Oracle Web Services Manager Architecture (OWSM)

Oracle Web Services Manager (OWSM) is component of Oracle SOA Suite . This component is used to secure Web Services and to monitor activities performed on protected Web Services.

Architecture of OWSM
OWSM Architecture

Oracle Web Service Manager consist of following components

A) Policy Enforcement Points (PEP) – Agents and Gateway
B) OWSM Policy Manager
C) OWSM Monitor
D) OWSM Control
E) OWSM Database

A. Policy Enforcement Points (PEP)– PEP are used to manage and enforce security of Web Services. Two type of PEPs are
i) OWSM Gateway – Gateways are deployed on J2EE container and acts as proxy to Web Service Client.
ii) OWSM Agents– These are further subdivided in to two kind Client Agent & Server Agent.
Client Agent intercept request from Web Service Client and enforces policy steps like encryption or signatures.
Server Agent intercept web service request before it reaches to protected web service and enforces access control like authentication and authorization.

B. OWSM Policy Manager– This component is installed on J2EE container and used for Web Service Registration, Policy Configuration and Policy Communication. OWSM manager uses OWSM database to store policies and upload it to all PEPs (Agents and Gateways)

C. OWSM Policy Monitor– This further consist of two components Collector and Aggregator. Collector collect information from PEP and Aggregator applies aggregation rules so that information can be defined in graphical format. OWSM Policy monitor manages collection and aggregation of data for monitoring Web Service Traffic.

D. OWSM Control – This is Web Based console to administer OWSM (Oracle Web Services Manager) components like Policy Manager and Policy Monitor.

E. OWSM Database – This is used to store policy data, monitoring data and system configuration.

URL for Oracle WSM Control is http ://hostname.domainname:port/ccore

Username & Password for ccore (owsm) is admin/oracle (This is different from other SOA comnponent where username is oc4jadmin)

Share This Post with Your Friends over Social Media!

About the Author Atul Kumar

Oracle ACE, Author, Speaker and Founder of K21 Technologies & K21 Academy : Specialising in Design, Implement, and Trainings.

follow me on:

Leave a Comment:

awesome says December 21, 2007

I’ve a question on this architecture diagram. If the gateways are load balanced (active active), why Oracle suggested to implement active/passive architecture for OWSM Monitor? Is there any specific reason?

Atul says December 23, 2007

Hi Awesome,
Could you please share doc which says that owsm monitor should be in active/passive ?

awesome says December 26, 2007

see the below oracle doc link

Figure 2-1 from the above link says that OWSM monitor is not load balanced. Moreover we have single monitor for the load balanced gateway.

Actually we are upgrading from OWSM 3.5.4 to and from the document we decided to have active/passive model for monitor and active/active model for gateway & policy manager.

however in our current setup (OWSM 3.5.4) gateway, policymanager and monitor are load balanced (active/active)

do you know why Oracle proposed a active/passive model for monitor in OWSM

your information in this regard is highly appreciated.


awesome says December 26, 2007

enabling email notification

Atul says December 26, 2007

Hi Awesome,
Yes, you are right as per documentation above it is mentioned that in Oracle Web SErvice manager, you can have only one instance of OWSM monitor and hence you see architetcture diagram shown in 2.1

Check with Oracle Support team (OWSM dev team for justification)

Here is extract from guide

However, you can only have one instance of Oracle WSM Monitor in your entire Oracle Web Services environment. Therefore, you must disable the Oracle WSM Monitor on vhost1 and vhost2

awesome says December 26, 2007

Thanks for ur quick reply…

Already we had a discussion with Oracle dev team…We didn’t ask why its active/passive but we asked how the monitor is scalable if it is configured active/passive…Oracle suggested some ways to turn Monitor for better scalability (like…increase buffer size [don’t know which buffer size??!!], logically group gateways and have single monitor for each group however they are not load balanced)

So there are two questions
First, why monitor is active/passive?
Second, how monitor can be scalable if it is configured active/passive?

