Operating Systems: i5/OS
             Personalize the table of contents and search results
Configure the server security bindings using an assembly tool
Overview
There is an important distinction between
V5.x and V6 and later applications. The information in
this article supports V5.x applications only that are used with
WebSphere Application Server V6.0.x and later. The information
does not apply to V6.0.x and later applications.
Create
an Enterprise JavaBeans (EJB) file Java archive (JAR) file or a Web archive
(WAR) file containing the security binding file (ibm-webservices-bnd.xmi)
and the security extension file (ibm-webservices-ext.xmi).Â
If this archive is acting as a client to a downstream service, you also need
the client-side binding file (ibm-webservicesclient-bnd.xmi) and
the client-side extension file (ibm-webservicesclient-ext.xmi).Â
These files are generated using the WSDL2Java command for JAX-RPC applications. You can edit these files using the Web services editor
in the Assembly tools.
When configuring server-side security for Web services security,
the security extensions configuration specifies what security is performed,
the security bindings configuration indicates how to perform what is specified
in the security extensions configuration. You can use the defaults for some
elements at the cell and server levels in the bindings configuration,
including key locators, trust anchors, the collection certificate store, trusted
ID evaluators, and login mappings and reference these elements from the WAR
and JAR binding configurations.
Prior to importing the Web services
enterprise archive (EAR) file into the assembly tool, make sure that you have
already run the wsdl2java command on your Web service to enable your
J2EE application. You must import the
Web services EAR file into the assembly tool.
Open the Web services
editor in an assembly tool to begin editing the server security extensions
and bindings. The following steps can locate the server security extensions
and bindings. Other tasks specify how to configure each section of the extensions
and bindings in more detail.
Procedure
- Launch an assembly tool. For more information on the
assembly tools, see Assembly tools.
- Switch to the J2EE perspective. Click Window > Open Perspective
> J2EE.
- Configure the server for inbound requests and outbound responses
security configuration. To configure the server for inbound requests
and outbound responses, complete the following steps:
- Click EJB Projects > application_name > ejbModule
> META-INF.
- Right-click the webservices.xml file and click Open
with > Web services editor. The webservices.xml file
represents the server-side (inbound) Web services configuration. The webservicesclient.xml file
represents the client-side (outbound) Web services configuration.
- In the Web services editor (for the webservices.xml file
and inbound requests and outbound responses Web services configuration), there
are several tabs at the bottom of the editor including Web Services, Port
Components, Handlers, Security Extensions, Bindings, and Binding Configurations.
The security extensions are edited using the Security Extensions tab. The
security bindings are edited using the Security Bindings tab.
- Click the WS Extensions tab and select the port component binding
to edit. The Web services security extensions are configured for inbound requests
and outbound responses. You need to configure the following information for
Web services security extensions. These topics are discussed in more detail
in other topics in the documentation. Request receiver
service configuration details
- Required integrity
-
Configuring the server for request digital signature verification:
Verifying the message parts
- Required confidentiality
-
Configuring the server for request decryption: decrypting the message
parts
- Login config
-
- Basic auth
-
Configuring the server to handle basic authentication information
- ID assertion
-
Configuring the server to handle identity assertion authentication
- Signature
-
Configuring the server to support signature authentication
- LTPA
-
Configuring the server to handle LTPA token authentication information
- Add received time stamp
-
Configuring the server for request digital signature verification:
Verifying the message parts
Response sender service configuration details
- Details
-
Configuring the server for response signing: digitally signing message
parts
- Integrity
-
Configuring the server for response signing: digitally signing message
parts
- Confidentiality
-
Configuring the server for response encryption: encrypting the message
parts
- Add created time stamp
-
Configuring the server for response signing: digitally signing message
parts
- Click the Binding Configurations tab and select the port component
binding to edit. The Web services security bindings are configured for inbound
requests and outbound responses. You need to configure the following information
for Web services security bindings. These topics are discussed in more details
in other topics in the documentation. Response
receiver binding configuration details
- Signing Information
-
Configuring the server for request digital signature verification:
choosing the verification method
- Encryption Information
-
Configuring the server for request decryption: choosing the decryption
method
- Trust Anchor
-
Configuring trust anchors using an assembly tool
- Certificate Store List
-
Configuring the server-side collection certificate store using an assembly
tool
- Key Locators
-
Configuring key locators using an assembly tool
- Login Mapping
-
- Basic auth
-
Configuring the server to validate basic authentication information
- ID assertion
-
Configuring the server to validate identity assertion authentication
information
- Signature
-
Configuring the server to validate signature authentication information
- LTPA
-
Configuring the server to validate LTPA token authentication information
- Trusted ID evaluator
-
- Trusted ID evaluator reference
-
Response sender binding configuration details
- Signing information
-
Configuring the server for response signing: choosing the digital signature
method
- Encryption information
-
Configuring the server for response encryption: choosing the encryption
method
- Key locators
-
Configuring key locators using an assembly tool
What to do next
Configure the client for outbound requests and inbound responses
security configuration by right-clicking the webservicesclient.xml file
and clicking Open With > Deployment descriptor editor. For more information,
see Configuring the client security bindings using an assembly tool.
}
Related tasks
Configuring the client security bindings using an assembly tool
Configuring the security bindings on a server acting as a client using
the administrative console
Configuring the server security bindings using the administrative console
Securing Web services for V5.x applications using XML digital
signature
  Â