Java 1.8 SOAP stack: An older SOAP stack, only loaded by integration servers running Java 1.8 (this is the same stack used in previous ACE versions). This stack consists of:
- WebSphere Application Server (WAS) Axis2
- Additional WAS libraries
- Jakarta EE 8 (this version predates the API namespace move from javax to jakarta)
Java 17 SOAP stack: A new SOAP stack, only be loaded by integration servers running Java 17. This stack consists of:
- Open source Apache Axis2
- Open source Apache Rampart
- Jakarta EE 10 (this version no longer uses the javax namespace and uses the jakarta namespace instead)
Due to our adoption of Apache Rampart for the future support of WS-Security in Java 17 servers, it has been necessary for some of the ACE product externals to change in this release, but we have also tried to keep a similar look and feel to help users who may be familiar with this functional area in past versions of the product. The most noticeable change comes in the area of policy sets and bindings files. In previous ACE versions, web service policy sets and bindings files were defined within a policy project but they did not use the .policyxml file extension and they were not presented in the same way as other policy files. These older web service policy sets and bindings files carried the required ACE configuration for both WS-Security and WS-ReliableMessaging settings, for the SOAP Input, SOAP Reply, SOAP Request, SOAP AsyncRequest, and SOAP AsyncResponse nodes. Starting in ACE 13.0.7.0:
- WS-ReliableMessaging information has now been separated into its own dedicated policy file with the standard
.policyxml file extension (there is a deeper description of this lower down this blog).
- For the WS-Security information, a Toolkit user will create a new policy with the standard
.policyxml file extension. There are two different WS-Security policy types provided in ACE 13.0.7.0: WS-Security Input (which is used by provider message flows that contain SOAP Input and SOAP Reply nodes) and WS-Security Request (which is used by consumer message flows that contain SOAP Request nodes). Each of these policy types has sections for controlling the Message Signing and Message Encryption both for request messages and reply messages.
The diagram below shows a situation where ACE is fulfilling the role of both Web Service Consumer and Web Service Provider. The blue and green arrows and boxes are designed to demonstrate which part of each policy influences which part of the communication between Consumer and Provider.

In this scenario, the four stages below describe what is happening to the data as it flows back and forth:
- The Consumer encrypts the data using the Provider’s public certificate, and signs the data using the Consumer’s private key
- The Provider decrypts the data using the Provider’s private key, and verifies the data signature using the Consumer’s public key
- The Provider encrypts the reply data using the Consumer’s public certificate, and signs the data using the Provider’s private key
- The Consumer decrypts the data using the Consumer’s private key, and verifies the data signature using the Provider’s public key
For this example, here is the WS-Security Request Policy:
When you click on the Configure button, a new window opens which shows a more detailed set of configuration panels that should be familiar to users of WS-Security in earlier versions of the ACE product. This window can be used to specify further details about the Token types you would like to use, and your chosen configuration if doing Message Part protection. To help explain how this panel could be used when configuring a Web Service Consumer, this example has also been annotated with numbers to match the four stages of flowing data that were defined above.
For this example, here is the WS-Security Input Policy:
When you click on the Configure button, the same more detailed configuration window opens. To help explain how this panel could be used when configuring a Web Service Provider, this example has also been annotated with the same numbers to match the four stages of flowing data that were defined above.
Having configured these policies you will find the following files stored inside your Policy Projects. In this example we have a separate Policy Project for the Web Service Consumer (named DemoConsumerPolicies) and the Web Service Provider (named DemoProviderPolicies):
The SOAP Input node in the Provider message flow references the DemoProvider policy:
The SOAP Request node in the Consumer message flow references the DemoConsumer policy: