Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Secure web services > Secure web services > Administer Web Services Security > Administer message-level security for JAX-WS web services > Secure requests to the trust service using system policy sets > Enable secure conversation


Secure conversation client cache and trust service configuration

For both distributed and local clients, the WAS secure conversation client cache stores tokens on the client.

WAS supports caching of the security context token for both the distributed client and local client. If the security context token is distributed, a client in the same replication domain uses the same security context token. Distributed caching also supports disk offload to save the security context token to disk for recovery. When the client runs applications using secure conversation, and is part of a cluster setup, then the client can use the distributed cache mechanism to replicate the token data among the cluster members.

To use the administrative console to modify the cache settings, click Services > Security Cache.

We can configure the cache settings, such as the following.

The WS-SecureConversation client rejects a security context token that is issued at a future time. If you cannot synchronize the clock between the client machine and service machine, the clock skew could be configured to prevent the rejection of a valid token. The default clock skew is 3 minutes.

To modify the default clock skew setting, add the following custom property to the desired minutes:

clockSkewToleranceInMinutes

Alternatively, use the wsadmin commands to manage secure conversation client cache configurations.


Thin client

For a web service application client running outside WAS, the security context token is cached only in the local Java process. The following system properties can be used to override the default cache setting on the thin client:

com.ibm.wsspi.wssecurity.SC.cache.cushion

Time in minutes to renew a security context token to be used with WS-SecureConversation on the client side so that the security context token has enough time to complete the downstream call. The default value is 10 minutes, and the minimum value is 3 minutes.

com.ibm.wsspi.wssecurity.SC.token.clockSkewTolerance

Tolerant clock skew time for a token between two machines. The default value is 3 minutes.


WS-Reliable Messaging settings

When WAS applications use policies such as WS-I RSP with managed persistent WS-Reliable Messaging, modify the cache and trust configuration values.

Set the cache configuration time value to 120 minutes.

  1. In the WAS administrative console, click Services > Security Cache.
  2. Modify the value of the Time token is in cache after timeout field from 10 to 120.

  3. Click Apply, and then click Save.

Increasing the cache time value means that the token remains in the cache for a longer period after token expiration, so that the token is available for renewal. The WS-Reliable Messaging runtime scopes the CreateSequence message to the security context token. Therefore, it is important to maintain the same security context for the life time of the Reliable Messaging sequence.

Enable distributed caching using the default option, Synchronous update of cluster members, to support distributed clients. For more information, refer to the topic Enabling the distributed cache using synchronous update and token recovery.


Additional recommended changes

Other important configuration changes are also recommended.


Web Services Secure Conversation
Manage WS-Security distributed cache configuration
Enable the distributed cache using synchronous update and token recovery
Configure the Web Services Security distributed cache
Enable distributed cache and session affinity when using Secure Conversation


Related


Security cache settings

+

Search Tips   |   Advanced Search