Securing JAX-RPC Web services manually based on WS-Security

If the Web services security wizards do not meet your needs, you have the option of manually securing your Web services. Standards and profiles address how to provide protection for messages that are exchanged in a JAX-RPC Web service environment.

Web service security is supported in the managed Web service container. To establish a managed environment and to enforce constraints for Web services security, perform a Java™ Naming and Directory Interface (JNDI) lookup on the client to resolve the service reference. For more information on the recommended client programming model, see "Service lookup" in the Java Specification Request (JSR) 109 specification available at: ftp://www-126.ibm.com/pub/jsr109/spec/1.0/websvcs-1_0-fr.pdf.

WebSphere® Application Server Version 6 and Version 5.x compatibility

In WAS Version 6, you can run a version 5.x Web services-secured application on a v6 application server. However, when you use a Web services-secured application, the client and the server must use the same version of the application server. For example, a Web services-secured application does not work properly when the client uses WAS Version 6 and the server uses version 5.x. Conversely, a Web services-secured application does not work properly when the client uses WAS Version 5.x and the server uses v6. This issue occurs because the SOAP message format is different between a version 5.x application and a v6 application.

Configurations

To secure Web services with WAS, specify several different configurations. Although there is not a specific sequence in which specify these different configurations, some configurations reference other configurations. The following table shows an example of the relationship between each of the configurations. However, the requirements for the bindings depend upon the deployment descriptor. Some binding information depends upon other information in the binding or server and cell-level configuration. For instance, the signing information references the key information.

Table 1. The relationship between the configurations.
Configuration level Configuration name Configurations it references
Application-level request generator Token generator

  • Collection certificate store

  • Nonce

  • Timestamp

  • Callback handler
Application-level request generator Key information

  • Key locator

  • Key name

  • Token
Application-level request generator Signing information

  • Key information
Application-level request generator Encryption information

  • Key information
Application-level request consumer Token consumer

  • Trust anchor

  • Collection certificate store

  • Trusted ID evaluators

  • Java Authentication and Authorization Service (JAAS) configuration
Application-level request consumer Key information

  • Key locator

  • Token
Application-level request consumer Signing information

  • Key information
Application-level request consumer Encryption information

  • Key information
Application-level response generator Token generator

  • Collection certificate store

  • Callback handler
Application-level response generator Key information

  • Key locator

  • Token
Application-level response generator Signing information

  • Key information
Application-level response generator Encryption information

  • Key information
Application-level response consumer Token consumer

  • Trust anchor

  • Collection certificate store

  • JAAS configuration
Application-level response consumer Key information

  • Key locator

  • Key name

  • Token
Application-level response consumer Signing information

  • Key information
Application-level response consumer Encryption information

  • Key information
Server-level default generator bindings Token generator

  • Collection certificate store

  • Callback handler
Server-level default generator bindings Key information

  • Key locator

  • Token
Server-level default generator bindings Signing information

  • Key information
Server-level default generator bindings Encryption information

  • Key information
Server-level default consumer bindings Token consumer

  • Trust anchor

  • Collection certificate store

  • Trusted ID evaluator

  • JAAS configuration
Server-level default consumer bindings Key information

  • Key locator

  • Token
Server-level default consumer bindings Signing information

  • Key information
Server-level default consumer bindings Encryption information

  • Key information
Cell-level default generator bindings Token generator

  • Collection certificate store

  • Callback handler
Cell-level default generator bindings Key information

  • Key locator

  • Token

If multiple applications will use the same binding information, consider configuring the binding information on the server level. For example, you might have a global key locator configuration that is used by multiple applications.

Because of the relationship between the different Web services security configurations, it is recommended that you specify the configurations in following order:

After completing these steps on the appropriate level of WAS, you have secured Web services.

Note: Configuration information for the application-level precedes similar configuration information on the server-level.

 

Related tasks

Configuring an application for Web services security