WebSphere Message Broker, Version 8.0.0.7 Operating Systems: AIX, HP-Itanium, Linux, Solaris, Windows, z/OS

See information about the latest product version

Configuring WebSphere Message Broker as a client to a Kerberos secured service

You can configure WebSphere® Message Broker to operate as a client to a Kerberos secured service for message integrity, confidentiality, and authenticity.

You must have access to a Key Distribution Center (KDC) and a server that is hosting the service. For more information about configuring Kerberos, see your host Kerberos documentation.
  1. Set the user credentials that are used to authenticate with the KDC.
    • You can configure the credentials at the broker level by issuing a mqsisetdbparms. For example,
      mqsisetdbparms brokerName -n SPN::realm -u username -p password
    • You can also set the user credentials at the execution group level. For example, you can set a specific realm in any execution group with
      mqsisetdbparms brokerName -n kerberos::realm1::ExecutionGroup1 -u clientId -p password 
    • You can also use the Properties tree to set the credentials by using the following ESQL in a compute node:
      SET OutputRoot.Properties.IdentitySourceType = 'usernameAndPassword';
      SET OutputRoot.Properties.IdentitySourceToken = Username;
      SET OutputRoot.Properties.IdentitySourcePassword = Password;
  2. Create a Kerberos configuration file. Using the configuration file the client can authenticate with the KDC.

    For more information about Kerberos-based WS-Security that is supported in SOAP nodes, see Message flow security and security profiles.

    When you use Kerberos for security, the default Kerberos configuration file is the one on your workstation. The location for the configuration file differs depending on the system. The usual locations are:
    • For Windows - C:\Windows\krb5.ini and C:\WINNT\krb5.ini
    • For Linux - /etc/krb5.conf , UNIX (AIX®) /etc/krb5/krb5.conf
    • For z/OS® - /krb5/krb5.conf
    You can configure Kerberos configuration files for use by a broker or execution group.

    The following sample Kerberos configuration file shows typical values for the variables. The variables default_realm, default_keytab_name, and the names in the realms are among the values you change in the configuration file, depending on your network and location of the configuration file.

    [libdefaults]
    default_realm = MYREALM.EXAMPLE.COM
    default_keytab_name = FILE:c:\Windows\krb5.keytab
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    [realms]
    MYREALM.EXAMPLE.COM = {
    kdc = kdc.myrealm.example.com
    admin_server = kdc.myrealm.example.com
    }
    For example, you can set the variables for a WebSphere Message Broker level Kerberos configuration with
    mqsichangeproperties brokerName -o BrokerRegistry -n brokerKerberosConfigFile -v kerberosConfigLocation
    For example, you can set the variables for an execution group level Kerberos configuration with
    mqsichangeproperties brokerName -e executionGroupName -o ComIbmJVMManager -n brokerKerberosConfigFile -v kerberosConfigLocation
  3. Configure a policy set and binding that is associated with the SOAPRequest node for the BAR containing the message flow.

You have configured WebSphere Message Broker to operate as a client to a Kerberos secured service.

Notices | Trademarks | Downloads | Library | Support | Feedback

Copyright IBM Corporation 1999, 2016Copyright IBM Corporation 1999, 2016.

        
        Last updated:
        
        Last updated: 2016-05-23 14:48:00


Task topicTask topic | Version 8.0.0.7 | bc49106_