Configuration Guides › Policy Configuration Guide › SOA Security Manager Configuration Overview › Policy Management Methods

Policy Management Methods

SOA Security Manager provides two policy management methods for securing your SOA resources:

• Enterprise Policy Management Using Application Objects

  The recommended method for creating and managing new security policies for your SOA environment is to define application objects that represent one or more related web services and then generate the component and resource settings that define what to protect from associated WSDL files.

  Note: Application objects do not support policy expressions using variable objects. Content-based authorization using variables must be implemented using traditional policy management.

• Traditional Policy Management Using Policy Domains and Policy Domain Objects

  For Policy Server administrators already comfortable with earlier releases of SOA Security Manager or TransactionMinder, traditional policy management — using policy domains and domain objects (realms, rules, responses, polcies, and so on) — can still be used to perform manual configuration of security policies for web service resources.

  Traditional policy management must also be used to modify policies created traditionally and migrated from a previous SOA Security Manager deployment or to implement content-based authorization using variables.

Important! While traditional policy management provides all the same policy objects as in previous releases, the user interface is different — you must use the Administrative UI; even if available, you must not use the Policy Server User Interface to create new or manipulate existing policies.