You can verify the signing or signature information using the WSS API for the consumer binding. The signature and canonicalization algorithm methods are used for the generator binding. The WSSVerification API is provided in the com.ibm.websphere.wssecurity.wssapi.verification package.
To configure consumer signing information to protect message integrity, you must first digitally sign and then verify the signature for the SOAP messages. Integrity refers to digital signature while confidentiality refers to encryption. Integrity decreases the risk of data modification when you transmit data across a network.
The algorithm that is specified for the request generator configuration must match the algorithm that is specified for the response consumer configuration.
The signature algorithms specify the signature verification algorithm that is used to sign the certificate. The signature algorithms specify the Uniform Resource Identifiers (URI) of the signature verification method. WebSphere® Application Server supports the following pre-configured algorithms:
Algorithm | Description |
---|---|
WSSVerification.HMAC_SHA1 | A URI of the signature algorithm, HMAC: http://www.w3.org/2000/09/xmldsig#hmac-sha1 |
WSSVerification.RSA_SHA1 (the default value) | A URI of the signature algorithm, RSA: http://www.w3.org/2000/09/xmldsig#rsa-sha1 |
WebSphere Application Server does not support the algorithm for DSA-SHA1: http://www.w3.org/2000/09/xmldsig#dsa-sha1
The canonicalization algorithms specify the Uniform Resource Identifiers (URI) of the canonicalization method. WebSphere Application Server supports the following pre-configured algorithms:
Algorithm | Description |
---|---|
WSSVerification.C14N | A URI of the inclusive canonicalization algorithm, C14N: http://www.w3.org/2001/10/xml-c14n# |
WSSVerification.EXC_C14N (the default value) | A URI of the exclusive canonicalization algorithm EXC_C14N: http://www.w3.org/2001/10/xml-exc-c14n# |
The following example provides sample WSS API code that specifies the X.509 token security token for signature verification:
WSSFactory factory = WSSFactory.getInstance(); WSSConsumingContext concont = factory.newWSSConsumingContext(); // X509ConsumeCallbackHandler X509ConsumeCallbackHandler callbackHandler = new X509ConsumeCallbackHandler("dsig-receiver.ks", "jks", "server".toCharArray(), certList, java.security.Security.getProvider("IBMCertPath")46 ); // Set the verification component // DEFAULT verification parts: Body, WS-Addressing header, and Timestamp // DEFAULT data encryption algorithm: RSA-SHA1 // DEFAULT digest algorithm: SHA1 // DEFAULT canonicalization algorithm: exc-c14n WSSVerification ver = factory.newWSSVerification(X509Token.class, callbackhandler); concont.add(ver); // Validate the WS-Security header concont.validate(msgctx);