Configuring the client for response decryption: Choosing a decryption
method
Before you begin
Prior to completing these steps, read either of the following
topics to become familiar with the
Security Extensions tab and the
Port
Binding tab in the Web Services Client Editor within the Assembly Toolkit:
These two tabs are used to configure the Web services security extensions
and Web services security bindings, respectively.
Why and when to perform this task
Complete the following steps to specify which decryption method
to use when the client decrypts the response message. The server response
encryption and client response decryption configurations must match.
Steps for this task
- Launch the Assembly Toolkit.
- Open the J2EE perspective by clicking Window > Open Perspective
> Other > J2EE.
- Select the Web services enabled Enterprise JavaBean (EJB) or Web
module.
- In the Project Navigator window, locate the META-INF directory
for an EJB module or the WEB-INF directory
for a Web module.
- Right-click the webservicesclient.xml file, and
click Open With > Web Services Client Editor.
- Click the Port Binding tab, which is located at the bottom
of the Web services client editor within the Assembly Toolkit.
- Expand the Security Response Receiver Binding Configuration
> Encryption Information section.
For more information on encrypting
and decrypting Simple Object Access Protocol (SOAP) messages, see
XML encryption.
- Click Edit to view the encryption information.
The
following table describes the purpose for this information. Some of these
definitions are based on the XML-Encryption specification, which is located
at the following Web address:
http://www.w3.org/TR/xmlenc-core
- Encryption name
- Refers to the alias used for the encryption information entry.
- Data encryption method algorithm
- Encrypts and decrypts data in fixed size, multiple octet blocks.
- Key encryption method algorithm
- Represents public key encryption algorithms specified for encrypting and
decrypting keys.
- Encryption key name
- Represents a Subject from a personal certificate, which is typically a
distinguished name (DN) that is found by the encryption key locator. The Subject
is used by the key encryption method algorithm to decrypt the secret key.
The secret key is used to decrypt the data.
Note: The
key chosen must be a private key of the client. Encryption must be done using
the public key and decryption must be done by the private key (personal certificate).
For example, the personal certificate of the client is: CN=Alice, O=IBM,
C=US. Therefore, the client contains the public and private key pair.
The target server that sends the response encrypts the secret key using the
public key for CN=Alice, O=IBM, C=US. The client decrypts the
secret key using the private key for CN=Alice, O=IBM, C=US
. - Encryption key locator
- The encryption key locator represents a reference to a key locator implementation
class that finds the correct key store where the alias and the
certificate exist. For more information on configuring key locators,
see Configuring key locators
using the Assembly Toolkit and Configuring key locators using the administrative console.
Results
For decryption, the encryption key name chosen must refer to a
personal certificate that can be located by the client key locator. The Subject
(owner field of the certificate) of the personal certificate should be entered
in the Encryption key name, this is typically a Distinguished Name (DN).
The default key locator uses the Encryption key name to find the key within
the keystore. If you write a custom key locator, the encryption key name can
be anything used by the key locator to find the correct encryption key. The
encryption key locator references the implementation class that locates the
correct key store where this alias and certificate exists. For more information,
see Configuring key locators
using the Assembly Toolkit and Configuring key locators using the administrative console.

Response receiver
XML encryption

Configuring the client for response decryption: Decrypting the message parts
Configuring the client security bindings using the Assembly Toolkit
Configuring the security bindings on a server acting as a client using the administrative console
Configuring key locators using the Assembly Toolkit
Configuring key locators using the administrative console

XML
Encryption Syntax and Processing W3C Recommendation 10 December 2002
Searchable topic ID:
twbs_confclrespdecryptmeth
Last updated: Jun 21, 2007 9:56:50 PM CDT
WebSphere Application Server for z/OS, Version 5.0.2
http://publib.boulder.ibm.com/infocenter/wasinfo/index.jsp?topic=/com.ibm.websphere.zseries.doc/info/zseries/ae/twbs_confclrespdecryptmeth.html