Configuration Guides › Policy Server Configuration Guide › Authentication Schemes › WS‑Security Authentication › Additional WS‑Security Features › Username and Password Digest Token Age Restrictions

Previous Topic: SOAP Actor/Role Attributes in Messages with Multiple WS‑Security Headers

Next Topic: Configure the WS‑Security Authentication Scheme
Username and Password Digest Token Age Restrictions

The WS-Security authentication scheme provides protection against replay attacks using Username and Password Digest tokens by imposing a "freshness" restriction (60 minutes by default) on the age of the token. That is, if a token was created more than 60 minutes ago according to its <wsu:Created> timestamp, authentication fails.

The token age restriction for Username and Password Digest Tokens can be configured at the agent level. For more information, see the SOA Agent Configuration Guide.