Set the server security bindings using an assembly tool
Use an assembly tool to edit bindings for a Web service after these bindings are deployed on a server.
There is an important distinction between Version 5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V6.0.x and later applications.
Prior to importing the Web services enterprise archive (EAR) file into the assembly tool, make sure that we have already run the wsdl2java command on the Web service to enable the Java EE application. You must import the Web services EAR file into the assembly tool.
Create an EJB file JAR file or a WAR file containing the security binding file (ibm-webservices-bnd.xmi) and the security extension file (ibm-webservices-ext.xmi). If this archive is acting as a client to a downstream service, you also need the client-side binding file (ibm-webservicesclient-bnd.xmi) and the client-side extension file (ibm-webservicesclient-ext.xmi). These files are generated using the WSDL2Java command.
See, read about the WSDL2Java command for JAX-RPC applications. We can edit these files using the Web services editor in the assembly tool.
When configuring server-side security for Web services security, the security extensions configuration specifies what security is performed, the security bindings configuration indicates how to perform what is specified in the security extensions configuration. Use the defaults for some elements at the cell and server levels in the bindings configuration, including key locators, trust anchors, the collection certificate store, trusted ID evaluators, and login mappings and reference these elements from the WAR and JAR binding configurations.
Open the Web services editor in an assembly tool to begin editing the server security extensions and bindings.
The following steps can locate the server security extensions and bindings. Other tasks specify how to configure each section of the extensions and bindings in more detail.
- Launch an assembly tool.
See the related information on Assembly Tools.
- Switch to the Java EE perspective. Click Window > Open Perspective > J2EE.
- Set the server for inbound requests and outbound responses security configuration. To configure the server for inbound requests and outbound responses...
- Click EJB Projects > application_name > ejbModule > META-INF.
- Right-click the webservices.xml file and click Open with > Web services editor. The webservices.xml file represents the server-side (inbound) Web services configuration. The webservicesclient.xml file represents the client-side (outbound) Web services configuration.
- In the Web services editor (for the webservices.xml file and inbound requests and outbound responses Web services configuration), there are several tabs at the bottom of the editor including Web Services, Port Components, Handlers, Security Extensions, Bindings, and Binding Configurations. The security extensions are edited using the Security Extensions tab. The security bindings are edited using the Security Bindings tab.
- Click the WS Extensions tab and select the port component binding to edit. The WS-Security extensions are configured for inbound requests and outbound responses. we need to configure the following information for WS-Security extensions. These topics are discussed in more detail in other topics in the documentation. Request receiver service configuration details
- Required integrity
- Set the server for request digital signature verification: Verifying the message parts
- Required confidentiality
- Set the server for request decryption: decrypting the message parts
- Login config
- Add received time stamp
- Set the server for request digital signature verification: Verifying the message parts
Response sender service configuration details
- Details
- Set the server for response signing: digitally signing message parts
- Integrity
- Set the server for response signing: digitally signing message parts
- Confidentiality
- Set the server for response encryption: encrypting the message parts
- Add created time stamp
- Set the server for response signing: digitally signing message parts
- Click the Binding Configurations tab and select the port component binding to edit. The WS-Security bindings are configured for inbound requests and outbound responses. we need to configure the following information for WS-Security bindings. These topics are discussed in more details in other topics in the documentation. Response receiver binding configuration details
- Signing Information
- Set the server for request digital signature verification: choosing the verification method
- Encryption Information
- Set the server for request decryption: choosing the decryption method
- Trust Anchor
- Set trust anchors using an assembly tool
- Certificate Store List
- Set the server-side collection certificate store using an assembly tool
- Key Locators
- Set key locators using an assembly tool
- Login Mapping
- Basic auth
- Set the server to validate basic authentication information
- ID assertion
- Set the server to validate identity assertion authentication information
- Signature
- Set the server to validate signature authentication information
- LTPA
- Set the server to validate LTPA token authentication information
- Trusted ID evaluator
- Trusted ID evaluator reference
Response sender binding configuration details
Next steps
Set the client for outbound requests and inbound responses security configuration by right-clicking the webservicesclient.xml file and clicking Open With > Deployment descriptor editor.
See Set the client security bindings using an assembly tool.
Related concepts
Assembly tools
Related tasks
Set the client security bindings using an assembly tool
Set the security bindings on a server acting as a client
Set the server security bindings
Secure Web services for V5.x applications using XML digital signature
Related
WSDL2Java command for JAX-RPC applications