Use an assembly tool to specify which digital signature
method to use when configuring the server for response signing.
Before you begin
Important: There is an important distinction between
Version 5.x and Version 6 and later applications. The information
supports Version 5.x applications only that are used with WebSphere® Application Server Version 6.0.x and later. The information does not apply to Version 6.0.x and later applications.
Prior to completing these
steps, read either of the following topics to become familiar with
the Extensions tab and the
Binding configurations tab in the web services editor within the IBM® assembly
tools:
These two tabs are used to configure the Web Services Security
extensions and the Web Services Security bindings, respectively.
About this task
Complete the following steps to specify which digital signature
method to use when configuring the server for response signing:
Procedure
- Launch an assembly tool. For more information,
see the related information on Assembly Tools.
- Switch to the Java™ Platform, Enterprise Edition (Java EE) perspective. Click .
- Click .
- Right-click the webservices.xml file
and click .
- Click the Binding Configurations tab.
- Expand .
- Click Edit to choose a signing method. The signing info dialog is displayed and either select or enter
the following information:
- Canonicalization method algorithm
- Digest method algorithm
- Signature method algorithm
- Signing key name
- Signing key locator
The following table describes the purpose of this information.
Some of these definitions are based on the XML-Signature specification,
which is located at the following address: http://www.w3.org/TR/xmldsig-core.
Table 1. Digital
signature methods. Use the methods to configure the server
for response signing.Name |
Purpose |
Canonicalization method algorithm |
Canonicalizes the <SignedInfo> element before
the information is digested as part of the signature operation. Use
the same algorithm on the client response receiver. The algorithm
selected for the server response sender configuration must match the
algorithm selected in the client response receiver configuration. |
Digest method algorithm |
Applies to the data after transforms are applied,
if specified, to yield the <DigestValue> element. Signing the <DigestValue>
element binds resource content to the signer key. The algorithm selected
for the server response sender configuration must match the algorithm
selected in the client response receiver configuration. |
Signature method algorithm |
Converts the canonicalized <SignedInfo> element
into the <SignatureValue> element. The algorithm selected for the
server response sender configuration must match the algorithm selected
in the client response receiver configuration. |
Signing key name |
Represents the key entry associated with the
signing key locator. The key entry refers to an alias of the key,
which is found in the key store and is used to sign the request. |
Signing key locator |
Represents a reference to a key locator implementation
class that locates the correct key store where the alias and certificate
exists. For more information on configuring
key locators, see any of the following files:For more information
on configuring key locators, see the following file:
|
- Optional: Select Show only FIPS
Compliant Algorithms if you only want the FIPS compliant
algorithms to be shown in the Signature method algorithm and Digest
method algorithm dropdown lists. Use this option if you expect this
application to be run on a WebSphere Application Server
that has set the Use the United States Federal Information
Processing Standard (FIPS) algorithms option in the SSL
certificate and key management panel of the administrative console
for WebSphere Application Server.
Results
You have specified which method is used to digitally sign
a message when the server sends a message to a client.
What to do next
After you configure the server to digitally sign the response
message, you must configure the client to verify the digital signature
contained in the response message. See
Configurando o Cliente para a Verificação de Assinatura Digital da Resposta: Verificando as Partes da Mensagem for more
information.