Service reference settings

Service reference settings

Use this administrative console page to manage the settings for our service references. Service references can inherit the policy sets and bindings of the service client or we can specify policy sets and bindings that are different from those of the service client.

This service references page displays configuration information for a service reference and the associated endpoints and operations. We can view and configure the service reference to either inherit policy set and binding configurations from the service client or to specify individual settings for the service reference by attaching policy sets and bindings that are different from the policy sets and bindings that are attached to the service client.

The Application, Module, and Service client links provide access to the application, module, and service client settings page.

From the admin console, click Services > Service clients > service_reference_instance.

We can also view this page by clicking Applications > Application Types > WebSphere enterprise applications > service_client_application_instance > Service clients > service_reference_instance.

We can specify a policy set and binding for a service reference that is different from the policy set attachment for the service. In addition, we can indicate to not attach a policy set to a service reference, even if a policy set is attached to the service. The default behavior is that a service reference, and its endpoints and operations, inherits the policy set attachment of the corresponding resources of the service. Service references are only valid for the client attachment type.

To attach or detach a policy set or binding:

Select a service reference, endpoint, or operation from Service Reference/Endpoint/Operation. The Service Reference/Endpoint/Operation list is nested, indicating parent-child relationships. When we select a parent, the children automatically inherit the settings of the parent.
Click the button for the action to complete.

Button Resulting action
Inherit Click this button to clear the existing policy set and binding settings for the service reference and to use policy set attachments defined by the service client. By default, a service reference, as well as its endpoints and operations, inherits the policy set attachment of the corresponding resources of the service.
Override Click this button to override the existing policy set and binding settings for the service client and to either define separate policy sets and bindings for the service reference or to specify that a policy set is not attached to the service reference.
Attach Client Policy Set Click this button to view a list of policy sets available for attachment to the selected service reference, endpoint, or operation. Select a policy set from the list to attach; that policy set is attached to the selected service, endpoint, or operation. To close the menu list, click Attach Client Policy Set. This button is active only after we have clicked the Override button.
Detach Client Policy Set Click this button to detach a policy set from a selected service reference, endpoint, or operation. After the policy set is detached, if there is no policy set attached to an upper-level service resource, the Attached Client Policy Set column displays None and the Binding column displays Not Applicable.
If there is a policy set attached to an upper-level service reference resource or service client, the Attached Client Policy Set column displays policy_set_name (inherited) and the binding used for the upper-level attachment is applied. The binding name is displayed followed by (inherited).

This button is active only after we have clicked the Override button.

Assign Binding Click this button to select from a list of available bindings for the selected policy set attachment.
The options include the following:

Default

Default binding for the selected service reference, endpoint, or operation. We can specify client and provider default bindings to be used at the cell level or global security domain level for a particular server or for a security domain. The default bindings are used when an application-specific binding has not been assigned to the attachment. When we attach a policy set to a service resource, the binding is initially set to the default. If we do not specifically assign a binding to the attachment point using this Assign Binding action, the default specified at the nearest scope is used.
For any policy set attachment, the runtime environment verifies whether the attachment includes a binding. If so, it uses that binding. If not, the runtime environment checks in the following order and uses the first available default binding:

Default general bindings for the server
Default general bindings for the domain in which the server resides
Default general bindings for the global security domain

New Application Specific Binding

Select this option to create a new application-specific binding for the policy set attachments. The new binding we create is used for the selected resources. If we select more than one resource, ensure that all selected resources have the same policy set attached.

Client sample

Select this option to use the Client sample binding.

Client sample V2

Select this option to use the Client sample V2 binding when we are using either the Kerberos V5 WSSecurity default or the TrustServiceKerberosDefault policy sets.

Saml Bearer Client sample

Select this option to use the Saml Bearer Client sample. The Saml Bearer Client sample extends the Client sample binding to support SAML Bearer token usage scenarios. Use this sample with any of the SAML bearer token default policy sets.

