WSS Module 2.0 Reference | MuleSoft Documentation
# WSS Module 2.0 Reference
WSS Module enables you to process and validate an inbound SOAP request against a given Web Service Security (WSS) extension configuration.
## Configurations
### Inbound
#### Parameters
Name | Type | Description | Default Value | Required  
---|---|---|---|---  
The name for this configuration. Connectors reference the configuration with this name.  
Extract Security Header  
Validate Username Token |  Verify Username Token Config  
Validate Signature |  Verify Signature Config  
Decrypt Message |  Decryption Config  
Validate Timestamp |  Verify Timestamp Config  
Validate SAML Assertion |  Verify Saml Config  
The identifier of this element used to reference it in other components.  
Expiration Policy |  Expiration Policy | Configures the minimum amount of time that a dynamic configuration instance can remain idle before the runtime considers it eligible for expiration. This does not mean that the platform will expire the instance at the exact moment that it becomes eligible. The runtime will actually purge the instances when it sees it fit.  
#### Associated Operations
  * 

### Outbound
#### Parameters
Name | Type | Description | Default Value | Required  
---|---|---|---|---  
The name for this configuration. Connectors reference the configuration with this name.  
Signature Configuration |  Signature Config  
Encryption Configuration |  Encryption Config  
Timestamp Configuration |  Timestamp Config  
'Must Understand' Attribute  
The identifier of this element used to reference it in other components.  
#### Associated Operations
## Operations
### Validate WSS
`<wss:validate-wss>`
#### Parameters
Name | Type | Description | Default Value | Required  
---|---|---|---|---  
Configuration | The name of the configuration to use.  
#[payload]  
Enumeration, one of:
  * SOAP_11
  * SOAP_12

  
Output Mime Type | The mime type of the payload that this operation outputs.  
Output Encoding | The encoding of the payload that this operation outputs.  
Config Ref |  ConfigurationProvider | The name of the configuration used to execute this component.  
Streaming Strategy | 
  * Repeatable In Memory Stream
  * Repeatable File Store Stream
  * Non-Repeatable Stream

| Configure if repeatable streams should be used and their behaviour  
Target Variable | The name of a variable on which the operation's output will be placed  
Target Value | An expression that will be evaluated against the operation's output and the outcome of that expression will be stored in the target variable | #[payload]  
Error Mappings |  Array of Error Mapping | Set of error mappings.  
#### For Configurations.
#### Throws
  * WSS:MISSING_CERTIFICATE 
  * WSS:SECURITY_APPLYING 
  * WSS:SECURITY_VALIDATING 


### Apply WSS
`<wss:apply-wss>`
#### Parameters
Name | Type | Description | Default Value | Required  
---|---|---|---|---  
Configuration | The name of the configuration to use.  
Response | #[payload]  
Enumeration, one of:
  * SOAP_11
  * SOAP_12

  
Output Mime Type | The mime type of the payload that this operation outputs.  
Output Encoding | The encoding of the payload that this operation outputs.  
Config Ref |  ConfigurationProvider | The name of the configuration used to execute this component.  
Streaming Strategy | 
  * Repeatable In Memory Stream
  * Repeatable File Store Stream
  * Non-Repeatable Stream

| Configure if repeatable streams should be used and their behaviour  
Target Variable | The name of a variable on which the operation's output will be placed  
Target Value | An expression that will be evaluated against the operation's output and the outcome of that expression will be stored in the target variable | #[payload]  
Error Mappings |  Array of Error Mapping | Set of error mappings.  
#### For Configurations.
#### Throws
  * WSS:MISSING_CERTIFICATE 
  * WSS:SECURITY_APPLYING 
  * WSS:SECURITY_VALIDATING 


## Types
### Verify Username Token Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Authenticate User Config |  One of:
  * Credentials Config
  * 
| Specific type for the authentication configuration. See AuthenticateUserConfig sub-types.  
Time To Live | The time difference between creation and expiry time in seconds in the UsernameToken Created element.  
Check Nonce | Whether to check the Nonce Element in the UsernameToken. A Nonce is a random value that the sender creates to include in each UsernameToken that it sends. Only checked if included.  
### Verify Signature Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Truststore Config |  Trust Store Configuration | TrustStore configuration used for validating the signature.  
Issuer Pattern | Certificate Issuer pattern.  
Subject Pattern | Certificate Subject pattern.  
### Trust Store Configuration
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
### Decryption Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Keystore Config |  Key Store Configuration | KeyStore configuration used for decryption.  
### Key Store Configuration
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Key Password  
### Verify Timestamp Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Time To Live | The time within which the Timestamp element is valid. The default is 5 minutes.  
Skew Time | The time difference between server and client. The default is 60 seconds.  
Time Unit |  Enumeration, one of:
  * NANOSECONDS
  * MICROSECONDS
  * MILLISECONDS
  * SECONDS
  * MINUTES
  * HOURS

