+

Search Tips   |   Advanced Search

Set trust anchors using an assembly tool


Use an assembly tool to configure trust anchors (that specify keystores which contain trusted root certificates to validate the signer certificate) or trust stores at the application level.

There is an important distinction between V 5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V 6.0.x and later applications.

This document describes how to configure trust anchors or trust stores at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. Configure an application-level trust anchor using an assembly tool or the admin console. This document describes how to configure the application-level trust anchor using an assembly tool.

See on creating and configuring trust anchors at the server or cell level, see either Set the server security bindings using an assembly tool or Set the server security bindings .

A trust anchor specifies keystores that contain trusted root certificates, which validate the signer certificate. These keystores are used by the request receiver (as defined in the ibm-webservices-bnd.xmi file) and the response receiver (as defined in the application-client.xml file when Web services is acting as client) to validate the signer certificate of the digital signature. The keystores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request receiver in the ibm-webservices-bnd.xmi file must match the binding configuration for the response receiver in the application-client.xml file.

Complete the following steps to configure trust anchors using an assembly tool.

 

  1. Set an assembly tool to work with a Java EE enterprise application. For more information, see the related information on Assembly Tools.

  2. Create a Web services-enabled Java EE enterprise application. See either Set the server security bindings using an assembly tool or Set the server security bindings for an introduction on how to manage WS-Security binding information on the server.

  3. Set the client-side response receiver, which is defined in the ibm-webservicesclient-bnd.xmi bindings extensions file.

    1. Use an assembly tool to import the Java EE application.

    2. Click Window > Open Perspective > Other > J2EE.

    3. Click Application Client projects > application_name > appClientModule > META-INF

    4. Right-click the application-client.xml file, select Open with > Deployment Descriptor Editor, and click the WS Binding tab.

      The Client Deployment Descriptor is displayed.

    5. Locate the Port qualified name binding section and either select an existing entry or click Add, to add a new port binding. The Web services client port binding editor displays for the selected port.

    6. Locate the Trust anchor section and click Add.

      The Trust anchor window is displayed.

      1. Enter a unique name within the port binding for the Trust anchor name.

        The name is used to reference the trust anchor that is defined.

      2. Enter the keystore password, path, and keystore type.

        The supported keystore types are the JCE and Java Cryptography Extension Keystores (JCEKS) types.

      Click Edit to edit the selected trust anchor.

      Click Remove to remove the selected trust anchor.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

    7. Save the changes.

  4. Set the server-side request receiver, which is defined in the ibm-webservices-bnd.xmi bindings extensions file.

    1. Click Window > Open perspective > J2EE.

    2. Select the Web services enabled EJB or Web module.

    3. In the Package Explorer window, click the META-INF directory for an EJB module or the WEB-INF directory for a Web module.

    4. Right-click the webservices.xml file, select Open with > Web services editor, and click the bindings tab.

      The Web services bindings editor is displayed.

    5. Locate the Web service description bindings section and either select an existing entry or click Add to add a new Web services descriptor.

    6. Click Binding configurations. The Web services binding configurations editor is displayed for the selected Web services descriptor.

    7. Locate the Trust anchor section and click Add.

      The Trust anchor dialog box is displayed.

      1. Enter a unique name within the binding for the Trust anchor name.

        This unique name is used to reference the trust anchor defined.

      2. Enter the keystore password, path, and keystore type. The supported keystore types are JCE and JCEKS.

      Click Edit to edit the selected trust anchor.

      Click Remove to remove the selected trust anchor.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

    8. Save the changes.

 

Results

This procedure defines trust anchors that can be used by the request receiver or the response receiver (if the Web services is acting as client) to verify the signer certificate.

 

Example

The request receiver or the response receiver (if the Web service is acting as a client) uses the defined trust anchor to verify the signer certificate. The trust anchor is referenced using the trust anchor name.

 

Next steps

To complete the signing information configuration process for request receiver, complete the following tasks:

  1. Set the server for request digital signature verification: Verifying the message parts
  2. Set the server for request digital signature verification: choosing the verification method
To complete the process for the response receiver, if the Web services is acting as a client, complete the following tasks:

  1. Set the client for response digital signature verification: verifying the message parts
  2. Set the client for response digital signature verification: choosing the verification method

 

Related concepts


Trust anchors
Assembly tools

 

Related tasks


Assembling applications
Set the server security bindings using an assembly tool
Set the server security bindings
Set the server for request digital signature verification: Verifying the message parts
Set the server for request digital signature verification: choosing the verification method
Set the client for response digital signature verification: verifying the message parts
Set the client for response digital signature verification: choosing the verification method
Secure Web services for V5.x applications using XML digital signature