BPEL needs to pass on ws-security elements. Is it possible?

[meghanai_99]

Hello All,

In our scenario, the BPEL process itself doesn't have any security needs but the participating webservices need to support single sign on. So is it possible that BPEL passes on ws-security elements in the <soap:Header> on to all webservices it invokes? Can I somehow configure this behavior?

From the JBossWS documentation and one of the threads on this forum, I know I can create handler that intercepts the SOAP and read headers. But in my case I do not need to read the contents, I only want to pass them along. Can I create something similar that gets called before each 'invoke'?

Thank you,
Meghana

[meghanai_99]

Any idea how I can implement this?

Will it strip off the ws-security header that is coming in or forward them to next call in line? If I have correct 'actor' specified in the security header, will it honor that setting?

[aguizar]

Because BPEL is binding agnostic, a portable process should only access bound SOAP headers (refer to the JBossWS user guide for an explanation of bound headers). This applies to services either consumed or provided by the process.

However, at the moment jBPM does not process SOAP headers. This already appears in our roadmap as BPEL-168.