Configuration Guides › Policy Server Configuration Guide › Authentication Schemes › WS‑Security Authentication › Additional WS‑Security Features › XML Signature Scope

XML Signature Scope

SOA Security Manager provides three options for defining what elements of an incoming SOAP message are digitally signed when configuring WS‑Security authentication using either Username and Password Digest or X509v3 tokens:

• Signature must cover the entire document
• Signature must cover the body of the message
• Signature need apply only to headers

Notes:

For the Username and Password Digest token, XML digital signatures are optional.

If the authentication scheme is configured to require the timestamp element, the digital signature must cover that timestamp.

SAML token authentication has its own requirements for what elements of a SOAP message must be digitally signed; these are defined implicitly based on the subject confirmation methods that you require.