You can secure the SOAP messages, without using policy sets for configuration, by using the Web Services Security APIs (WSS API). To configure encrypted parts for the request generator (client side) bindings, use the WSSEncryptPart API to define and add to the listing of elements in the encrypted part. WSSEncryptPart is an interface that is part of the com.ibm.websphere.wssecurity.wssapi.encryption package.
You can use the WSS APIs or configure policy sets using the administrative console to enable the encrypted parts. To secure SOAP messages, use the WSS APIs to complete the following encryption tasks, as needed:
Confidentiality settings require that confidentiality constraints be applied to generated messages. These constraints include specifying which message parts within the generated message must be encrypted, and which message parts to attach encrypted elements to. The encryption information on the generator side is used for encrypting an outgoing SOAP message. The request generator is configured for the client.
The WSSEncryptPart API specifies information related to encrypted parts and sets the encrypted parts that have been added for message confidentiality protection. Use the WSSEncryptPart to set the transform method and to specify the part to which the transform method is to be applied. Sets the transform method only if using SOAP with Attachments. The WSSEncryptPart is usually not needed except, in some case for tasks such as setting the transform method.
The encrypted parts and related information displayed in the following table are used to protect the confidentiality of messages.
Encrypted parts | Description |
---|---|
part | Adds the WSSEncryptPart object as a target of the encryption part. |
keyword | Adds the encrypted parts using keywords. The default encryption parts that you can add using keywords are the BODY_CONTENT and SIGNATURE. WebSphere® Application Server supports using these keywords:
|
xpath | Adds the encrypted part by using an XPath expression. |
signature | Adds the WSSSignature component as a target
of the encrypted part. WSSSignature is applicable only if the SOAP message contains a signature element. |
header | Adds the SOAP header, specified by QName, as a target of the encrypted part. |
securityToken | Adds the SecurityToken object as a target of the encrypted part. |
For encrypted parts, certain default behaviors occur. The simplest way to use the WSSEncryptPart API is to use the default behavior. The WSSEncryptPart API provides defaults for specifying the transform algorithm, setting objects as targets, specifying the encrypted parts, such as: the SOAP body content and the signature.
The encryption default behaviors include:
Encrypted part decisions | Default behavior |
---|---|
Which SOAP message parts to encrypt using keywords | Specifies which keywords to use for the encrypted parts. WebSphere Application Server sets the following SOAP message parts by default for encryption:
|
Which transform method to add | WebSphere Application Server does not specify any transform method by default. Specify a transform method only if using SOAP with Attachments. |
After enabling encrypted parts for the request generator (client side) binding, you must specify the same parts to be decrypted for the response consumer (client side) bindings. Next, to configure decryption and decrypted parts, use the WSS APIs or configure policy sets using the administrative console.