WS-Security Inbound Policy Configuration for no-header in WebSphere
Recently I was working on WS-Security configuration for my Web Service client. Particularly in my case Service Provider is expecting a security header with username and password digest token along with time-stamp header. But the response does not contains any header element. After configuring the client policy, I was continuously seeing following message along with error trace which did not tell much about the problem cause.
There are no Header elements in the inbound SOAP message, so there is no Security header to process.
Later I realized that WS-Security runtime in WebSphere is expecting a time-stamp header in the inbound message and since my provider is not sending it.. its not letting that response processes and producing an error message. With the help of Integration expert in my team, I found that we would need to configure a custom property in Client binding for inbound message which will skip header check and let the message process successfully.
com.ibm.wsspi.wssecurity.consumer.timestampRequired
Below here is the info center link for more custom property, keeping it handy for my quick reference.
WebSphere Application Server (Distributed operating systems), Version 8.5 > Reference > Custom properties