# Configuring the extra properties

There are several extra properties that may need to be set to provide the additional bits of information to the runtime.

User PropertiesUser Properties

| ws-security.username | The user's name. It is used differently by each of the WS-Security functions,<br>see the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#USERNAME) for more information. |
| --- | --- |
| ws-security.password | The user's password when ws-security.callback-handler is not<br>defined. It is currently only used for the case of adding a password to a<br>UsernameToken. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#SIGNATURE_USERNAME) for more information. |
| ws-security.signature.username | The user's name for signature. It is used as the alias name in the keystore to<br>get the user's cert and private key for signature. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#SIGNATURE_USERNAME) for more information. |
| ws-security.encryption.username | The user's name for encryption. It is used as the alias name in the keystore<br>to get the user's public key for encryption. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#ENCRYPT_USERNAME) for more information. |

Callback Class and Crypto propertiesCallback Class and Crypto properties

| ws-security.callback-handler | The WSS4J security [CallbackHandler](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#CALLBACK_HANDLER) class used for passwords. |
| --- | --- |
| ws-security.saml-callback-handler | The SAML [CallbackHandler](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#SAML_CALLBACK_HANDLER) class used to construct SAML Assertions. |
| ws-security.signature.properties | The Crypto property [configuration](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#SIGNATURE_PROPERTIES) to use for signature, if "ws-security.signature.crypto" is<br>not set instead. |
| ws-security.encryption.properties | The Crypto property [configuration](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#ENCRYPT_PROPERTIES) to use for encryption, if "ws-security.encryption.crypto"<br>is not set instead. |
| ws-security.signature.crypto | A [Crypto](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/common/crypto/Crypto.html) object to be used for signature. If this is not defined then<br>"ws-security.signature.properties" is used instead. |
| ws-security.encryption.crypto | A [Crypto](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/common/crypto/Crypto.html) object to be used for encryption. If this is not defined then<br>"ws-security.encryption.properties" is used instead. |

Boolean WS-Security configuration tags (true or false values only)Boolean WS-Security configuration tags (true or false values only)

| Constant | Default | Description |
| --- | --- | --- |
| ws-security.validate.token | true | Whether to validate the password of a received UsernameToken or not. |
| ws-security.enableRevocation | false | Whether to enable Certificate Revocation List (CRL) checking or not when<br>verifying trust in a certificate. |
| ws-security.username-token.always.encrypted | true | Whether to always encrypt UsernameTokens that are defined as a<br>SupportingToken. This should not be set to false in a production environment, as<br>it exposes the password (or the digest of the password) on the wire. |
| ws-security.is-bsp-compliant | true | Whether to enforce compliance with the Basic Security Profile (BSP) 1.1 or<br>not. |
| ws-security.self-sign-saml-assertion | false | Whether to self-sign a SAML Assertion or not. If this is set to true, then an<br>enveloped signature will be generated when the SAML Assertion is<br>constructed. |
| ws-security.enable.nonce.cache | (varies) | Whether to cache UsernameToken nonces. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#ENCRYPT_USERNAME) for more information. |
| ws-security.enable.timestamp.cache | (varies) | Whether to cache Timestamp Created Strings. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#ENCRYPT_USERNAME) for more information. |

Non-boolean WS-Security Configuration parametersNon-boolean WS-Security Configuration parameters

| ws-security.timestamp. timeToLive | The time in seconds to append to the Creation value of an incoming Timestamp<br>to determine whether to accept the Timestamp as valid or not. The default value is<br>300 seconds (5 minutes). |
| --- | --- |
| ws-security.timestamp. futureTimeToLive | This configuration tag specifies the time in seconds in the future within<br>which the Created time of an incoming Timestamp is valid. The default value is 60<br>seconds. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#TIMESTAMP_FUTURE_TTL) for more information. |
| ws-security. saml-role-attributename | The attribute URI of the SAML AttributeStatement where the role information is<br>stored. The default is<br>"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role". |
| ws-security.kerberos.client | A reference to the [Kerberos](https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java) client object class used to obtain a service ticket. |
| ws-security.spnego.client.action | The [SpnegoClientAction](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/common/spnego/SpnegoClientAction.html) implementation to use for SPNEGO. This allows the<br>user to plug in a different implementation to obtain a service ticket. |
| ws-security.kerberos.jaas.context | The JAAS Context name to use for Kerberos. This is currently only supported<br>for SPNEGO. |
| ws-security.kerberos.spn | The Kerberos Service Provider Name (spn) to use. This is currently only<br>supported for SPNEGO. |
| ws-security.nonce.cache.instance | This holds a reference to a [ReplayCache](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/common/cache/ReplayCache.html) instance used to cache UsernameToken nonces. The default<br>instance that is used is the [EHCacheReplayCache.](http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/cache/EHCacheReplayCache.java?view=markup) |
| ws-security.timestamp.cache.instance | This holds a reference to a [ReplayCache](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/common/cache/ReplayCache.html) instance used to cache Timestamp Created Strings. The<br>default instance that is used is the [EHCacheReplayCache.](http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/cache/EHCacheReplayCache.java?view=markup) |
| ws-security.cache.config.file | Set this property to point to a configuration file for the underlying caching<br>implementation. The default configuration file that is used is [cxf-ehcache.xml](https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/resources/cxf-ehcache.xml?view=markup) in the cxf-rt-ws-security module. |
| org.apache.cxf.ws.security. tokenstore.TokenStore | The [TokenStore](https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/TokenStore.java?view=markup) instance to use to cache security tokens. By default this<br>uses the [EHCacheTokenStore](https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/EHCacheTokenStore.java?view=markup) if EhCache is available. Otherwise it uses the [MemoryTokenStore](https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/MemoryTokenStore.java?view=markup) |
| ws-security.subject.cert.constraints | A comma separated String of regular expressions which will be applied to the<br>subject DN of the certificate used for signature validation, after trust<br>verification of the certificate chain associated with the certificate. These<br>constraints are not used when the certificate is contained in the keystore (direct<br>trust). |

