Configure the client for signature authentication: collecting the authentication information: WAS v5.1

Configure the client for signature authentication: collecting the authentication information

This task is used to configure signature authentication. A signature refers to the use of an X.509 certificate to login on the target server. For more information on signature authentication, see Signature authentication method.
Complete the following steps to specify how the client collects the authentication information for signature authentication...

Launch the Assembly Toolkit.
Open the J2EE perspective by clicking Window > Open Perspective > Other > J2EE.
Select the Web services-enabled Enterprise JavaBean (EJB) or Web module.
In the Project Navigator window, locate the META-INF directory for an EJB module or the WEB-INF directory for a Web module.
Right-click the webservicesclient.xml file, and click Open With > Web Services Client Editor.
Click the Port Binding tab, which is located at the bottom of the Web services cient editor within the Assembly Toolkit.
Expand the Security Request Sender Binding Configuration > Signing Information and click Edit to modify the signing key name and signing key locator. To create new signing information, click Enable. The certificate that is sent to log in at the server is the one configured in the Signing Information section. Review the section on Key locators to understand how the signing key name maps to a key within the key locator entry.
The following list describes the purpose of this information. Some of these definitions are based on the XML-Signature specification, which is located at the following Web address: http://www.w3.org/TR/xmldsig-core

Canonicalization method algorithm Canonicalizes the SignedInfo element before it is digested as part of the signature operation.

Digest mehod algorithm Represents the algorithm that is applied to the data after transforms are applied, if specified, to yield the <DigestValue> element. The signing of the DigestValue element binds the resource content to the signer key. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.

Signature method algorithm Represents the algorithm that is used to convert the canonicalized <SignedInfo> value into the <SignatureValue> value. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.

Signing key name Represents the key entry associated with the signing key locator. The key entry refers to an alias of the key, which is used to sign the request.

Signing key locator TRepresents a reference to a key locator implementation. For more information on configuring key locators, see Key locators.

Expand the Security Request Sender Binding Configuration > Login Binding section.
Click Edit to view the login binding information. Then, select or enter the following information...

Authentication method Specifies the type of authentication that occurs. Select Signature to use signature authentication.

Token value type URI and Token value type URI local name When you select Signature, you cannot edit the Token value type URI and Local name values. Specifies custom authentication types. For signature authentication, leave these fields blank.

Callback handler Specifies the Java Authentication and Authorization Server (JAAS) callback handler implementation for collecting signature information. Enter the following callback handler for signature authentication: com.ibm.wsspi.wssecurity.auth.callback.NonPromptCallbackHandler
This callback handler is used because the signature method does not require user interaction.

Basic authentication User ID and Basic authentication Password Leave the BasicAuth fields blank when Signature authentication is used.

Property name and property value This field enables you to enter properties and name and value pairs for use by custom callback handlers. For signature authentication, you do not need to enter any information.

Other customization entries: There is a basic authentication entry in the Port Qualified Name Binding Details section. This entry is used for HTTP transport authentication, which might be required if the router servlet is protected.
Information specified in the Web services security signature authentication section overrides the basic authentication information specified in the Port Qualified Name Binding Details section for authorizing the Web service.
To use the signature authentication method, specify the authentication method in the Login Config section of the Assembly Toolkit. See Configuring the client for signature authentication: specifying the method if you have not previously specified this information.

See Also
Key locator
Securing Web services using signature authentication
Configuring the client for signature authentication: specifying the method
Configuring the client security bindings using the Assembly Toolkit
XML-Signature Syntax and Processing W3C Recommendation 12 February 2002

Canonicalization method algorithm	Canonicalizes the SignedInfo element before it is digested as part of the signature operation.
Digest mehod algorithm	Represents the algorithm that is applied to the data after transforms are applied, if specified, to yield the <DigestValue> element. The signing of the DigestValue element binds the resource content to the signer key. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.
Signature method algorithm	Represents the algorithm that is used to convert the canonicalized <SignedInfo> value into the <SignatureValue> value. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.
Signing key name	Represents the key entry associated with the signing key locator. The key entry refers to an alias of the key, which is used to sign the request.
Signing key locator	TRepresents a reference to a key locator implementation. For more information on configuring key locators, see Key locators.

Authentication method	Specifies the type of authentication that occurs. Select Signature to use signature authentication.
Token value type URI and Token value type URI local name	When you select Signature, you cannot edit the Token value type URI and Local name values. Specifies custom authentication types. For signature authentication, leave these fields blank.
Callback handler	Specifies the Java Authentication and Authorization Server (JAAS) callback handler implementation for collecting signature information. Enter the following callback handler for signature authentication: com.ibm.wsspi.wssecurity.auth.callback.NonPromptCallbackHandler This callback handler is used because the signature method does not require user interaction.
Basic authentication User ID and Basic authentication Password	Leave the BasicAuth fields blank when Signature authentication is used.
Property name and property value	This field enables you to enter properties and name and value pairs for use by custom callback handlers. For signature authentication, you do not need to enter any information.