Author: coheigea
Date: Tue Feb 25 11:47:05 2014
New Revision: 1571657
URL: http://svn.apache.org/r1571657
Log:
Adding some information on WS-SecurityPolicy to the user guide
Modified:
webservices/wss4j/site/src/site/xdoc/newfeatures20.xml
Modified: webservices/wss4j/site/src/site/xdoc/newfeatures20.xml
URL:
http://svn.apache.org/viewvc/webservices/wss4j/site/src/site/xdoc/newfeatures20.xml?rev=1571657&r1=1571656&r2=1571657&view=diff
==============================================================================
--- webservices/wss4j/site/src/site/xdoc/newfeatures20.xml (original)
+++ webservices/wss4j/site/src/site/xdoc/newfeatures20.xml Tue Feb 25 11:47:05
2014
@@ -31,7 +31,23 @@ information.
<subsection name="WS-SecurityPolicy support">
<p>
-TODO.
+WSS4J 2.0.0 introduces a new WS-SecurityPolicy model as part of the
+"wss4j-policy" module. This model can be shared between both the DOM and StAX
+WS-Security implementations. Web service stacks such as Apache CXF and
+Apache Axis/Rampart that use WSS4J for WS-Security no longer need to maintain
+their own model. In this way any bug fixes to the model will get picked up
+by all web service stacks that rely on WSS4J.
+</p>
+<p>
+In addition to the new WS-SecurityPolicy model, a significant new feature of
+WSS4J 2.0.0 is that the new streaming WS-Security implementation has the
+ability to perform "real-time" validation of a request against the set of
+applicable WS-SecurityPolicy policies. The DOM-based code in WSS4J does not
+have any concept of WS-SecurityPolicy, but instead processes an inbound
+request, and relies on the web service stack to compare the results against
+the applicable policies. The advantage of the streaming approach in WSS4J
+2.0.0 is that bogus requests can be rejected quicker, which may help to avoid
+DoS based scenarios.
</p>
</subsection>