Saml HoK Symmetric Client sample

Select this option to use the Saml HoK Symmetric Client sample. The Saml HoK Symmetric Client sample extends the Client sample binding to support SAML holder-of-key (HoK) symmetric key token usage scenarios. Use this sample with one of the SAML HoK Symmetric key default policy sets: either SAML11 HoK Symmetric WSSecurity default or SAML20 HoK Symmetric WSSecurity default.

To close the menu list, click Assign Binding.

This button is active only after we have clicked the Override button.

Display inherit policy set attachments confirmation

Select this check box specifies to enable the inherit policy set attachments confirmation. We must expand the Preferences section to select this check box.

Service Reference/Endpoint/Operation

Name of the service reference, endpoints, or operations. The full resource name is displayed when you hover the mouse pointer over a service reference, endpoint or operation.

Client Policy Set

Policy set that is attached to the service reference, endpoints, or operations.

The Attached Client Policy Set column can contain the following values:

None. No policy set is attached, either directly to the service client, or to a higher-level service reference resource.
policy_set_name. The name of the policy set that is attached directly to the service reference resource, for example, WS-I RSP.
policy_set_name (inherited). The name of the policy set that is not attached directly to a service reference resource; the policy set is attached to a higher-level service reference resource or to a service client resource.

When the value in the column is a link, click the link to view or change settings about the attached policy set.

Policies Applied

Policies applied to the service reference.

The Policies Applied service reference link is only enabled after we have clicked the Override button.

The Policies Applied column can contain the following values:

None. No policies are applied to the service. This is the default setting if there is no policy set attached to the client.
Client only. The client policy set is applied to the service. This is the default setting if a policy set is attached to the client.
Provider only. The policy configuration of the service provider is applied to the service, as long as the client can support those policies.
Client and provider. A policy based on both the client policy set and the policy of the service provider is applied to the service.

When the value in the column is a link, click the link to view or change settings about how the policies are applied.

For an endpoint or operation, the value is not a link and it is followed by the word inherited in parentheses. The setting is inherited from the parent application or service and we cannot change it. If there is no applied policy, the entries in the column are None or None (inherited).

Binding

Binding information available for a service reference, endpoint, or operation.

The Binding column can contain the following values:

Not applicable. There is no policy set attached, either directly to the service client, or to a higher-level service reference resource.
Binding_name or Default. The binding name is displayed if a policy set is attached directly and an application-specific binding or a general binding is assigned, for example, MyBindings1. Default is displayed if a policy set is attached directly but the service reference resource uses the default bindings.
Binding_name (inherited) or Default (inherited). A service resource inherits the bindings from an attachment to a higher-level service reference resource or to a service client resource.

About policy set bindings

In this release, there are two types of bindings: application-specific bindings and general bindings.

Application-specific bindings

Create application-specific bindings only at a policy set attachment point. These bindings are specific to, and constrained by, the characteristics of the defined policy. Application-specific bindings can provide configuration for advanced policy requirements such as multiple signatures; however, these bindings are reusable only within an application. Also, application-specific bindings have very limited reuse across policy sets.

When we create an application-specific binding for a policy set attachment, the binding begins in a completely unconfigured state. We must add each policy, such as WS-Security or HTTP transport, to override the default binding, and fully configure the bindings for each policy that we add. For WS-Security policy, some high-level configuration attributes such as TokenConsumer, TokenGenerator, SigningInfo, or EncryptionInfo might be obtained from the default bindings if they are not configured in the application-specific bindings.

For service providers, we can create application-specific bindings only by selecting Assign Binding > New Application Specific Binding, on the Service providers policy sets and bindings collection page, for service provider resources that have an attached policy set. Similarly, for service clients, we can create application-specific bindings only by selecting Assign Binding > New Application Specific Binding, on the Service clients policy sets and bindings collection page, for service client resources that have an attached policy set.