Validator implementations for validating received security tokensValidator implementations for validating received security tokens

| ws-security.ut.validator | The WSS4J Validator instance to use to validate UsernameTokens. The default<br>value is the [UsernameTokenValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/UsernameTokenValidator.html). |
| --- | --- |
| ws-security.saml1.validator | The WSS4J Validator instance to use to validate SAML 1.1 Tokens. The default<br>value is the [SamlAssertionValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/SamlAssertionValidator.html). |
| ws-security.saml2.validator | The WSS4J Validator instance to use to validate SAML 2.0 Tokens. The default<br>value is the [SamlAssertionValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/SamlAssertionValidator.html). |
| ws-security.timestamp.validator | The WSS4J Validator instance to use to validate Timestamps. The default value<br>is the [TimestampValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/TimestampValidator.html). |
| ws-security.signature.validator | The WSS4J Validator instance to use to validate trust in credentials used in<br>Signature verification. The default value is the [SignatureTrustValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/SignatureTrustValidator.html). |
| ws-security.bst.validator | The WSS4J Validator instance to use to validate BinarySecurityTokens. The<br>default value is the [NoOpValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/NoOpValidator.html). |
| ws-security.sct.validator | The WSS4J Validator instance to use to validate SecurityContextTokens. The<br>default value is the [NoOpValidator](http://ws.apache.org/wss4j/apidocs/org/apache/wss4j/dom/validate/NoOpValidator.html). |

STS Client Configuration tagsSTS Client Configuration tags

| ws-security.sts.client | A reference to the STSClient class used to communicate with the STS. |
| --- | --- |
| ws-security.sts.applies-to | The "AppliesTo" address to send to the STS. The default is the endpoint<br>address of the service provider. |
| ws-security.sts.token.usecert | If true, writes out an X509Certificate structure in UseKey/KeyInfo. If false<br>(the default), writes out a KeyValue structure instead. |
| ws-security.sts.token.do.cancel | Whether to cancel a token when using SecureConversation after successful<br>invocation. The default is "false". |
| ws-security.cache.issued. token.in.endpoint | Set this to "false" to not cache a SecurityToken per proxy object in the<br>IssuedTokenInterceptorProvider. This should be done if a token is being retrieved<br>from an STS in an intermediary. The default value is "true". |
| ws-security.sts.disable-wsmex-call-using-epr-address | Whether to avoid STS client trying send WS-MetadataExchange call using STS EPR<br>WSA address when the endpoint contract contains no WS-MetadataExchange info. The<br>default value is "false". |
| ws-security.sts.token.crypto | A Crypto object to be used for the STS. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#STS_TOKEN_CRYPTO) for more information. |
| ws-security.sts.token.properties | The Crypto property configuration to use for the STS. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#STS_TOKEN_PROPERTIES) for more information. |
| ws-security.sts.token.username | The alias name in the keystore to get the user's public key to send to the STS<br>for the PublicKey KeyType case. |
| ws-security.sts.token.act-as | The token to be sent to the STS in an "ActAs" field. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#STS_TOKEN_ACT_AS) for more information. |
| ws-security.sts.token.on-behalf-of | The token to be sent to the STS in an "OnBehalfOf" field. See the [JavaDoc](http://cxf.apache.org/javadoc/latest/org/apache/cxf/ws/security/SecurityConstants.html#STS_TOKEN_ON_BEHALF_OF) for more information. |

Note: for Symmetric bindings that specify a protection token, the ws-security-encryption properties are used.

### In this section

* [Configuring via Spring](https://help.qlik.com/talend/en-US/esb-service-developer-guide/8.0/configuring-via-spring)
* [Configuring via API's](https://help.qlik.com/talend/en-US/esb-service-developer-guide/8.0/configuring-via-api-s)