| Time unit to be used in the timeToLive configuration.  
If set to true then validates if the timestamp contains an expires element and the semantics are expired.  
Require Expires Header | Whether timestamp Expires header is required.  
Precision In Milliseconds | If set to true then use timestamps with milliseconds, otherwise omit the milliseconds.  
### Verify Saml Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Saml Version |  Enumeration, one of:
  * SAML10
  * SAML11
  * SAML20

| SAML Version.  
Time To Live | The time in seconds within which a SAML Assertion is valid, if it does not contain a NotOnOrAfter Condition. The default is 30 minutes.  
Skew Time | The time difference between server and client. The default is 60 seconds.  
Time Unit |  Enumeration, one of:
  * NANOSECONDS
  * MICROSECONDS
  * MILLISECONDS
  * SECONDS
  * MINUTES
  * HOURS

| Time unit to be used in the timeToLive and skewTime configuration.  
Require Standard Subject Confirmation Method | If set, at least one of the standard Subject Confirmation Methods in SamlConfirmationMethod **must** be present in the assertion (Bearer / SenderVouches / HolderOfKey).  
Require Bearer Signature | If set, an Assertion with a Bearer Subject Confirmation Method must be signed.  
Validate Signature Against Profile | Whether to validate the signature of the Assertion (if it exists) against the relevant profile. Default is true.  
Required Subject Confirmation Method |  Enumeration, one of:
  * BEARER
  * HOLDER_OF_KEY
  * SENDER_VOUCHES

| If set, the value must appear as one of the Subject Confirmation Methods SamlConfirmationMethod.  
### Expiration Policy
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Max Idle Time | A scalar time value for the maximum amount of time a dynamic configuration instance should be allowed to be idle before it’s considered eligible for expiration  
Time Unit |  Enumeration, one of:
  * NANOSECONDS
  * MICROSECONDS
  * MILLISECONDS
  * SECONDS
  * MINUTES
  * HOURS
| Time unit to be used in the timeToLive and skewTime configuration.  
Require Standard Subject Confirmation Method | If set, at least one of the standard Subject Confirmation Methods in SamlConfirmationMethod **must** be present in the assertion (Bearer / SenderVouches / HolderOfKey).  
Require Bearer Signature | If set, an Assertion with a Bearer Subject Confirmation Method must be signed.  
Validate Signature Against Profile | Whether to validate the signature of the Assertion (if it exists) against the relevant profile. Default is true.  
Required Subject Confirmation Method |  Enumeration, one of:
  * BEARER
  * HOLDER_OF_KEY
  * SENDER_VOUCHES

| If set, the value must appear as one of the Subject Confirmation Methods SamlConfirmationMethod.  
### Expiration Policy
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Max Idle Time | A scalar time value for the maximum amount of time a dynamic configuration instance should be allowed to be idle before it’s considered eligible for expiration  
Time Unit |  Enumeration, one of:
  * NANOSECONDS
  * MICROSECONDS
  * MILLISECONDS
  * SECONDS
  * MINUTES
  * HOURS

| A time unit that qualifies the maxIdleTime attribute  
### Repeatable In Memory Stream
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Initial Buffer Size | This is the amount of memory that will be allocated in order to consume the stream and provide random access to it. If the stream contains more data than can be fit into this buffer, then it will be expanded by according to the bufferSizeIncrement attribute, with an upper limit of maxInMemorySize.  
Buffer Size Increment | This is by how much will be buffer size by expanded if it exceeds its initial size. Setting a value of zero or lower will mean that the buffer should not expand, meaning that a STREAM_MAXIMUM_SIZE_EXCEEDED error will be raised when the buffer gets full.  
Max Buffer Size | This is the maximum amount of memory that will be used. If more than that is used then a STREAM_MAXIMUM_SIZE_EXCEEDED error will be raised. A value lower or equal to zero means no limit.  
Buffer Unit |  Enumeration, one of: | The unit in which all these attributes are expressed  
### Repeatable File Store Stream
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
In Memory Size | Defines the maximum memory that the stream should use to keep data in memory. If more than that is consumed then it will start to buffer the content on disk.  
Buffer Unit |  Enumeration, one of: | The unit in which maxInMemorySize is expressed  
### Error Mapping
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Enumeration, one of:
  * REDELIVERY_EXHAUSTED
  * TRANSFORMATION
  * EXPRESSION
  * SECURITY
  * CLIENT_SECURITY
  * SERVER_SECURITY
  * ROUTING
  * CONNECTIVITY
  * RETRY_EXHAUSTED
  * TIMEOUT

