Configure pluggable tokens using the administrative console

 

+

Search Tips   |   Advanced Search

 

 

Before you begin

Prior to completing these steps, it is assumed that you have already created a Web services-enabled J2EE with a Web Services for J2EE (JSR 109) enterprise application. If not, see Developing Web services applications to create Web services-enabled J2EE with a JSR 109 enterprise application. See either of the following topics for an introduction of how to manage Web services security binding information for the server:

 

Overview

This document describes how to configure a pluggable token in the request sender...

ibm-webservicesclient-ext.xmi
ibm-webservicesclient-bnd.xmi

...and request receiver...

ibm-webservices-ext.xmi
ibm-webservices-bnd.xmi

The pluggable token is required for the request sender and request receiver as they are a pair. The request sender and the request receiver must match for a request to be accepted by the receiver.

Prior to completing these steps, it is assumed that you deployed a Web services-enabled enterprise application to the WebSphere Application Server.

Use the following steps to configure the client-side request sender or server-side request receiver using the WAS Administrative Console.

  1. Click...

    Applications | Enterprise applications | enterprise_application | EJB modules or Web modules | URI | Web services: client security bindings
    If Web services is acting as client.

    1. Under Response sender binding, click Edit.

    2. Under Additional Properties, click Login binding.

    3. Select Dedicated login binding to define a new login binding.

      1. Enter the authentication method, this must match the authentication method defined in IBM extension deployment descriptor. The authentication method must be unique in the binding file.

      2. Enter an implementation of the JAAS javax.security.auth.callback.CallbackHandler interface.

      3. Enter the basic authentication information (User ID and Password) and the basic authentication information is passed to the construct of the CallbackHandler implementation. The usage of the basic authentication information is up to the implementation of the CallbackHandler.

      4. Enter the token value type, it is optional for BasicAuth, Signature and IDAssertion authentication methods but required for any other authentication method. The token value type is inserted into the <wsse:BinarySecurityToken>@ValueType for binary security token and used as the namespace of the XML based token.

      5. Click Properties. Define the property with name and value pairs. These pairs are passed to the construct of the CallbackHandler implementation as java.util.Map.

      Select None to deselect the login binding.

  2. Under Additional Properties, click Web services: server security bindings to edit the request receiver binding information.

    1. Under Request Receiver Binding, click Edit.

    2. Under Additional Properties, click Login mappings.

    3. Click New to create new login mapping.

      1. Enter the authentication method, this must match the authentication method defined in the IBM extension deployment descriptor. The authentication method must be unique in the login mapping collection of the binding file.

      2. Enter a JAAS Login Configuration name. The JAAS Login Configuration must be defined under Security > Global security. Under Authentication, click JAAS Configuration > Application Logins. For more information, see Configuring application logins for Java Authentication and Authorization Service.

      3. Enter an implementation of the interface...

        com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory interface.

        This is a mandatory field.

      4. Enter the token value type, it is optional for BasicAuth, Signature and IDAssertion authentication methods but required for any other authentication method. The token value type is used to validate against the <wsse:BinarySecurityToken>@ValueType for binary security token and against the namespace of the XML based token.

      5. Enter the name and value pairs for the "Login Mapping Property" by clicking Properties .

        These name and value pairs are available to the JAAS Login Module or Modules by...

        com.ibm.wsspi.wssecurity.auth.callback.PropertyCallback JAAS Callback.

        Note: This is true when editing existing login mappings but not when creating new login mappings.

      6. Enter the name and value pairs for the "Callback Handler Factory Property", these name and value pairs is passed as method...

        java.util.Map

        ...to the method...

        com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory.init()

        The usage of these name and value pairs is up to the CallbackHandlerFactory implementation.

  3. Click authentication method link to edit the selected login mapping.

  4. Click Remove to remove the selected login mapping or mappings.

  • Click Save .

     

    Result

    The previous steps define how to configure the request sender to create security tokens in the SOAP message and the request receiver to validate the security tokens found in the incoming SOAP message. WAS supports pluggable security tokens.

    Use the authentication method defined in the login bindings and login mappings to generate security tokens in the request sender and validate security tokens in the request receiver.

     

    What to do next

    Once you have configured pluggable tokens, configure both the client and the server to support pluggable tokens. See the following topics to configure the client and the server:

     

    See Also


    Pluggable token support
    Authentication method overview
    Binary security token
    XML token
    Username token element
    Security token
    Token type overview

     

    Related Tasks


    Configuring pluggable tokens using an assembly tool
    Developing Web services applications
    Configuring application logins for Java Authentication and Authorization Service