Since we had lot of other architecture related questions to Oracle on that day we had conference with Oracle, I couldn’t take much time to ask theses questions to Oracle dev team…

Can you help me to find out a good forum/site/person to contact to address these questions?? Please share your thoughts also if you have some idea on above questions…


awesome says December 27, 2007


I need some clarification on OHS installation
in production environment.

Gateway has it own HTTPListener. 1) Shall we use the gateway’s HTTPListener in production environment? 2) If we shouldn’t use Gateway’s HTTPlistener, how OHS should be installed & configured?

Very much appreciated your thoughts or related document any.


Atul says December 27, 2007

OWSM Gateway as mentioned above are deployed on OC4J and act as proxy for web service.
If you wish to use OWSM with OHS use OAS version with advanced install (SOA) J2EE, Web Server and SOA Suite.

Do let me know if I have understood your issue correctly and this deployment is fine with your implementation.

awesome says December 27, 2007

Yes, as u said, we planned to deploy OWSM gateway on OC4J instance where gateway act as a proxy for the web services which do authentications, logging as predefined and custom policy steps.

My doubt here is, in our current OWSM 3.5.4 implementation, gateway deployed in Weblogic instance. A load balancer (Virtual IP Hardware) will redirect the request to the load balanced gateways (Weblogic instance). So here we don’t have the HTTP listener concept.

But in new OWSM architecture (advance installation), Oracle proposed to have OHS in between the Load balancer and the Gateway (deployed in OC4J instance). So our doubt is:

1. Should we have a separate host to install OHS in production environment?

2. Do OC4J instance will have inbuilt HTTPListener (built-in webserver in the application sever)? If yes, do we need to disable the built-in HTTPListener and have to install OHS in a new host (machine)? (we assume, The new OHS host will be between the load balancer and the OC4J gateway instance). I guess this question looks messy!!
Please give your thoughts on this.


Atul Kumar says December 27, 2007

1. Should we have a separate host to install OHS in production environment?

This OHS is optional, if you wish to integrate with SSO or need OHS for any other functioanlity then you can use it else select basic install of SOA suite which is just OC4J and soa application (owsm,esb,bpel) deployed on this OC4J

OC4J instance will have inbuilt http listener (default port 8888)
There is no need to disable OHS, its required only in case you wish to deploy OHS on seperate machine.

OHS forward request to OC4J using mod_oc4j module of OHS

mahender says December 28, 2007

Hi All,
Please help me with the following issue:-

“Many of us in the Finance department are having an issue with logging back in to Oracle when our session is not valid due to lack of activity. It keeps telling us to log in. It is a circle we cannot get out of unless we log off of Oracle completely and start over. Is there anything you can do for us”


Ashish Kumar says April 14, 2008

Hi Atul,
I am trying to inject OWSM Server Agent in one of our our Existing WebServices hosted on BEA WEBLOGIC and another .NET service hosted on IIS. I am using OWSM version of setup …I need help in following steps:-

While doing “Add New Component” in Policy Management for OWSM…how to get other “Container types” options in combo box i.e BEA 8.1\IIS …currenty it shows only OC4J|AXIS|OTHER (other is showing but i do not know how to use this option for BEA).

Do i need to install something ?

Another issue i see is in step :- “Adding the Server Agent with the Web Service” i.e on opening Cluster Topology page using http://localhost:8888/em i can see only “home” for OC4j container (other contaners BEA \IIS not showing)….

i am not sure how to get BEA Weblogic container option in Cluster Topology …so that i can see all the web services hosted on it and thus select a service of my choice (on BEA) and add enable OWSM agent (i.e inject server agent) using “Enable\Disable Features” option .

Kindly let me know if i am missing some step or need some additional configuration needs to be done …

I am following steps from the Oracle by Example tutorial :-

Thanks …

Ashish Kumar says April 14, 2008

I believe i am missing the OWSM installation on BEA \ IIS …do we have any documentaion for intstallation of OWSM on BEA or IIS …is this the case for problem in above Post ?

