="ssm:AuditRecordType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="SsmIdType">

        <xsd:annotation>

            <xsd:documentation>Service locating request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>                

            <xsd:element maxOccurs="1" minOccurs="1" name="ServiceType" type="ssm:ServiceTypeEnum"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="SsmId" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthenticationResultType">

        <xsd:annotation>

            <xsd:documentation>Response to an authentication request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>                

            <xsd:choice>

                <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

             <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Challenge" type="ssm:ChallengeType" />

            </xsd:choice>

            <xsd:element maxOccurs="unbounded" minOccurs="1" nillable="true" name="StatusInfo" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthorizationResultType">

        <xsd:annotation>

            <xsd:documentation>Response to an authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="AccessAllowed" type="xsd:boolean"/>

            <xsd:choice>

             <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AtzDecisionData" type="ssm:AtzDecisionDataType"/>

                <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="ContextRequests" type="ssm:ContextRequestsType"/>

            </xsd:choice>

        </xsd:sequence>

    </xsd:complexType>



 <!-- for bulk authorization API -->

    <xsd:complexType name="ExtendedAuthorizationResultType">

        <xsd:annotation>

            <xsd:documentation>Response to a bulk authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

    <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

    <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

                <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AtzResult" type="ssm:AuthorizationResultType"/>

        </xsd:sequence>

    </xsd:complexType>



    <xsd:complexType name="BulkChildAuthorizationResultType">

        <xsd:annotation>

            <xsd:documentation>Response to a bulk authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

                <xsd:element maxOccurs="unbounded" minOccurs="1" nillable="true" name="AtzResult" type="ssm:ExtendedAuthorizationResultType"/>

        </xsd:sequence>

    </xsd:complexType>



    <xsd:complexType name="BulkAuthorizationResultType">

        <xsd:annotation>

            <xsd:documentation>Response to a bulk authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

                <xsd:element maxOccurs="unbounded" minOccurs="1" nillable="true" name="AtzResult" type="ssm:ExtendedAuthorizationResultType"/>

        </xsd:sequence>

    </xsd:complexType>





    <xsd:complexType name="GetCredentialsResultType">

        <xsd:annotation>

            <xsd:documentation>Response to a credential mapping request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" nillable="true" name="MissingTypes" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="IdentityCredential" type="ssm:IdentityCredentialType"/>

            <xsd:element maxOccurs="unbounded" minOccurs="1" nillable="true" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

        </xsd:sequence>

    </xsd:complexType>            

    

    <xsd:complexType name="DoesServiceExistResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to an authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="doesServiceExistResponse" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    

    <xsd:complexType name="getParameterValueType">

        <xsd:annotation>

            <xsd:documentation>Request parameter of getParameterValue request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="getParameterValue" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    

    <xsd:complexType name="getParameterValueResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to an getParameterValue request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="getParameterValueResponse" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    

    <xsd:complexType name="RecordEventResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to a record event request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="recordEventResponse" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthenticationRequiredResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to an authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="isAuthenticationRequiredResponse" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AssertionTokenSupportedResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to an authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="isAssertionTokenSupportedResponse" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="ValidateIdentityResponseType">

        <xsd:annotation>

            <xsd:documentation>Response to an authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="validateIdentityResponse" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="ComplexAnyURI">

        <xsd:annotation>

            <xsd:documentation>A complex URI</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="locateServiceResponse" type="xsd:anyURI"/>

        </xsd:sequence>

    </xsd:complexType>   

    <xsd:complexType name="GetServiceTypeReturnType">

        <xsd:annotation>

            <xsd:documentation>Return type from the getServiceType method</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="ServiceType" type="ssm:ServiceTypeEnum"/>

        </xsd:sequence>

    </xsd:complexType>   

    <xsd:complexType name="IsCompatibleReturnType">

        <xsd:annotation>

            <xsd:documentation>Return type from the isCompatible method</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="Value" type="ssm:ServiceCompatibilityEnum"/>

        </xsd:sequence>

    </xsd:complexType>   



 <xsd:complexType name="RequestedActionsType">

  <xsd:annotation>

   <xsd:documentation>Wrapper the requested actions</xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="unbounded" minOccurs="1" name="Actions" type="ssm:RuntimeActionType"/>

  </xsd:sequence>

 </xsd:complexType>

 <xsd:complexType name="QueryActionsOnResourceType">

  <xsd:annotation>

   <xsd:documentation>Query actions on resource request</xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

   <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedActions" type="ssm:RequestedActionsType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

  </xsd:sequence>

 </xsd:complexType>

 <xsd:complexType name="QueryActionsOnResourceResultType">

  <xsd:annotation>

   <xsd:documentation>Response to an Query actions on resource request</xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeEntitlement" type="ssm:RuntimeEntitlementType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="ResponseContext" type="ssm:ContextType"/>

