Migrating WS-Security policy sets and bindings to Java 17

Use the IBM® App Connect Enterprise Toolkit migration function to convert WS-Security policy sets and bindings from the Java 8 format to Java 17 policy artifacts. Then update your SOAP nodes and redeploy your applications to Java 17 integration servers.

1. In the IBM App Connect Enterprise Toolkit, right-click the Java 8 WS-Security policy binding that you want to migrate in the Application Development view, then click Migrate (Java 8) WS Policy Sets and Bindings.

   The policy binding is listed under the (Java 8) WS Policy Sets and Bindings virtual folder in the policy project.

2. Complete the migration flow in the wizard.

   Review the selected resources, then complete the migration to generate the Java 17 policy artifacts in the policy project.

3. Review the generated Java 17 policy artifacts.

   The migrated resources can include a WS Policy file and a WS Security policy. The type of WS Security policy that is generated depends on the binding mode:

   • A consumer binding is converted to a WS Security Request policy (.policyxml).
   • A provider binding is converted to a WS Security Input policy (.policyxml).

   Tip: For example, in a provider scenario, the generated artifacts can include a WS Security Input policy such as {ProviderPolicies}:UsernameTokenProvider.

   Note: Security profiles are not created or modified by the migration wizard. Any existing security profiles in your project remain unchanged.
4. Update the SOAP nodes in your message flows to reference the migrated Java 17 policies.
   1. Open a message flow that uses WS-Security.
   2. Open the properties for the SOAP node that you want to update.
   3. Set the WS-Security policy property to the migrated WS Security policy.
   4. If required, set the Security Profile property to the migrated security profile.
   5. In the BAR file editor, remove the old Java 8 policy set and binding references. These references can be set at the node level or the flow level in the BAR file editor, and must be cleared there rather than in the flow editor.
   6. Save the changes.

   Important: If you set the WS-Security policy property on a SOAP node and deploy the message flow to a Java 8 integration server, an error occurs. This property is supported only in Java 17 integration servers.
5. Build a BAR file that contains the migrated policy project and the updated application resources.
   1. Create a BAR file, or update an existing BAR file.
   2. Add the migrated policy project and the service application.
   3. If old Java 8 policy files are still included, remove the .wssecpolicy.xml and .wssecbindings.xml files from the BAR file.
   4. Save the BAR file.

   Important: Ensure that the BAR file contains the migrated policy project as well as the application resources. If the policy project is not included, the deployed flow cannot resolve the migrated policy references.
6. Deploy the BAR file to a Java 17 integration server and test the migrated service.

   If the target integration server is not already configured for Java 17, reconfigure it before testing.

   Verify that the deployed message flows resolve the migrated policy references correctly and that WS-Security processing works as expected.

   For more information about testing and deployment, see Testing your Java 17 migration and Deploying to Java 17 integration servers.