To configure the client for response decryption, specify which
decryption method to use when the client decrypts the response message. The
server response encryption and client response decryption configurations must
match.
Before you begin
Important: There is an important distinction
between Version 5.x and Version 6 and later applications. The information
in this article supports Version 5.x applications only that are used
with WebSphere Application Server Version 6.0.x and later. The information
does not apply to Version 6.0.x and later applications.
Prior
to completing these steps, read either of the following topics to become familiar
with the
WS Extensions tab and the
WS Bindings tab in the Client
Deployment Descriptor Editor within an assembly tool:
These two tabs are used to configure the Web services security
extensions and Web services security bindings, respectively.
About this task
Complete the following steps to specify which decryption method
to use when the client decrypts the response message. The server response
encryption and client response decryption configurations must match.
Procedure
- Launch an assembly tool. For more information on the
assembly tools, see Assembly tools
.
- Switch to the Java 2 Platform, Enterprise Edition (J2EE) perspective.
Click Window > Open Perspective > J2EE.
- Click Application Client Projects > application_name >
appClientModule > META-INF.
- Right-click the application-client.xml file, select Open
with > Deployment descriptor editor.
- Click the WS Binding tab, which is located at the bottom
of the deployment descriptor editor within the assembly tool.
- Expand the Security response receiver binding configuration
> Encryption information section. For more information on encrypting
and decrypting SOAP messages, see XML encryption
.
- Click Edit to view the encryption information. The
following table describes the purpose for this information. Some of these
definitions are based on the XML-Encryption specification, which is located
at the following Web address: http://www.w3.org/TR/xmlenc-core
- Encryption name
- Refers to the alias that is used for the encryption information entry.
- Data encryption method algorithm
- Encrypts and decrypts data in fixed size, multiple octet blocks.
- Key encryption method algorithm
- Represents public key encryption algorithms specified for encrypting and
decrypting keys.
- Encryption key name
- Represents a Subject from a personal certificate, which is typically a
distinguished name (DN) that is found by the encryption key locator. The Subject
is used by the key encryption method algorithm to decrypt the secret key.
The secret key is used to decrypt the data.
Important: The key
chosen must be a private key of the client. Encryption must be done using
the public key and decryption must be done by the private key (personal certificate).
For example, the personal certificate of the client is: CN=Alice, O=IBM,
C=US. Therefore, the client contains the public and private key pair.
The target server that sends the response encrypts the secret key by using
the public key for CN=Alice, O=IBM, C=US. The client decrypts the
secret key by using the private key for CN=Alice, O=IBM, C=US.
- Encryption key locator
- Represents a reference to a key locator implementation class that finds
the correct key store where the alias and the certificate exist. For more
information on configuring key locators, see Configuring key locators using an assembly tool
and Configuring key locators using the administrative console
.
- Optional: Select Show only
FIPS Compliant Algorithms if you only want the FIPS compliant algorithms
to be shown in the Data Encryption method algorithm and Key Encryption method
algorithm drop-down lists. Use this option if you expect this application
to be run on a WebSphere Application Server that has set the Use the Federal
Information Processing Standard (FIPS) option in the Global security panel
of the administrative console for WebSphere Application Server.
Results
For decryption, the encryption key name chosen must refer to a
personal certificate that can be located by the client key locator. The Subject
(owner field of the certificate) of the personal certificate should
be entered in the Encryption key name, this is typically a Distinguished Name
(DN). The default key locator uses the Encryption key name to find the
key within the keystore. If you write a custom key locator, the encryption
key name can be anything used by the key locator to find the correct encryption
key. The encryption key locator references the implementation class that locates
the correct key store where this alias and certificate exists. For more information,
see Configuring key locators using an assembly tool
and Configuring key locators using the administrative console
.