Generic security token login module for the token consumer

When a web service message is received, the application server calls the generic security token login module for the token consumer as part of the Web Services Security authentication process.

The login module delegates the token validation process to the WS-Trust service using WS-Trust Validate. The WS-Trust Security Token Service processes the request and returns a RequestSecurityTokenResponse message to login module, which might contain a new security token or validation status code only. The returned token from the WS-Trust Security Token Service or the original received token is the caller token if the caller token is required.

If the trust service call returns an invalid status code or an error, the token validation process fails and the login module produces a LoginException exception.

The login module, and its use of the WS-Trust Service, permits the following actions:
  • The exchange of security tokens when the incoming or outgoing security tokens are different types
  • The exchange of security tokens when you map one identity to another identity
  • The evaluation of authorization checks to ensure that authenticated users are permitted to invoke the target web service

The Java™ Authentication and Authorization Service (JAAS) login configuration name is wss.consume.issuedToken, and the callback handler class name is com.ibm.websphere.wssecurity.callbackhandler.GenericIssuedTokenConsumeCallbackHandler.

Supported token types

The receiving token must have a ValueType value that the designated trust service can handle and exchange. The valid token ValidType value might be a known token type that is supported by system default login modules. The valid incoming tokens can be a user name token, an XML token, or a binary security token, including the following token types:
  • Security Assertion Markup Language (SAML) 2.0
  • SAML 1.1
  • Username
  • PassTicket
  • Kerberos
  • Lightweight Third Party Authentication (LTPA)
  • Tivoli® Access Manager credential
However, if WS-Trust Validate does not complete the token exchange and returns a validation status code only, the incoming token type must be one of following token types:
  • SAML 2.0
  • SAML 1.1
  • Username
  • Kerberos
  • LTPA v2
  • LTPA
Also, the return token value type from WS-Trust call must be one of the previous token types.
支援的配置 支援的配置:
  • The received token that is sent by the requesting party is the token that is specified in the policy.
  • You can use this token for authentication only. You cannot use this token as a protection token.
sptcfg

Policy sets

The implementation of the generic security token login module can support any authentication tokens that are supported by system default login modules or by a custom login module. The generic security token login module implementation does not add a new security token type in the policy set. For example, if you plan to use a generic security token login module to generate a user name token, you can create a policy set that specifies a user name token as an authentication token. Any token types that are supported by designated security token services can be used with the generic security token login modules. You can implement custom login modules to process any new token types that are not supported by the existing default system login modules.

Bindings

When you configure bindings for an authentication token, you have the following options:
  • Use a generic login module.
  • Use an existing system default login module.
  • Create your own custom login module.

For example, if you configure a user name token, you can use the wss.consume.unt JAAS login configuration and maintain the existing behavior. However, you can configure the wss.consume.issuedToken JAAS login to use the generic login module.


指出主題類型的圖示 概念主題



時間戳記圖示 前次更新: July 9, 2016 11:11
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-nd-mp&topic=cwbs_gensectokenmodtokcons
檔名:cwbs_gensectokenmodtokcons.html