Atul says April 15, 2008

I don’t see any owsm agent for BEA or IIS , what you can do instead is
— register gateway in ccore/owsm that came with web service isntallation (URL is like /gateway)
— Register web service or URL which you wish to protect (BEA or IIS URL/WSDL) with owsm
— This will give new URL pointing to your gateway
— This way users trying to access URL/webservice on BEA/IIS will get gateway URL protected by OWSM and that gateway in turn will speak to BEA/IIS

Check with Oracle OWSM support team on this

Enio Machado says September 29, 2008

I’d like to know how to configure the user name and password (web service manager control) that once i’ve lost…
thank you
send the to mail please….

Atul says September 29, 2008

@ Enio, I am not clear about your requirement.

Are you looking for configuring OWSM users authntication ?

Oracle Guide for OWSM

Bhargavi Ch says October 3, 2008

I have installed SOA suite using Advanced installation type.

After installation I am unable to login into web service manager control(http://localhost:8888/ccore) with oc4jadmin user…
it showing “Invalid Login”

In ccore logs i m getting below error
INFO [AJPRequestHandler-HTTPThreadGroup-54] userregistry.UsersTable – isValidUserPassword() failed for oc4jadmin
INFO [AJPRequestHandler-HTTPThreadGroup-54] sampledb.LocalDBAuthProvider – The error in authenticate for user : oc4jadmin
SEVERE [AJPRequestHandler-HTTPThreadGroup-54] uibeans.LoginBean – Error when authenticating user. Invalid user id or password
SEVERE [AJPRequestHandler-HTTPThreadGroup-54] userregistry.UsersTable – isActiveUser() failed for oc4jadmin
com.cfluent.utils.db.DBException: ORA-01017: invalid username/password; logon denied at com.cfluent.utils.db.DBContext.getConnection(….

Atul says October 3, 2008

Authentication engine for OWSM (/ccore) is different use

admin/oracle to login to OWSM

Ghanny says March 9, 2009

Hi Atul,

I am new to OWSM and web services in general. I have worked with OAM and OIM though. I wanted to know do we have to use OAM for protecting web services or OWSM by itself is sufficient for protecting web services. Also our web service is developed on .NET platform, I understand from above messages gateway/agent is not available for .net, can you please confirm this.


Atul Kumar says March 9, 2009

OWSM by itself is sufficient for protecting web services.

mesut says April 16, 2009

I studied on using weblogic with OWSM is there way to use thmen togerther. If so, how can I achieve it. I have some java services deployed into weblogicAppServer a nd wanna secure thme via owsm. Please show me a way

Atul says April 16, 2009

Use Policy Enforcement Points (PEP gateway’s and agents) to protect java services deployed into weblogicAppServer .

Check two whitepapers

mesut says April 16, 2009

Thank you first of all. When I used to try oracle soa suit everything was good. I used owsm to secure my esb services but I have to use web logic anymore but still want to use owsm. but Bea does not have owsm. so I now thinking on how to use owsm on web logic like
Ashish Kumar(I have same problem).
I need owsm, did it run standalone? or I have to install soa suit? that is what I excatly want
Thank you for your quick reply

Atul Kumar says April 16, 2009

OWSM is available as standalone product as well and it is another j2ee application server which is now supported on WebLogic Server as well.

Download standalone OWSM from (I think you need minimum 10.1.3 weblogic server to deploy standalone OWSM)

mesut says April 16, 2009

thank you a lot I tried lots of way but miss 10.1.3 web logic server, I think that will solve my problem.. thank you again

» Overview of Securing Web Services in Fusion Middleware 11g (SOA / ADF / WebCenter) Online Apps DBA: One Stop Shop for Apps DBA’s says February 1, 2010

[…] know more about OWSM in 10g click here or for OWSM in 11g click […]

kumar says February 9, 2010


I am very new to OWSM.
I have basic doubt. what is difference between 2 PEP(policy enforcement points)
Agents and gateway.
what web service security is achieved in agent and not possible in gateway.
when do we go for agent rather than gateway.

