You can configure WebSphere® Message
Broker to operate as a client to a
Kerberos secured service for message integrity, confidentiality, and
authenticity.
You must have access to a Key Distribution Center (KDC) and
a server that is hosting the service. For more information about configuring
Kerberos, see your host Kerberos documentation.
- Set the user credentials that are used to authenticate
with the KDC.
- You can configure the credentials at the broker level by issuing
a mqsisetdbparms.
For example,
mqsisetdbparms brokerName -n SPN::realm -u username -p password
- You can also set the user credentials at the execution group level. For
example, you can set a specific realm in any execution group with
mqsisetdbparms brokerName -n kerberos::realm1::ExecutionGroup1 -u clientId -p password
- You can also use the Properties tree to set the credentials by
using the following ESQL in a compute node:
SET OutputRoot.Properties.IdentitySourceType = 'usernameAndPassword';
SET OutputRoot.Properties.IdentitySourceToken = Username;
SET OutputRoot.Properties.IdentitySourcePassword = Password;
- Create a Kerberos configuration file. Using the configuration
file the client can authenticate with the KDC.
For more
information about Kerberos-based WS-Security that is supported in
SOAP nodes, see Message flow
security and security profiles.
When you use Kerberos
for security, the default Kerberos configuration file is the one on
your workstation. The location for the configuration file differs
depending on the system. The usual locations are:
- For Windows -
C:\Windows\krb5.ini and C:\WINNT\krb5.ini
- For Linux - /etc/krb5.conf , UNIX (AIX®) /etc/krb5/krb5.conf
- For z/OS® - /krb5/krb5.conf
You can configure Kerberos configuration files for use by a
broker or execution group.
The following sample Kerberos configuration
file shows typical values for the variables. The variables default_realm, default_keytab_name,
and the names in the realms are among the values
you change in the configuration file, depending on your network and
location of the configuration file.
[libdefaults]
default_realm = MYREALM.EXAMPLE.COM
default_keytab_name = FILE:c:\Windows\krb5.keytab
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
MYREALM.EXAMPLE.COM = {
kdc = kdc.myrealm.example.com
admin_server = kdc.myrealm.example.com
}
For example, you can set the variables for
a
WebSphere Message
Broker level Kerberos configuration with
mqsichangeproperties brokerName -o BrokerRegistry -n brokerKerberosConfigFile -v kerberosConfigLocation
For example, you can set the variables for an execution group level Kerberos configuration with
mqsichangeproperties brokerName -e executionGroupName -o ComIbmJVMManager -n brokerKerberosConfigFile -v kerberosConfigLocation
- Configure a policy set and binding that is associated with
the SOAPRequest node for the BAR containing the message flow.
You have configured WebSphere Message
Broker to
operate as a client to a Kerberos secured service.