Conclusion

Accessing Web services continues to become more and more complicated as new security and other XML messaging requirements evolve . Being able to specify the requirements for accessing a Web service can make things much easier, and WS-Policy and WS-PolicyAttachment enable policy assertions to be exposed in any arbitrary XML or in the WSDL discovery document. Although WSE provides only a basic implementation of WS-Policy in version 2.0 and doesnt support WSDL integration, it does support basic policies for making Confidentiality and Integrity assertions about your WSE-enabled Web service. In addition, WSE lets you write your own custom policy assertion handlers, and it will enforce send policy statements by automatically retrieving tokens from the security token cache and using them to encrypt or sign messages when required by the policy. Im hoping that future versions of WSE will build on this policy framework to enable the publishing of more descriptive policies.