To configure the client for response decryption, specify
which decryption method to use when the client decrypts the response
message. The server response encryption and client response decryption
configurations must match.
Before you begin
Important: There is an important
distinction between Version 5.x and Version 6 and later applications.
The information supports Version 5.x applications only that
are used with WebSphere® Application Server Version 6.0.x and
later. The information does not apply to Version 6.0.x and
later applications.
Prior to completing these steps, read
either of the following topics to become familiar with the
WS
Extensions tab and the
WS Bindings tab
in the Client Deployment Descriptor Editor within an assembly tool:
These two tabs are used to configure the Web Services
Security extensions and Web Services Security bindings, respectively.
About this task
Complete the following steps to specify which decryption
method to use when the client decrypts the response message. The server
response encryption and client response decryption configurations
must match.
Procedure
- Launch an assembly tool. For more information,
see the related information on Assembly Tools.
- Switch to the Java™ Platform,
Enterprise Edition (Java EE)
perspective. Click .
- Click .
- Right-click the application-client.xml file,
select .
- Click the WS Binding tab, which is located at the end of the deployment
descriptor editor within the assembly tool.
- Expand the section. For more information on encrypting
and decrypting SOAP messages, see XML encryption.
- Click Edit to view the encryption
information. The following table describes the purpose
for this information. Some of these definitions are based on the XML-Encryption
specification, which is located at the following web address: http://www.w3.org/TR/xmlenc-core
- Encryption name
- Refers to the alias that is used for the encryption information
entry.
- Data encryption method algorithm
- Encrypts and decrypts data in fixed size, multiple octet blocks.
- Key encryption method algorithm
- Represents public key encryption algorithms specified for encrypting
and decrypting keys.
- Encryption key name
- Represents a Subject from a personal certificate, which is typically
a distinguished name (DN) that is found by the encryption key locator.
The Subject is used by the key encryption method algorithm to decrypt
the secret key. The secret key is used to decrypt the data.
Important: The key chosen must be a private key of the client.
Encryption must be done using the public key and decryption must be
done by the private key (personal certificate). For example, the personal
certificate of the client is: CN=Alice, O=IBM, C=US.
Therefore, the client contains the public and private key pair. The
target server that sends the response encrypts the secret key by using
the public key for CN=Alice, O=IBM, C=US. The
client decrypts the secret key by using the private key for CN=Alice,
O=IBM, C=US.
- Encryption key locator
- Represents a reference to a key locator implementation class that
finds the correct key store where the alias and the certificate exist.
For more information on configuring key locators, see Configuring key locators using an assembly tool and Configuring key locators using the administrative console.
- Optional: Select Show only FIPS
Compliant Algorithms if you only want the FIPS compliant
algorithms to be shown in the Data Encryption method algorithm and
Key Encryption method algorithm dropdown lists. Use this option if
you expect this application to be run on a WebSphere Application
Server that has set the Use the United States Federal Information
Processing Standard (FIPS) algorithms option in the SSL
certificate and key management panel of the administrative console
for WebSphere Application Server.
Results
For decryption, the encryption key name chosen must refer
to a personal certificate that can be located by the client key locator.
The Subject (owner field of the certificate) of the personal
certificate should be entered in the Encryption key name, this is
typically a Distinguished Name (DN). The default key locator uses
the Encryption key name to find the key within the keystore. If you
write a custom key locator, the encryption key name can be anything
used by the key locator to find the correct encryption key. The encryption
key locator references the implementation class that locates the correct
key store where this alias and certificate exists. For more information,
see Configuring key locators using an assembly tool and Configuring key locators using the administrative console.
What to do next
You must specify which parts of the request message to decrypt.
See the topic
Configuring the client for response decryption: decrypting the message parts if
you have not previously specified this information.