Atul Kumar says February 10, 2010

@ Kumar

Gateways : Runs in the webserver and acts as an proxy for all incoming requests. The Gateway inspects the request and allows or disallows it to pass-through to the Web Service.

An Agent can either run server side with the Web Service or client side with the Web Service client. Can be configured to communicate with OWSM Policy Manager.

More information on Agent & Gateway

or OWSM 11g R1

karthik says March 4, 2010

Hi All,

I have done some changes in components logging.xml files now i want to deploy the components ( gateway , coreman , ccore , policymanager )

Can any one help me out in saying the commands
to deploy the components ..

tanushree says June 1, 2010


Is webservices SSO possible by OWSM? Can you please share any link on Single sign-on of webservices using OWSM.

Lavanya G

Atul Kumar says June 1, 2010

@ Lavnya

Which SSO solution you are using ?
If this is OAM (Access Manager) SSO then use

Oracle Web Services Manager uses the Identity Asserter for single sign-on.

tanushree says June 2, 2010

Hi Atul,

Thks for the link. It was really helpful.

Does this identity asserter for SSO work only services deployed in WEblogic server?


Lara K says July 22, 2010

All our services been virtualize in OWSM, Is there any option to display or monitor the response messages in OWSM.

For instance ServiceA push data to another application via OWSM. The response received back to ServiceA has to display on OWSM Execution details.
Any idea Please.

Ramnathyadav says August 8, 2010


Chinni says March 14, 2011

Very good description about OWSM ..thank you kumar.

Ritu says October 24, 2011

Firstly,I want clarification on a point for OWSM 10g( that whether multiple gateways in OWSM can work at a time. As per my knowledge, we can register multiple gateways at a time, but can they work at a same time as well?
Thanks in advance.

Ritu says October 31, 2011

Any update on the above query.
Please let me know if anyone has an idea regarding this??
Thanks in advance.

vivek says August 27, 2012

Hi Atul,
Policy set console does not open in em console with some error. I looked into deployments of wsm-pm app. It is in prepared state. When I try to start I get the below error:

weblogic.application.ModuleException: [HTTP:101216]Servlet: “PolicyManagerValidator” failed to preload on startup in Web application: “/wsm-pm”. oracle.adf.share.ADFShareException: MDSConfigurationException encountered in parseADFConfiguration at oracle.adf.share.config.ADFMDSConfig.parseADFConfiguration( at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke( at sun.reflect.DelegatingMethodAccessorImpl.invoke( at java.lang.reflect.Method.invoke( at oracle.adf.share.config.ADFConfigImpl.getResultFromComponent( at oracle.adf.share.config.ADFConfigImpl.getConfigObject( at oracle.adf.share.config.ADFConfigImpl.getConfigObject( at oracle.adf.share.config.ADFConfigImpl.getMDSInstance( at oracle.adf.share.config.ADFConfigImpl.getMDSInstance( at

Please help

vivek says August 27, 2012

Yes I got it.
MDS data source was not having my managed server in targets.

vijay says September 10, 2013


I get the below error when i try to run the view i created:
Search results could not be retrieved due to the following exception:
Coud not get RMI IQueryStub

thanks in advance for your answer

» SAML & Virtual User : OPSS Virtual User Online Apps DBA: One Stop Shop for Apps DBA’s says December 14, 2013

[…] SAML assertion) is called as Virtual User. This post covers covers how to set this virtual user in Oracle Web Services Manager (OWSM) that is used to protect WebServices deployed on SOA/ […]

» Pick of the Week : Identity Management Posts : Securing Heterogeneous Systems Using Oracle Web Services Manager Online Apps DBA: One Stop Shop for Apps DBA’s says December 23, 2013

[…] Oracle Web Services Manager (OWSM) provides policy based ws-security to Web Services and is part of Oracle SOA Suite […]

Add Your Reply