Configuring nonce for the server level

Nonce is a randomly generated, cryptographic token that is used to prevent the theft of username tokens, which are used with SOAP messages. Nonce is used in conjunction with the basic authentication (BasicAuth) method. You can configure nonce for the server level by using the WebSphere® Application Server administrative console.

About this task

Important: The information in this article supports Version 5.x applications only that are used with WebSphere Application Server Version 6.0.x and later. The information does not apply to Version 6.0.x and later applications.

You can configure nonce at the application level, the server level, and cell level.

However, you must consider the order of precedence:
  1. Application level
  2. Server level
  3. Cell level
If you configure nonce on the application level and the server level, the values specified for the application level take precedence over the values specified for the server level.

Likewise, the values specified for the application level take precedence over the values specified for the server level and the cell level.

In a WebSphere Application Server or WebSphere Application Server, Express environment, you must specify values for the Nonce cache timeout, Nonce maximum age, and Nonce clock skew fields on the server level to use nonce effectively.

However, in a WebSphere Application Server, Network Deployment environment, these fields are optional on the server level, but required on the cell level.

Complete the following steps to configure nonce on the server level:

Procedure

  1. Connect to the administrative console.

    Type http://localhost:port_number/ibm/console in your Web browser unless you have changed the port number.

  2. Click Servers > Server Types > WebSphere application servers > server_level.
  3. Under Security, click JAX-WS and JAX-RPC security runtime.
    Mixed-version environment: In a mixed node cell with a server using WebSphere Application Server version 6.1 or earlier, click Web services: Default bindings for Web services security.mixv
  4. Specify a value, in seconds, for the Nonce cache timeout field. The value specified for the Nonce cache timeout field indicates how long the nonce remains cached before it is expunged. You must specify a minimum of 300 seconds. However, if you do not specify a value, the default is 600 seconds. This field is required for the server level.

    However, in a WebSphere Application Server, Network Deployment environment or on the z/OS® platform, this field is optional on the server level, but required on the cell level.

  5. Specify (optional) a value, in seconds, for the Nonce maximum age field.

    The value specified for the Nonce Maximum Age field indicates how long the nonce is valid. You must specify a minimum of 300 seconds, but the value cannot exceed the number of seconds specified for the Nonce cache timeout field on the server level.

    The value specified for the Nonce maximum age field must not exceed the Nonce maximum age value set on the cell level. You can specify the Nonce cache timeout value for the cell level by clicking Security > Web Services. This field is optional on the server level, but required on the cell level.

  6. Specify a value, in seconds, for the Nonce clock skew field. The value specified for the Nonce clock skew field specifies the amount of time, in seconds, to consider when the message receiver checks the timeliness of the value. Consider the following information when you set this value:
    • Difference in time between the message sender and the message receiver if the clocks are not synchronized.
    • Time needed to encrypt and transmit the message.
    • Time needed to get through network congestion.
    You must specify at least 0 seconds for the Nonce clock skew field. However, the maximum value cannot exceed the number of seconds specified in the Nonce maximum age field on the server level. If you do not specify a value, the default is 0 seconds.
  7. Restart the server. If you change the Nonce cache timeout value and do not restart the server, the change is not recognized by the server.



In this information ...


IBM Redbooks, demos, education, and more

(Index)

Use IBM Suggests to retrieve related content from ibm.com and beyond, identified for your convenience.

This feature requires Internet access.

Task topic    

Terms of Use | Feedback

Last updated: Oct 20, 2010 7:53:43 PM CDT
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-dist&topic=twbs_confnoncesvr
File name: twbs_confnoncesvr.html