General bindings

We can configure general bindings to be used across a range of policy sets and they can be reused across applications and for trust service attachments. Although general bindings are highly reusable, they cannot provide configuration for advanced policy requirements such as multiple signatures. There are two types of general bindings: general provider policy set bindings and general client policy set bindings.

Create general provider policy set bindings by clicking Services > Policy sets > General provider policy set bindings > New in the general provider policy sets panel, or by clicking Services > Policy sets > General client.policy set bindings > New in the general client policy set and bindings panel. Read about defining and managing service client or provider bindings for more information. General provider policy set bindings might also be used for trust service attachments.

Manage policy sets and bindings for services references
Service providers collection at the application level
Service client collection at the cell level
Service client settings
Service provider policy sets and bindings collection
Service client policy set and bindings collection
Service providers collection at the cell level
Policies applied settings
Administrative roles

Button	Resulting action
Inherit	Click this button to clear the existing policy set and binding settings for the service reference and to use policy set attachments defined by the service client. By default, a service reference, as well as its endpoints and operations, inherits the policy set attachment of the corresponding resources of the service.
Override	Click this button to override the existing policy set and binding settings for the service client and to either define separate policy sets and bindings for the service reference or to specify that a policy set is not attached to the service reference.
Attach Client Policy Set	Click this button to view a list of policy sets available for attachment to the selected service reference, endpoint, or operation. Select a policy set from the list to attach; that policy set is attached to the selected service, endpoint, or operation. To close the menu list, click Attach Client Policy Set. This button is active only after we have clicked the Override button.
Detach Client Policy Set	Click this button to detach a policy set from a selected service reference, endpoint, or operation. After the policy set is detached, if there is no policy set attached to an upper-level service resource, the Attached Client Policy Set column displays None and the Binding column displays Not Applicable. If there is a policy set attached to an upper-level service reference resource or service client, the Attached Client Policy Set column displays policy_set_name (inherited) and the binding used for the upper-level attachment is applied. The binding name is displayed followed by (inherited). This button is active only after we have clicked the Override button.
Assign Binding	Click this button to select from a list of available bindings for the selected policy set attachment. The options include the following: Default Default binding for the selected service reference, endpoint, or operation. We can specify client and provider default bindings to be used at the cell level or global security domain level for a particular server or for a security domain. The default bindings are used when an application-specific binding has not been assigned to the attachment. When we attach a policy set to a service resource, the binding is initially set to the default. If we do not specifically assign a binding to the attachment point using this Assign Binding action, the default specified at the nearest scope is used. For any policy set attachment, the runtime environment verifies whether the attachment includes a binding. If so, it uses that binding. If not, the runtime environment checks in the following order and uses the first available default binding: Default general bindings for the server Default general bindings for the domain in which the server resides Default general bindings for the global security domain New Application Specific Binding Select this option to create a new application-specific binding for the policy set attachments. The new binding we create is used for the selected resources. If we select more than one resource, ensure that all selected resources have the same policy set attached. Client sample Select this option to use the Client sample binding. Client sample V2 Select this option to use the Client sample V2 binding when we are using either the Kerberos V5 WSSecurity default or the TrustServiceKerberosDefault policy sets. Saml Bearer Client sample Select this option to use the Saml Bearer Client sample. The Saml Bearer Client sample extends the Client sample binding to support SAML Bearer token usage scenarios. Use this sample with any of the SAML bearer token default policy sets. Saml HoK Symmetric Client sample Select this option to use the Saml HoK Symmetric Client sample. The Saml HoK Symmetric Client sample extends the Client sample binding to support SAML holder-of-key (HoK) symmetric key token usage scenarios. Use this sample with one of the SAML HoK Symmetric key default policy sets: either SAML11 HoK Symmetric WSSecurity default or SAML20 HoK Symmetric WSSecurity default. To close the menu list, click Assign Binding. This button is active only after we have clicked the Override button.