+

Search Tips   |   Advanced Search

Set the key locator using JAX-RPC for the consumer binding on the application level


The key locator information for the consumer at the application level specifies which key locator implementation is used. The key locator implementation locates the key to be used to validate the digital signature or the encryption information by the application.

Complete the following steps to configure the key locator for the consumer binding on the application level:

 

  1. Locate the key locator configuration panel in the admin console.

    1. Click Applications > Application Types > WebSphere enterprise apps > application_name.

    2. Under Manage modules, click URI_name.

    3. Under WS-Security Properties, we can access the key information for the request consumer and response consumer bindings.

    4. Under Additional properties, click Key locators.

    5. Click New to create a key locator configuration, click Delete and select the box next to the configuration to delete an existing configuration, or click the name of an existing key locator configuration to edit its settings.

      If creating a new configuration, enter a unique name in the Key locator name field. For example, we might specify klocator.

  2. Specify a name for the key locator class implementation.

    The Java Authentication and Authorization Service (JAAS) Login Module implementation is used to validate (authenticate) the security token on the consumer side. Specify a class name according to the requirements of the application. For example, if the application requires that the key is read from a keystore file, specify the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation. WAS provides the following default key locator class implementations for Version 6.0.x applications that are available to use with the request consumer or response consumer:

    com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator

    This implementation locates and obtains the key from the specified keystore file.

    com.ibm.wsspi.wssecurity.keyinfo.X509TokenKeyLocator

    This implementation uses the X.509 security token from the sender message for digital signature validation and encryption. This class implementation is used by the request consumer and the response consumer.

  3. Specify the keystore password, the keystore location, and the keystore type. Keystore files contain public and private keys, root certificate authority (CA) certificates, the intermediate CA certificate, and so on. Keys that are retrieved from the keystore files are used to sign and validate or encrypt and decrypt messages or message parts. If we specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation for the key locator class implementation, specify a keystore password, location, and type.

    1. Specify a password in the keystore Password field.

      This password is used to access the keystore file.

    2. Specify the location of the keystore file in the keystore Path field.

    3. Select a keystore type from the keystore Type field.

      The JCE used by IBM supports the following keystore types:

      JKS

      Use this option if we are not using Java Cryptography Extensions (JCE) and if wer keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if we are using Java Cryptography Extensions.

      PKCS11KS (PKCS11)

      Use this format if the keystore file uses the PKCS#11 file format. Keystore files that use this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if the keystore uses the PKCS#12 file format.

      WAS provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, we might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is Storepass and the type is JCEKS.

      Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

  4. Click OK and Save to save the configuration.

  5. Under Additional properties, click Keys.

  6. Click New to create a key configuration, click Delete and select the box next to the configuration to delete an existing configuration, or click the name of an existing key configuration to edit its settings.

    This entry specifies the name of the key object within the keystore file. If creating a new configuration, enter a unique name in the Key name field.

    IBM recommends that you use a fully qualified distinguished name for the key name. For example, we might use CN=Bob,O=IBM,C=US.

  7. Specify an alias in the Key alias field. The key alias is used by the key locator to search for key objects in the keystore file.

  8. Specify a password in the Key password field. The password is used to access the key object within the keystore file.

  9. Click OK and then click Save to save the configuration.

 

Results

we have configured the key locator for the consumer binding at the application level.

 

Next steps

Specify a similar key information configuration for the generator.

 

Related tasks


Set the key locator using JAX-RPC for the generator binding on the application level
Set WS-Security using JAX-RPC at the platform level