Implementing the user name token

The user name token security mechanism provides user name and password credentials.

Why and when to perform this task

With the user name token security mechanism, you can choose to implement various callback handlers. Depending on your choice:

In either case, the supplied user name and password must match those of an authorized role in the corresponding business process container or human task container.

The user name and password are encapsulated in the request message envelope, and so appear "in clear" in the SOAP message header. It is therefore strongly recommended that you configure the client application to use the HTTPS (HTTP over SSL) communications protocol. All communications are then encrypted. You can select the HTTPS communications protocol when you specify the Web service API's endpoint URL address.

To define a user name token:

Steps for this task

  1. In the Rational Application Developer environment available in WebSphere Integration Developer, choose WS Binding > Security Request Generator Binding Configuration > Token Generator.
  2. On the Token Generator dialog, choose Username as the Token type.
  3. In the Call back handler field, type either com.ibm.wsspi.wssecurity.auth.callback.GUIPromptCallbackHandler (which prompts for the user name and password when you run the client application) or com.ibm.wsspi.wssecurity.auth.callback.NonPromptCallbackHandler.
  4. If you choose NonPromptCallbackHandler, you must specify a valid user name and password in the deployment descriptor.
Related tasks
Specifying the Web service endpoint address
Related information
IBM WebSphere Developer Technical Journal: Web services security with WebSphere Application Server V6

(c) Copyright IBM Corporation 2005, 2006.
This information center is powered by Eclipse technology (http://www.eclipse.org)