Configure trust anchors using the Assembly Toolkit

This document describes how to configure trust anchors or trust stores at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. You can configure an application-level trust anchor using the Assembly Toolkit or the administrative console. This document describes how to configure the application-level trust anchor using the Assembly Toolkit. For more information on creating and configuring trust anchors at the server or cell level, see either Configuring the server security bindings using the Assembly Toolkit or Configuring the server security bindings using the administrative console.

A trust anchor specifies key stores that contain trusted root certificates, which validate the signer certificate. These key stores are used by the request receiver (as defined in the ibm-webservices-bnd.xmi file) and the response receiver (as defined in the ibm-webservicesclient-bnd.xmi file when Web services is acting as client) to validate the signer certificate of the digital signature. The key stores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these key stores. The binding configuration specified for the request receiver in the ibm-webservices-bnd.xmi file must match the binding configuration for the response receiver in the ibm-webservicesclient-bnd.xmi file.

The steps in this document assume that you have already created a Web services-enabled Java 2 Platform, Enterprise Edition (J2EE) with Java Specification Requests (JSR) 109 enterprise application. If you have not created a Web services-enabled J2EE with JSR 109 enterprise application, see Developing Web services. Also, see either Configuring the server security bindings using the Assembly Toolkit or Configuring the server security bindings using the administrative console for an introduction on how to manage Web services security binding information on the server.

1. Configure the client-side response receiver, which is defined in the ibm-webservicesclient-bnd.xmi bindings extensions file.

   1. Launch the Assembly Toolkit and click Windows > Open Perspective > J2EE.

   2. Select the Web services-enabled EJBs or Web module.

   3. In the Package Explorer window, click the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

   4. Right-click the webservicesclient.xml file, select Open With > Web Services Client Editor, and click the Web Services Client Binding tab.The Web Services Client Binding editor is displayed.

   5. Locate the Port Qualified Name Binding section and either select an existing entry or click Add, to add a new port binding.The Web Services Client Port Binding editor displays for the selected port.

   6. Locate the Trust Anchor section and click Add. The Trust Anchor dialog box is displayed.

      1. Enter a unique name within the port binding for the Trust anchor name.

         The name is used to reference the trust anchor that is defined.

      2. Enter the key store password, path, and key store type.

         The supported key store types are Java Cryptography Extension (JCE) and JCEKS.

      Click Edit to edit the selected trust anchor.

      Click Remove to remove the selected trust anchor.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

   7. Save the changes.

2. Configure the server-side request receiver, which is defined in the ibm-webservices-bnd.xmi bindings extensions file.

   1. Launch the Assembly Toolkit and click Windows > Open Perspective > J2EE.

   2. Select the Web services enabled EJB or Web module.

   3. In the Package Explorer window, click the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

   4. Right-click the webservices.xml file, select Open With > Web Services Editor, and click the Bindings tab. The Web Services Bindings editor is displayed.

   5. Locate the Web Service Description Bindings section and either select an existing entry or click Add to add a new Web services descriptor.

   6. Click Binding Configurations.The Web Services Binding Configurations editor is displayed for the selected Web services descriptor.

   7. Locate the Trust Anchor section and click Add. The Trust Anchor dialog box is displayed.

      1. Enter a unique name within the binding for the Trust anchor name.

         This unique name is used to reference the trust anchor defined.

      2. Enter the key store password, path, and key store type. The supported key store types are JCE and JCEKS.

      Click Edit to edit the selected trust anchor.

      Click Remove to remove the selected trust anchor.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

   8. Save the changes.

This procedure defines trust anchors that can be used by the request receiver or the response receiver (if the Web services is acting as client) to verify the signer certificate.

 

Usage Scenario

To complete the signing information configuration process for request receiver, complete the following tasks...

1. Configure the server for request digital signature verification: Verifying the message parts

2. Configure the server for request digital signature verification: Choosing the verification method

To complete the process for the response receiver, if the Web services is acting as a client, complete the following tasks...

1. Configure the client for response digital signature verification: Verifying the message parts

2. Configure the client for response digital signature verification: Choosing the verification method

 

See Also

Default binding
Trust anchors
Securing Web services using XML digital signature
Configuring the server security bindings using the Assembly Toolkit
Configuring the server security bindings using the administrative console
Developing Web services based on Web Services for J2EE
Configuring the server for request digital signature verification: verifying the message parts
Configuring the server for request digital signature verification: choosing the verification method
Configuring the client for response digital signature verification: Verifying the message parts
Configuring the client for response digital signature verification: choosing the verification method

 

---