High-level architecture for WS-Security

The WS-Security policy is specified in the IBM extension of the Web services deployment descriptors when using the JAX-RPC model, and in policy sets when using the JAX-WS model.

A stand-alone JAX-WS client application may specify Web Services security policy programmatically.

Binding data that supports the Web Services security policy are stored in the IBM extension of the Web services deployment descriptors for both the JAX-RPC and JAX-WS models.

The Web Services security run time enforces the security assertions specified in the policy document, or in the application program, in that order.

IBM WAS supports the JAX-WS model and the JAX-RPC model. JAX-WS uses annotations.

JAX-RPC is still supported.

WAS uses the Java EE Version 1.4 or later Web services deployment model to implement Web services security. One of the advantages of deployment model is that we can define the WS-Security requirements outside of the application business logic. With the separation of roles, the application developer can focus on the business logic and the security expert can specify the security requirement.

The following figure shows the high-level architecture model used to secure Web services in WAS v7.0:

The WSS API can also be used to secure the message, as illustrated below:

There are two sets of configurations on both the client side and the server side:

Request generator

This client-side configuration defines the WS-Security requirements for the outgoing SOAP message request. These requirements might involve generating a SOAP message request that uses a digital signature, incorporates encryption, and attaches security tokens. In WAS Versions 5.0.2, 5.1, and 5.1.1, the request generator was known as the request sender.

Request consumer

This server-side configuration defines the WS-Security requirements for the incoming SOAP message request. These requirements might involve verifying that the required integrity parts are digitally signed; verifying the digital signature; verifying that the required confidential parts were encrypted by the request generator; decrypting the required confidential parts; validating the security tokens, and verifying that the security context is set up with the appropriate identity. In WAS Versions 5.0.2, 5.1, and 5.1.1, the request consumer was known as the request receiver.

Response generator

This server-side configuration defines the WS-Security requirements for the outgoing SOAP message response. These requirements might involve generating the SOAP message response with Web services security; including digital signature; and encrypting and attaching the security tokens, if necessary. In WAS Versions 5.0.2, 5.1, and 5.1.1, the response generator was known as the response sender.

Response consumer

This client-side configuration defines the WS-Security requirements for the incoming SOAP response. The requirements might involve verifying that the integrity parts are signed and the signature is verified; verifying that the required confidential parts are encrypted and that the parts are decrypted; and validating the security tokens. In WAS Versions 5.0.2, 5.1, and 5.1.1, the response consumer was known as the response receiver.

WAS does not include security policy negotiation or exchange between the client and server. This security policy negotiation, as defined by the WS-Policy, WS-PolicyAssertion, and WS-SecurityPolicy specifications, are not supported in WAS.

The WS-Security requirements defined in the request generator must match the request consumer. The requirements defined in the response generator must match the response consumer. Otherwise, the request or response is rejected because the WS-Security constraints cannot be met by the request consumer and response consumer.

The format of the WS-Security deployment descriptors and bindings are IBM proprietary. However, the following tools are available to edit the deployment descriptors and bindings:

IBM assembly tools

Use IBM assembly tools to edit the WS-Security deployment descriptor and binding. Use the tools to assemble both Web and EJBs modules.

See, read about assembly tools.

WAS Administrative Console

Use this tool to edit the WS-Security binding of a deployed application.

---

Subtopics

Security model mixture
Overview of platform configuration and bindings
Default configuration
Default implementations of the WS-Security service provider programming interfaces
Assembly tools
WS-Security provides message integrity, confidentiality, and authentication
Request generator (sender) binding settings
Request consumer (receiver) binding settings
Response generator (sender) binding settings
Response consumer (receiver) binding settings