Configure pluggable tokens using the Assembly Toolkit

This document describes how to configure a pluggable token in the request sender (ibm-webservicesclient-ext.xmi and ibm-webservicesclient-bnd.xmi file) and request receiver (ibm-webservices-ext.xmi and ibm-webservices-bnd.xmi file).

The pluggable token is required for the request sender and request receiver because they are a pair. The request sender and the request receiver must match for the receiver to accept a request.

Prior to completing these steps, it is assumed that you have already created a Web services-enabled Java 2 Platform, Enterprise Edition (J2EE) with a Web Services for J2EE (JSR 109) enterprise application. If not, see Developing Web services to create Web services-enabled J2EE with a JSR 109 enterprise application. See either of the following topics for an introduction of how to manage Web services security binding information for the server...

You must specify the security constraints in the ibm-webservicesclient-ext.xmi and the ibm-webservices-ext.xmi files for the required tokens using the Assembly Toolkit.

Complete the following steps to configure the request sender using the ibm-webservicesclient-ext.xmi and ibm-webservicesclient-bnd.xmi files...

  1. Launch the Assembly Toolkit.

  2. Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.

  3. Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.

  4. In the Package Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

  5. Right-click the webservicesclient.xml file, and click Open With > Web Services Client Editor.

  6. Click the Security Extensions tab.The Web service client security extensions editor is displayed.

    1. Under Service References, select an existing service reference or click Add to create a new reference.

    2. Under Port Qname Bindings, select an existing port qualified name for the selected service reference or click Add to create a new port name binding.

    3. Under Request Sender Configuration: Login Configuration, select an exiting authentication method or type in a new one in the editable list box (Lightweight Third Party authentication (LTPA) is a supported token generation when Web services is acting as client).

    4. Click File > Save to save the changes.

  7. Click the Web Services Client Binding tab.The Web services client binding editor is displayed.

    1. Under Port Qualified Name Binding, select an existing entry or click Add to add a new port name binding.The Web Services Client Binding editor displays for the selected port.

    2. Under Login Binding, click Edit or Enable. The Login Binding dialog box is displayed.

      1. In the Authentication Method field, enter the authentication method. The authentication method that you enter in this field must match the authentication method defined on the Security Extension tab for the same Web service port. This field is mandatory.

      2. (Optional) Enter the token value type information in the URI and Local name fields. These fields are ignored for the BasicAuth, Signature, and IDAssertion authentication methods, but required for other authentication methods. The token value type information is inserted into the <wsse:BinarySecurityToken>@ValueType element for binary security token and is used as the namespace for the XML-based token.

      3. Enter an implementation of the Java Authentication and Authorization Service (JAAS) javax.security.auth.callback.CallbackHandler interface. This field is mandatory.

      4. Enter the basic authentication information in the User ID and Password fields. The basic authentication information is passed to the construct of the CallbackHandler implementation. The use of the basic authentication information depends on the implementation of CallbackHandler.

      5. In the Property field, add name and value pairs. These pairs are passed to the construct of the CallbackHandler implementation as java.util.Map values.

      6. Click OK.

      Click Disable under Login Binding on the Web Services Client Port Binding tab to remove the authentication method login binding.

    3. Click File > Save to save the changes.

  8. In the Package Explorer window, right-click the webservices.xml file and click Open With > Web Services Editor.The Web Services window displays.

    1. Click the Security Extensions tab.The Web Service Security Extensions editor is displayed.

      1. Under Web Service Description Extension, select an existing service reference or click Add to create a new extension.

      2. Under Port Component Binding, select an existing port qualified name for the selected service reference or click Add to create a new one.

      3. Under Request Receiver Service Configuration Details: Login Configuration, select an exiting authentication method or click Add and enter a new method in the Add AuthMethod field that displays. You can select multiple authentication methods for the request receiver. The security token of the incoming message is authenticated against the authentication methods in the order that they are specified in the list. Click Remove to remove the selected authentication method or methods.

    2. Click File > Save to save the changes.

    3. Click the Bindings tab. The Web services bindings editor is displayed.

      1. Under Web Service Description Bindings, select an existing entry or click Add to add a new Web services descriptor.

      2. Click the Binding Configurations tab. The Web services binding configurations editor is displayed for the selected Web services descriptor.

      3. Under Request Receiver Binding Configuration Details: Login Mapping, click Add to create a new login mapping or click Edit to edit the selected login mapping. The Login mapping dialog is displayed.

        1. In the Authentication method field, enter the authentication method. The information entered in this field must match the authentication method defined on the Security Extensions tab for the same Web service port. This field is mandatory.

        2. In the Configuration name field, enter a JAAS login configuration name. You must define the JAAS login configuration name in the WebSphere Application Server administrative console under Security > JAAS Configuration > Application Logins. This is a mandatory field. For more information, see Configuring Java Authentication and Authorization Service login.

        3. (Optional) Select Use Token value type and enter the token value type information in the URI and Local name fields. This information is optional for BasicAuth, Signature and IDAssertion authentication methods, but required for any other authentication method. The token value type is used to validate the <wsse:BinarySecurityToken>@ValueType element for binary security tokens and to validate the namespace of the XML-based token.

        4. Under Callback Handler Factory, enter an implementation of the com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory interface in the Class name field. This field is mandatory.

        5. Under Callback Handler Factory property, click Add and enter the name and value pairs for the Callback Handler Factory Property. These name and value pairs are passed as java.util.Map to the com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory.init() method. The use of these name and value pairs is determined by the CallbackHandlerFactory implementation.

        6. Under Login Mapping Property, click Add and enter the name and value pairs for the Login mapping property. These name and value pairs are available to the JAAS Login Modules through thecom.ibm.wsspi.wssecurity.auth.callback.PropertyCallback JAAS Callback interface. Click Remove to delete the selected login mapping.

        7. Click OK.

    4. Click File > Save to save the changes.

The previous steps define how to configure the request sender to create security tokens in the Simple Object Access Protocol (SOAP) message and to configure the request receiver to validate the security tokens found in the incoming SOAP message. WAS supports pluggable security tokens.

Use the authentication method defined in the login bindings and login mappings to generate security tokens in the request sender and validate security tokens in the request receiver.

After you configure pluggable tokens, configure both the client and the server to support pluggable tokens. See the following topics to configure the client and the server...

 

See Also

Pluggable token support
Authentication method overview
Binary security token
XML token
Username token element
Security token
Token type overview
Securing Web services using a pluggable token
Warning: no string named [twbs_conplugac] found.
Configuring the client security bindings using the Assembly Toolkit
Configuring the security bindings on a server acting as a client using the administrative console
Configuring the server security bindings using the Assembly Toolkit
Configuring the server security bindings using the administrative console
Developing Web services based on Web Services for J2EE
Configuring Java Authentication and Authorization Service login
Configuring the client for LTPA token authentication: specifying LTPA token authentication
Configuring the client for LTPA token authentication: Collecting the authentication method information
Configuring the server to handle LTPA token authentication information
Configuring the server to validate LTPA token authentication information