Configure the server to handle BasicAuth authentication information

BasicAuth refers to the user ID and the password of a valid user in the registry of the target server.  After a request is received that contains basic authentication information, the server needs to log in to form a credential.  The credential is used for authorization. If the user ID and the password supplied are not valid, an exception is thrown and the request ends without invoking the resource. For more information on BasicAuth authentication, see BasicAuth.

Complete the following steps to configure the server to handle BasicAuth authentication information...

1. Launch the Assembly Toolkit.

2. Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.

3. Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.

4. In the Project Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

5. Right-click the webservices.xml file, and click Open With > Web Services Editor.

6. Click the Security Extensions tab, which is located at the bottom of the Web services editor within the Assembly Toolkit.

7. Expand the Request Receiver Service Configuration Details > Login Configuration section. You can select the following options: 

   • BasicAuth

   • Signature

   • ID assertion

   • Lightweight Third Party Authentication (LTPA)

   .

8. Select BasicAuth to authenticate the client with a user ID and a password.The client must specify a valid user ID and password in the server user registry.

   You can select multiple login configurations, which means that different types of security information might be received at the server.  The order in which the login configurations are added decides the order in which they are processed when a request is received. Problems can occur if you have multiple login configurations added that have security tokens in common.  For example, ID assertion contains a BasicAuth token. For ID assertion to work properly, list ID assertion ahead of BasicAuth in the processing list or the BasicAuth processing overrides the IDAssertion processing.

After you specify how the server handles BasicAuth authentication information, specify how the server validates the authentication information. See Configuring the server to validate basicauth authentication information for more information.

 

See Also

BasicAuth authentication method
Securing Web services using XML encryption
Configuring the server to validate BasicAuth authentication information
Configuring the server security bindings using the Assembly Toolkit
Configuring the server security bindings using the administrative console

 

---