The key locator information for the consumer at the application
level specifies which key locator implementation is used. The key locator
implementation locates the key to be used to validate the digital signature
or the encryption information by the application.
About this task
Complete the following steps to configure the key locator for the
consumer binding on the application level:
Procedure
- Locate the key locator configuration panel in the administrative
console.
- Click Applications > Application Types > WebSphere
enterprise applications > application_name.
- Under Manage modules, click URI_name.
- Under Web Services Security Properties, you can access the key
information for the request consumer and response consumer bindings.
- For the request consumer (receiver) binding, click Web services: Server
security bindings. Under Request consumer (receiver) binding, click Edit
custom.
- For the response consumer (receiver) binding, click Web services: Client
security bindings. Under Response consumer (receiver) binding, click Edit
custom.
- Under Additional properties, click Key locators.
- Click New to create a key locator configuration, click Delete and
select the box next to the configuration to delete an existing configuration,
or click the name of an existing key locator configuration to edit its settings.
If you are creating a new configuration, enter a unique name in the Key
locator name field. For example, you might specify klocator.
- Specify a name for the key locator class implementation.
The Java™ Authentication
and Authorization Service (JAAS) Login Module implementation is used to validate
(authenticate) the security token on the consumer side. Specify
a class name according to the requirements of the application. For example,
if the application requires that the key is read from a keystore file, specify
the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation. WebSphere® Application
Server provides the following default key locator class implementations for
Version 6.0.x applications that are available to use with the request
consumer or response consumer:
- com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator
- This implementation locates and obtains the key from the specified keystore
file.
- com.ibm.wsspi.wssecurity.keyinfo.X509TokenKeyLocator
- This implementation uses the X.509 security token from the sender message
for digital signature validation and encryption. This class implementation
is used by the request consumer and the response consumer.
- Specify the keystore password, the keystore location, and the keystore
type. Keystore files contain public and private keys, root certificate
authority (CA) certificates, the intermediate CA certificate, and so on. Keys
that are retrieved from the keystore files are used to sign and validate or
encrypt and decrypt messages or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator
implementation for the key locator class implementation, you must specify
a keystore password, location, and type.
- Specify a password in the keystore Password field.
This password is used to access the keystore file.
- Specify the location of the keystore file in the keystore Path field.
- Select a keystore type from the keystore Type field.
The Java Cryptography Extension (JCE) that is used by IBM® supports
the following keystore types:
- JKS
- Use this option if you are not using Java Cryptography Extensions (JCE) and if
your keystore file uses the Java Keystore (JKS) format.
- JCEKS
- Use this option if you are using Java Cryptography Extensions.
- JCERACFKS
- Use JCERACFKS if the certificates are stored in a SAF key ring (z/OS® only).
- PKCS11KS (PKCS11)
- Use this format if your keystore file uses the PKCS#11 file format. Keystore
files that use this format might contain RSA keys on cryptographic hardware
or might encrypt keys that use cryptographic hardware to ensure protection.
- PKCS12KS (PKCS12)
- Use this option if your keystore uses the PKCS#12 file format.
WebSphere Application Server provides some sample
keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory.
For example, you might use the enc-receiver.jceks keystore file for
encryption keys. The password for this file is Storepass and the
type is JCEKS.
Attention: Do not use these keystore
files in a production environment. These samples are provided for testing
purposes only.
- Click OK and Save to save the configuration.
- Under Additional properties, click Keys.
- Click New to create a key configuration, click Delete and
select the box next to the configuration to delete an existing configuration,
or click the name of an existing key configuration to edit its settings.
This entry specifies the name of the key object within the keystore
file. If you are creating a new configuration, enter a unique name in the Key
name field.
It is recommended that you use a fully qualified distinguished
name for the key name. For example, you might use CN=Bob,O=IBM,C=US.
- Specify an alias in the Key alias field. The
key alias is used by the key locator to search for key objects in the keystore
file.
- Specify a password in the Key password field. The
password is used to access the key object within the keystore file.
- Click OK and then click Save to save the configuration.
Results
You have configured the key locator for the consumer binding at the
application level.
What to do next
You must specify a similar key information configuration for the
generator.