  
### Signature Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Key Identifier |  Enumeration, one of:
  * ISSUER_SERIAL
  * DIRECT_REFERENCE
  * X509_KEY_IDENTIFIER
  * THUMBPRINT
  * SKI_KEY_IDENTIFIER
  * KEY_VALUE

| The key identifier type to use for signature. See SignatureKeyIdentifierConstants | ISSUER_SERIAL  
Algorithm |  Enumeration, one of:
  * RSAwithSHA256
  * ECDSAwithSHA256
  * DSAwithSHA1
  * RSAwithSHA1
  * RSAwithSHA224
  * RSAwithSHA384
  * RSAwithSHA512
  * ECDSAwithSHA1
  * ECDSAwithSHA224
  * ECDSAwithSHA384
  * ECDSAwithSHA512
  * DSAwithSHA256

| The signature algorithm to use. The default is set by the data in the certificate. See SignatureAlgorithmConstants  
Digest Algorithm |  Enumeration, one of:
  * SHA256
  * SHA224
  * SHA384
  * SHA512

| The signature digest algorithm to use. See SignatureDigestAlgorithmConstants  
C14n Algorithm |  Enumeration, one of:
  * CanonicalXML_1_0
  * CanonicalXML_1_1
  * ExclusiveXMLCanonicalization_1_0

| Defines which signature c14n (canonicalization) algorithm to use. See SignatureC14nAlgorithmConstants | ExclusiveXMLCanonicalization_1_0  
Keystore Config |  Key Store Configuration | KeyStore configuration used for signing.  
Wss Parts |  Array of Wss Part | Lists of parts to be encrypted. If any part is specified, the SOAP Body will be encrypted.  
### Wss Part
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Enumeration, one of:
  * ELEMENT
  * CONTENT

  
### Encryption Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Encryption Key Identifier |  Enumeration, one of:
  * ISSUER_SERIAL
  * DIRECT_REFERENCE
  * X509_KEY_IDENTIFIER
  * THUMBPRINT
  * SKI_KEY_IDENTIFIER
  * ENCRYPTED_KEY_SHA1

| The key identifier type to use for encryption. | ISSUER_SERIAL  
Encryption Sym Algorithm |  Enumeration, one of:
  * TRIPLE_DES
  * AES_128
  * AES_256
  * AES_192
  * AES_128_GCM
  * AES_192_GCM
  * AES_256_GCM

| The symmetric encryption algorithm to use.  
Encryption Key Transport Algorithm |  Enumeration, one of:
  * KEYTRANSPORT_RSA15
  * KEYTRANSPORT_RSAOAEP
  * KEYTRANSPORT_RSAOAEP_XENC11

| The algorithm used to encrypt the generated symmetric key. | KEYTRANSPORT_RSAOAEP  
Encryption Digest Algorithm |  Enumeration, one of:
  * SHA256
  * SHA384
  * SHA512

| The encryption digest algorithm to use with the key transport algorithm.  
Keystore Config |  Key Store Configuration | KeyStore configuration used for encryption.  
Wss Parts |  Array of Wss Part | Lists of parts to be encrypted. If any part is specified, the SOAP Body will be encrypted.  
### Timestamp Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Time To Live | The time within which the Timestamp element is valid. The default is 5 minutes.  
Time Unit |  Enumeration, one of:
  * NANOSECONDS
  * MICROSECONDS
  * MILLISECONDS
  * SECONDS
  * MINUTES
  * HOURS

| Time unit to be used in the timeToLive configuration.  
Precision In Milliseconds | If set to true then use timestamps with milliseconds, otherwise omit the milliseconds.  
### Credentials Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Username | Username.  
Password | Password.  
### LDAP Config
Field | Type | Description | Default Value | Required  
---|---|---|---|---  
Provider Url | LDAP Server URL.  
User that will authenticate to the directory.  
Password | Credentials to use for getting authenticated contexts.  
Search Base | The search base defines the starting point for the search in the directory tree.  
Search Filter | Filters can be used to restrict the numbers of users or groups that are permitted to access an application.  
Search In Subtree | Whether to search in subtree.