  </xsd:sequence>

 </xsd:complexType>

 <xsd:complexType name="RuntimeEntitlementType">

  <xsd:annotation>

   <xsd:documentation>Represents a set of granted and denied actions on a resource</xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

   <xsd:element maxOccurs="unbounded" minOccurs="0" name="GrantedActions" type="ssm:RuntimeActionType"/>

   <xsd:element maxOccurs="unbounded" minOccurs="0" name="DeniedActions" type="ssm:RuntimeActionType"/>

  </xsd:sequence>

 </xsd:complexType>

 <xsd:complexType name="QueryActionsOnChildResourceType">

  <xsd:annotation>

   <xsd:documentation>Query actions on child resource request </xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

   <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedActions" type="ssm:RequestedActionsType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

  </xsd:sequence>

 </xsd:complexType>

 <xsd:complexType name="QueryActionsOnChildResourceResultType">

  <xsd:annotation>

   <xsd:documentation>Response to an Query actions on child resource request</xsd:documentation>

  </xsd:annotation>

  <xsd:sequence>

   <xsd:element maxOccurs="unbounded" minOccurs="0" name="EntitlementList" type="ssm:RuntimeEntitlementType"/>

   <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="ResponseContext" type="ssm:ContextType"/>

  </xsd:sequence>

 </xsd:complexType>

    

    <xsd:complexType name="ConstraintAttributeType">

        <xsd:annotation>

            <xsd:documentation>Represents attribute and its value used in a policy constraint</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="Name" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Type" type="xsd:int"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Value" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="DataType" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthorizationPolicyType">

        <xsd:annotation>

            <xsd:documentation>Represents evaluated Authorization policy</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="PolicyEvaluationResult" type="xsd:boolean"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="PolicyType" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Privilege" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Resource" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Subject" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Constraints" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Delegator" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Notes" type="xsd:string"/>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="AttributeList" type="ssm:ConstraintAttributeType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="RolePolicyType">

        <xsd:annotation>

            <xsd:documentation>Represents evaluated Role policy</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="PolicyEvaluationResult" type="xsd:boolean"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="PolicyType" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Role" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Resource" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="Subject" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Constraints" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Delegator" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="Notes" type="xsd:string"/>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="AttributeList" type="ssm:ConstraintAttributeType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="UserInfoType">

        <xsd:annotation>

            <xsd:documentation>Information about "user" making request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="QualifiedGroupNameList" type="xsd:string"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="QualifiedUserName" type="xsd:string"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="DebugInfoType">

        <xsd:annotation>

            <xsd:documentation>Store the evaluation results for Authorization and user roles request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="AuthorizationPolicyList" type="ssm:AuthorizationPolicyType"/>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="GrantedRoleList" type="xsd:string"/>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="RolePolicyList" type="ssm:RolePolicyType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="UserInfo" type="ssm:UserInfoType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="ResourceLocated" type="xsd:boolean"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="IsAccessAllowedDebugType">

        <xsd:annotation>

            <xsd:documentation>Debug Authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="RequestedCredentialType" type="ssm:CredentialTypeType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="AuthorizationDebugResultType">

        <xsd:annotation>

            <xsd:documentation>Response to a debug authorization request</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="AccessAllowed" type="xsd:boolean"/>

            <xsd:choice>

             <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AtzDecisionData" type="ssm:AtzDecisionDataType"/>

                <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="ContextRequests" type="ssm:ContextRequestsType"/>

            </xsd:choice>

            <xsd:element maxOccurs="1" minOccurs="1" name="DebugInfo" type="ssm:DebugInfoType"/>

        </xsd:sequence>

    </xsd:complexType>

    <xsd:complexType name="GetRolesDebugType">

        <xsd:annotation>

            <xsd:documentation>Debug request for user roles</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="1" minOccurs="1" name="IdentityAssertion" type="ssm:IdentityAssertionType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeResource" type="ssm:RuntimeResourceType"/>

      <xsd:element maxOccurs="1" minOccurs="1" name="RuntimeAction" type="ssm:RuntimeActionType"/>

            <xsd:element maxOccurs="1" minOccurs="1" nillable="true" name="AppContext" type="ssm:ContextType"/>

        </xsd:sequence>

    </xsd:complexType>            

    <xsd:complexType name="GetRolesDebugResponseType">

        <xsd:annotation>

            <xsd:documentation>Represents a role collection</xsd:documentation>

        </xsd:annotation>

        <xsd:sequence>

            <xsd:element maxOccurs="unbounded" minOccurs="1" name="Roles" type="ssm:IdentityRoleType"/>

            <xsd:element maxOccurs="1" minOccurs="1" name="DebugInfo" type="ssm:DebugInfoType"/>

