The key locator
information for the default generator bindings
specifies which key locator implementation is used to locate the key
for signature and encryption information if these bindings are not
defined at the application level.
About this task
The key locator information
for the default consumer bindings
specifies which key locator implementation is used to locate the key
that is used for signature validation or decryption if these bindings
are not defined at the application level. WebSphere® Application
Server provides default values for the bindings. However, you must
modify the defaults for a production environment.
You
can configure the key locator on the server level and the cell level.
In the following steps, use the first step to access the server-level
default bindings and use the second step to access the cell-level
bindings.
Procedure
- Access the default bindings for the server level.
- Click .
- Under Security, click JAX-WS
and JAX-RPC
security runtime.
混合版本環境: In
a mixed node cell with a server using Websphere Application Server
version 6.1 or earlier, click
Web services: Default bindings
for Web Services Security.
mixv
- Click to access the default
bindings on the cell level.
- Under Additional
properties, click Key locator. You
can configure the key locator configurations for both the
default generator and the default consumer in this location.
- Click one of the following to work with the key
locator
configurations:
- New
- To create
a key locator configuration. Enter a unique name for
the key locator configuration in the Key locator name field.
For example, you might specify sig_klocator.
- Delete
- To delete an existing configuration
- an existing key locator configuration
- To
edit the settings of an existing configuration.
- Specify a name for the key locator class implementation
in the Key locator class name field. The key locators that are associated with Version
6.0.x applications must implement the com.ibm.wsspi.wssecurity.keyinfo.KeyLocator interface.
Note: This interface
is valid only for JAX-RPC applications. For
JAX-WS applications, the Java™ Authentication
and Authorization Service (JAAS) Login Module implementation is used
to create the security token on the generator side and to validate
(authenticate) the security token on the consumer side.
WebSphere
Application Server provides the following default key locator class
implementations for Version 6.0.x applications:- com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator
- This implementation locates and obtains the key from a specified
keystore file.
- com.ibm.wsspi.wssecurity.keyinfo.SignerCertKeyLocator
- This implementation uses the public key from the certificate of
the signer. This class implementation is used by the response generator.
- com.ibm.wsspi.wssecurity.keyinfo.X509TokenKeyLocator
- This implementation uses the X.509 security token from the sender
message for digital signature validation and encryption. This class
implementation is used by the request consumer and the response consumer.
For example, you might specify the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator implementation
if you need the configuration to be the key locator for signing information.
- Specify the keystore password, the keystore location,
and
the keystore type. Keystore files contain public and private
keys, root certificate authority (CA) certificates, the intermediate
CA certificate, and so on. Keys that are retrieved from the keystore
file are used to sign and validate or encrypt and decrypt messages
or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation
for the key locator class implementation, you must specify a key store
password, location, and type.
- Specify
a password in the Key store password field. This password is used to access the keystore file.
- Specify the location of the keystore file
in the Key
store path field.
- Select
a keystore type from the Key store
type field. The Java Cryptography
Extension (JCE) that is used supports the following key store types:
- JKS
- Use this option if you are not using Java Cryptography
Extensions (JCE) and if your keystore file uses the Java Keystore
(JKS) format.
- JCEKS
- Use this option
if you are using Java Cryptography
Extensions.
JCERACFKS
Use
JCERACFKS if the certificates are stored in a SAF key ring
(z/OS® only).
- PKCS11
- Use this format if your keystore file uses the PKCS#11 file format.
Keystore files that use this format might contain Rivest Shamir Adleman
(RSA) keys on cryptographic hardware or might encrypt keys that use
cryptographic hardware to ensure protection.
- PKCS12
- Use this option if your keystore file uses the PKCS#12 file format.
WebSphere Application Server
provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory.
For example, you might use the enc-receiver.jceks keystore
file for encryption keys. The password for this file is storepass and
the type is JCEKS.
Restriction: Do
not use these keystore files in a production environment. These samples
are provided for testing purposes only.
- Click OK and Save to
save the configuration.
- Under Additional properties,
click Keys.
- Click one
of the following to work with the key configurations:
- New
- To create a key configuration. Enter a unique
name in the Key
name field. You must use a fully qualified distinguished
name for the key name. For example, you might use CN=Bob,O=IBM,C=US.
- Delete
- To delete an existing configuration.
- an existing key configuration
- To edit
the settings of the existing configuration.
This
entry specifies the name of the key object within
the keystore file.
- Specify an alias in the Key
alias field. The key alias is used by the key
locator to search for key objects
in the keystore file.
- Specify a password in
the Key password field. The password
is used to access the key object within the keystore
file.
- Click OK and
then click Save to
save the configuration.
Results
You have configured
the key locator for the server or cell level.
What to do next
Configure
the key information for the default generator and
the default consumer bindings that reference this key locator.