Configuration Guides › Policy Server Configuration Guide › Authentication Schemes › WS‑Security Authentication › Additional WS‑Security Features › SOAP Actor/Role Attributes in Messages with Multiple WS‑Security Headers

SOAP Actor/Role Attributes in Messages with Multiple WS‑Security Headers

If a SOAP document has multiple WS‑Security headers (intended for different recipients), the WS‑Security specification requires that each be identified uniquely using the SOAP actor/role attribute (at most, one header can omit the SOAP actor attribute).

The WS‑Security authentication scheme lets you specify the value of the SOAP actor/role attribute that identifies the header element from which SOA Security Manager should obtain security tokens.

Note: If a message has only one WS‑Security header, it does not need to include a SOAP actor attribute. However, if you specify an actor/role attribute when configuring the authentication scheme, a matching actor attribute must be present in the document to allow successful authentication.