         <xsd:element maxOccurs="1" minOccurs="0" name="RolesTtlAdvice" type="xsd:int"/>

        </xsd:sequence>

    </xsd:complexType>            



<!-- Elements for "wrapped" document style -->

    <xsd:element name="getServiceType" type="ssm:EmptyAttributedType"/>

    <xsd:element name="getVersion" type="ssm:EmptyAttributedType"/>

    <xsd:element name="isCompatible" type="ssm:IsCompatibleType"/>

    <xsd:element name="authenticate" type="ssm:AuthenticateType"/>

    <xsd:element name="assertIdentity" type="ssm:AssertIdentityType"/>

    <xsd:element name="isAssertionTokenSupported" type="ssm:IsAssertionTokenSupportedType"/>

    <xsd:element name="validateIdentity" type="ssm:ValidateIdentityType"/>

    <xsd:element name="isAccessAllowed" type="ssm:IsAccessAllowedType"/>

    <xsd:element name="isAuthenticationRequired" type="ssm:IsAuthenticationRequiredType"/>

    <xsd:element name="getCredentials" type="ssm:GetCredentialsType"/>

    <xsd:element name="getRoles" type="ssm:GetRolesType"/>

    <xsd:element name="recordEvent" type="ssm:RecordEventType"/>

    <xsd:element name="locateService" type="ssm:SsmIdType"/>

    <xsd:element name="doesServiceExist" type="ssm:SsmIdType"/>

    <xsd:element name="getServiceTypeResponse" type="ssm:GetServiceTypeReturnType"/>

    <xsd:element name="getVersionResponse" type="ssm:ServiceVersionType"/>

    <xsd:element name="isCompatibleResponse" type="ssm:IsCompatibleReturnType"/>

    <xsd:element name="authenticateResponse" type="ssm:AuthenticationResultType"/>

    <xsd:element name="assertIdentityResponse" type="ssm:AuthenticationResultType"/>

    <xsd:element name="isAssertionTokenSupportedResponse" type="ssm:AssertionTokenSupportedResponseType"/>

    <xsd:element name="validateIdentityResponse" type="ssm:ValidateIdentityResponseType"/>

    <xsd:element name="isAccessAllowedResponse" type="ssm:AuthorizationResultType"/>

    <xsd:element name="isAuthenticationRequiredResponse" type="ssm:AuthenticationRequiredResponseType"/>

    <xsd:element name="getCredentialsResponse" type="ssm:GetCredentialsResultType"/>

    <xsd:element name="getRolesResponse" type="ssm:IdentityRolesType"/>

    <xsd:element name="locateServiceResponse" type="ssm:ComplexAnyURI"/>

    <xsd:element name="doesServiceExistResponse" type="ssm:DoesServiceExistResponseType"/>

    <xsd:element name="recordEventResponse" type="ssm:RecordEventResponseType"/>    

    <xsd:element name="getParameterValue" type="ssm:getParameterValueType"/>

    <xsd:element name="getParameterValueResponse" type="ssm:getParameterValueResponseType"/>  

    <xsd:element name="queryActionsOnResource" type="ssm:QueryActionsOnResourceType"/>

    <xsd:element name="queryActionsOnChildResource" type="ssm:QueryActionsOnChildResourceType"/>

    <xsd:element name="queryActionsOnResourceResponse" type="ssm:QueryActionsOnResourceResultType"/>

    <xsd:element name="queryActionsOnChildResourceResponse" type="ssm:QueryActionsOnChildResourceResultType"/>

 

    <xsd:element name="serviceFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="authenticationFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="authorizationFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="credentialMappingFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="roleMappingFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="auditingFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="registryFailure" type="ssm:FaultInfoType"/>

    <xsd:element name="xacmlFailure" type="ssm:FaultInfoType"/>



 <!-- for bulk authorization API -->

    <xsd:element name="isBulkAccessAllowed" type="ssm:IsBulkAccessAllowedType"/>

    <xsd:element name="isBulkAccessAllowedResponse" type="ssm:BulkAuthorizationResultType"/>

    <xsd:element name="isChildResourceAccessAllowed" type="ssm:IsChildResourceAccessAllowedType"/>

    <xsd:element name="isChildResourceAccessAllowedResponse" type="ssm:BulkChildAuthorizationResultType"/>

 

 <!-- for debug authorization and get roles API -->

    <xsd:element name="isAccessAllowedDebug" type="ssm:IsAccessAllowedDebugType"/>

    <xsd:element name="isAccessAllowedDebugResponse" type="ssm:AuthorizationDebugResultType"/>

    <xsd:element name="getRolesDebug" type="ssm:GetRolesDebugType"/>

    <xsd:element name="getRolesDebugResponse" type="ssm:GetRolesDebugResponseType"/>



</xsd:schema>