You can secure the SOAP messages, without using policy sets, by using the Web Services Security APIs. To configure the token on the generator side, use the Web Services Security APIs (WSS API). The generator security tokens are part of the com.ibm.websphere.wssecurity.wssapi.token interface package.
The pluggable token framework in WebSphere Application Server has been redesigned so that the same framework from the WSS API can be reused. The same implementation of creating and validating security token can be used both for the Web Services Security runtime and for the WSS API application code. The redesigned framework also simplifies the SPI programming model and will make it easier to add security token types.
You can use the WSS API or you can configure the tokens by using the administrative console. To configure tokens, you must complete the following token tasks:
The JAAS CallbackHandler and JAAS LoginModule are responsible for creating the security token on the generator side.
On the generator side, the token is created by using the JAAS LoginModule and by using JAAS CallbackHandler to pass authentication data. Then, the JAAS LoginModule creates the securityToken object, such as the UsernameToken, and passes it to the Web Service Security runtime.
On the consumer side, the XML format is passed to the JAAS LoginModule for validation or authentication. then the JAAS CallbackHandler is used to pass authentication data from the Web Service Security runtime to the LoginModule. After the token is authenticated, a security token object is created, and the token is passed it to the Web Service Security runtime.
When using the WSS API for generator token creation, certain default behaviors occur. The simplest way to use the WSS API is to use the default behavior (see the example code). The WSS API provide default values for the token type, the token value, and the JAAS confirmation name. The default token behaviors include:
Generator token decisions | Default behavior |
---|---|
Which token type to use | The token type specifies which type of token to use for message integrity, message confidentiality, or message authenticity. WebSphere Application Server provides the following
pre-configured generator token types for message integrity and message
confidentiality:
WebSphere Application Server also provides the following pre-configured generator token types for the message authenticity:
You can also create custom token types, as needed. |
What JAAS login configuration name to specify | The JAAS login configuration name specifies which JAAS login configuration name to use. |
Which configuration type to use | The JAAS login module specifies the configuration type. Only the pre-configured generator configuration types can be used for generator token types. |
The SecurityToken class (com.ibm.websphere.wssecurity.wssapi.token.SecurityToken) is the generic token class and represents the security token that has methods to get the identity, the XML format, and the cryptographic keys. Using the SecurityToken class, you can apply both the signature and encryption to the SOAP message. However, to apply both, you must have two SecurityToken objects, one for the signature and one for encryption, respectively.
The following tokens types are subclasses of the generic security token class:
Token type | JAAS login configuration name |
---|---|
Username token | system.wss.generate.unt |
Security context token | system.wss.generate.sct |
Derived key token | system.wss.generate.dkt |
The following tokens types are subclasses of the binary security token class:
Token type | JAAS login configuration name |
---|---|
LTPA token | system.wss.generate.ltpa |
LTPA propagation token | system.wss.generate.ltpaProp |
X.509 token | system.wss.generate.x509 |
X.509 PKI Path token | system.wss.generate.pkiPath |
X.509 PKCS7 token | system.wss.generate.pkcs7 |
Notes:
The following example code shows how to use WSS APIs to create a Username security token, attach the Username token to the SOAP message, and configure the Username token in the generator binding.
// import the packages import javax.xml.ws.BindingProvider; import com.ibm.websphere.wssecurity.wssapi.*; import com.ibm.websphere.wssecurity.callbackhandler.*; ... // obtain the binding provider BindingProvider bp = ... ; // get the request context Map<String, Object> reqContext = bp.getRequestContext(); // generate WSSFactory instance WSSFactory factory = WSSFactory.getInstance(); // generate WSSGenerationContext instance WSSGenerationContext gencont = factory.newWSSGenerationContext(); // generate callback handler UNTGenerateCallbackHandler untCallbackHandler = new UNTGenerateCallbackHandler("Chris", "sirhC"); // generate the username token SecurityToken unt = factory.newSecurityToken(UsernameToken.class, untCallbackHandler); // add the SecurityToken to the WSSGenerationContext gencont.add(unt); // generate the WS-Security header gencont.process(reqContext);
// generate callback handler LTPAGenerateCallbackHandler ltpaCallbackHandler = new LTPAGenerateCallbackHandler(null, null); // generate the LTPAv2 token SecurityToken ltpa = wssfactory.newSecurityToken(LTPAv2Token.class, ltpaCallbackHandler);
The instantiation of the LTPAGenerateCallbackHandler
object with (null, null) indicates that the LTPA token should be generated
from the current runAs identity. If the callback handler is instantiated
with basicAuth information, ("userName", "password"), a new LTPA token
is created using the specified basicAuth information.
For each token type, configure the token using the WSS APIs or using the administrative console. Next, specify the similar consumer tokens if you have not done so.
If both the generator and consumer tokens are configured, continue securing SOAP messages either by signing the SOAP message or by encrypting the message, as needed. You can use either the WSS APIs or the administrative console to secure the SOAP messages.
In this information ...Related concepts
Related tasks
| IBM Redbooks, demos, education, and more(Index) |