Currently I use an external policy to apply security policies to the STS 
client.  It seems that the policy is applied based on a static endpoint address 
(http://cxf.apache.org/docs/how-it-works.html).  Since my environment will have 
a different STS address for production than development I would like to avoid 
separate policy files for each endpoint.  Is it possible to create the endpoint 
address based on the endpoint name instead of address like 
{http://docs.oasis-open.org/ws-sx/ws-trust/200512}RequestSecurityToken?  Is 
there a name for the {namespace}name notation used in CXF?  

I've included the start of an external policy showing a sample endpoint address.

<?xml version="1.0" encoding="UTF-8"?>
<attachments xmlns:wsp="http://www.w3.org/ns/ws-policy"; 
xmlns:wsa="http://www.w3.org/2005/08/addressing";>
   <wsp:PolicyAttachment>
      <wsp:AppliesTo>
         <wsa:EndpointReference>
            
<wsa:Address>https://dev-sts.foo.com/services/RequestSecurityToken</wsa:Address>
 
         </wsa:EndpointReference>
      </wsp:AppliesTo>
      <wsp:Policy wsu:Id="UTOverTransport" 
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
         xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy";>
         <wsp:ExactlyOne>
            <wsp:All>

Thanks,

Brandon Richins

Reply via email to