Use an assembly tool to configure trust anchors (that specify
keystores which contain trusted root certificates to validate the
signer certificate) or trust stores at the application level.
Before you begin
Important: There is an important distinction between
Version 5.x and Version 6 and later applications. The information
in this article supports Version 5.x applications only that
are used with WebSphere® Application Server Version 6.0.x and
later. The information does not apply to Version 6.0.x and
later applications.
This document describes how to configure
trust anchors or trust stores at the application level. It does not
describe how to configure trust anchors at the server or cell level.
Trust anchors defined at the application level have a higher precedence
over trust anchors defined at the server or cell level. You can configure
an application-level trust anchor using an assembly tool or the administrative
console. This document describes how to configure the application-level
trust anchor using an assembly tool. For more
information on creating and configuring trust anchors at the server
or cell level, see Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console.
About this task
A trust anchor specifies keystores that contain trusted
root certificates, which validate the signer certificate. These keystores
are used by the request receiver (as defined in the ibm-webservices-bnd.xmi file)
and the response receiver (as defined in the application-client.xml file
when web services are acting as client) to validate the signer certificate
of the digital signature. The keystores are critical to the integrity
of the digital signature validation. If they are tampered with, the
result of the digital signature verification is doubtful and comprised.
Therefore, it is recommended that you secure these keystores. The
binding configuration specified for the request receiver in the ibm-webservices-bnd.xmi file
must match the binding configuration for the response receiver in
the application-client.xml file.
Complete
the following steps to configure trust anchors using an assembly tool.
Procedure
- Configure an assembly tool to work with a Java Platform, Enterprise Edition (Java EE) enterprise application. For
more information, see the related information on Assembly Tools.
- Create a web services-enabled Java EE
enterprise application. See Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console for an introduction
on how to manage Web Services Security binding information on the
server.
- Configure the client-side response receiver, which is defined
in the ibm-webservicesclient-bnd.xmi bindings
extensions file.
- Use an assembly tool to import your Java EE
application.
- Click .
- Click
- Right-click the application-client.xml file,
select , and click the WS
Binding tab. The Client Deployment Descriptor
is displayed.
- Locate the Port qualified name binding section and either
select an existing entry or click Add, to add
a new port binding. The web services client port binding
editor displays for the selected port.
- Locate the Trust anchor section and click Add.
The Trust anchor window is displayed.
- Enter a unique name within the port binding for the Trust
anchor name.
The name is used to reference the trust
anchor that is defined.
- Enter the keystore password, path, and keystore type.
The supported
keystore types are the Java Cryptography
Extension (JCE) and Java Cryptography
Extension Keystores (JCEKS) types.
Click Edit to edit the selected trust
anchor.
Click Remove to remove the selected
trust anchor.
When you start the application, the configuration
is validated in the run time while the binding information is loading.
- Save the changes.
- Configure the server-side request receiver, which is defined
in the ibm-webservices-bnd.xmi bindings extensions
file.
- Click .
- Select the web services enabled Enterprise JavaBeans (EJB) or web module.
- In the Package Explorer window, click the META-INF directory
for an EJB module or the WEB-INF directory for
a web module.
- Right-click the webservices.xml file,
select , and click the bindings
tab. The web services bindings editor is displayed.
- Locate the web service description bindings section
and either select an existing entry or click Add to
add a new web services descriptor.
- Click Binding configurations.
The web services binding configurations editor is displayed
for the selected web services descriptor.
- Locate the Trust anchor section and click Add.
The Trust anchor dialog box is displayed.
- Enter a unique name within the binding for the Trust
anchor name.
This unique name is used to reference the
trust anchor defined.
- Enter the keystore password, path, and keystore type. The supported
keystore types are JCE and JCEKS.
Click Edit to edit the selected trust
anchor.
Click Remove to remove the selected
trust anchor.
When you start the application, the configuration
is validated in the run time while the binding information is loading.
- Save the changes.
Results
This procedure defines trust anchors that can be used by the
request receiver or the response receiver (if the web services is
acting as client) to verify the signer certificate.
Example
The request receiver or the response receiver (if the web
service is acting as a client) uses the defined trust anchor to verify
the signer certificate. The trust anchor is referenced using the trust
anchor name.