The key locator information for the default generator bindings
specifies which key locator implementation is used to locate the key for signature
and encryption information if these bindings are not defined at the application
level.
About this task
The key locator information for the default consumer bindings
specifies which key locator implementation is used to locate the key that
is used for signature validation or decryption if these bindings are not defined
at the application level. WebSphere® Application Server provides default values
for the bindings. However, you must modify the defaults for a production environment.
Complete the following steps to configure the
key locator on the server level:
Procedure
- Access the default bindings for the server level.
- Click Servers > Server Types > WebSphere application servers > server_name.
- Under Security, click JAX-WS and JAX-RPC security runtime.
Mixed-version environment: In a mixed node cell with a server using Websphere
Application Server version 6.1 or earlier, click
Web services:
Default bindings for Web services security.
mixv
- Under Additional properties, click Key locator. You
can configure the key locator configurations for both the default generator
and the default consumer in this location.
- Click one of the following to work with the key locator configurations:
- New
- To create a key locator configuration. Enter a unique name for the key
locator configuration in the Key locator name field. For example, you
might specify sig_klocator.
- Delete
- To delete an existing configuration
- an existing key locator configuration
- To edit the settings of an existing configuration.
- Specify a name for the key locator class implementation in the Key
locator class name field. The key locators
that are associated with Version 6.0.x applications must implement
the com.ibm.wsspi.wssecurity.keyinfo.KeyLocator interface.
Note: This interface is
valid only for JAX-RPC applications. For JAX-WS
applications, the Java™ Authentication and Authorization Service (JAAS)
Login Module implementation is used to create the security token on the generator
side and to validate (authenticate) the security token on the consumer side.
WebSphere
Application Server provides the following default key locator class implementations
for Version 6.0.x applications:
- com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator
- This implementation locates and obtains the key from a specified keystore
file.
- com.ibm.wsspi.wssecurity.keyinfo.SignerCertKeyLocator
- This implementation uses the public key from the certificate of the signer.
This class implementation is used by the response generator.
- com.ibm.wsspi.wssecurity.keyinfo.X509TokenKeyLocator
- This implementation uses the X.509 security token from the sender message
for digital signature validation and encryption. This class implementation
is used by the request consumer and the response consumer.
For example, you might specify the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator
implementation if you need the configuration to be the key locator for signing
information.
- Specify the keystore password, the keystore location, and the keystore
type. Keystore files contain public and private keys, root certificate
authority (CA) certificates, the intermediate CA certificate, and so on. Keys
that are retrieved from the keystore file are used to sign and validate or
encrypt and decrypt messages or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator
implementation for the key locator class implementation, you must specify
a key store password, location, and type.
- Specify a password in the Key store password field.
This password is used to access the keystore file.
- Specify the location of the keystore file in the Key store
path field.
- Select a keystore type from the Key store type field.
The Java Cryptography Extension (JCE) that is used supports
the following key store types:
- JKS
- Use this option if you are not using Java Cryptography Extensions (JCE) and if
your keystore file uses the Java Keystore (JKS) format.
- JCEKS
- Use this option if you are using Java Cryptography Extensions.
- PKCS11
- Use this format if your keystore file uses the PKCS#11 file format. Keystore
files that use this format might contain Rivest Shamir Adleman (RSA) keys
on cryptographic hardware or might encrypt keys that use cryptographic hardware
to ensure protection.
- PKCS12
- Use this option if your keystore file uses the PKCS#12 file format.
WebSphere Application Server provides some sample
keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory.
For example, you might use the enc-receiver.jceks keystore file for
encryption keys. The password for this file is storepass and the
type is JCEKS.
Restriction: Do not use these keystore files
in a production environment. These samples are provided for testing purposes
only.
- Click OK and Save to save the configuration.
- Under Additional properties, click Keys.
- Click one of the following to work with the key configurations:
- New
- To create a key configuration. Enter a unique name in the Key name field.
You must use a fully qualified distinguished name for the key name. For example,
you might use CN=Bob,O=IBM,C=US.
- Delete
- To delete an existing configuration.
- an existing key configuration
- To edit the settings of the existing configuration.
This entry specifies the name of the key object within the
keystore file.
- Specify an alias in the Key alias field. The
key alias is used by the key locator to search for key objects in the keystore
file.
- Specify a password in the Key password field. The
password is used to access the key object within the keystore file.
- Click OK and then click Save to save the configuration.
Results
You have configured the key locator
for the server level.
What to do next
Configure the key information for the default generator and the default
consumer bindings that reference this key locator.