Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Secure web services > Secure web services > Administer Web Services Security > Administer message-level security for JAX-RPC web services > Configure Web Services Security using JAX-RPC at the platform level


Configure the key locator using JAX-RPC on the server or cell level

The key locator information for the default generator bindings specifies which key locator implementation is used to locate the key for signature and encryption information if these bindings are not defined at the application level.

The key locator information for the default consumer bindings specifies which key locator implementation is used to locate the key used for signature validation or decryption if these bindings are not defined at the application level. WAS provides default values for the bindings. However, modify the defaults for a production environment.

We can configure the key locator on the server level and the cell level. In the following steps, use the first step to access the server-level default bindings and use the second step to access the cell-level bindings.


Procedure

  1. Access the default bindings for the server level.

    1. Click Servers > Server Types > WebSphere application servers > server_name

      .

    2. Under Security, click JAX-WS and JAX-RPC security runtime.

      Mixed-version environment: In a mixed node cell with a server using Websphere Application Server version 6.1 or earlier, click Web services: Default bindings for Web Services Security.mixv

  2. Click Security > Web services to access the default bindings on the cell level.

  3. Under Additional properties, click Key locator. We can configure the key locator configurations for both the default generator and the default consumer in this location.

  4. Click one of the following to work with the key locator configurations:

    New

    To create a key locator configuration. Enter a unique name for the key locator configuration in the Key locator name field. For example, you might specify sig_klocator.

    Delete

    To delete an existing configuration

    an existing key locator configuration

    To edit the settings of an existing configuration.

  5. Specify a name for the key locator class implementation in the Key locator class name field. The key locators that are associated with Version 6.0.x applications must implement the com.ibm.wsspi.wssecurity.keyinfo.KeyLocator interface.

    This interface is valid only for JAX-RPC applications. For JAX-WS applications, the JAAS Login Module implementation is used to create the security token on the generator side and to validate (authenticate) the security token on the consumer side. WAS provides the following default key locator class implementations for v6.0.x applications:

    com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator

    This implementation locates and obtains the key from a specified keystore file.

    com.ibm.wsspi.wssecurity.keyinfo.SignerCertKeyLocator

    This implementation uses the public key from the certificate of the signer. This class implementation is used by the response generator.

    com.ibm.wsspi.wssecurity.keyinfo.X509TokenKeyLocator

    This implementation uses the X.509 security token from the sender message for digital signature validation and encryption. This class implementation is used by the request consumer and the response consumer.

    For example, you might specify the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreLeyLocator implementation if you need the configuration to be the key locator for signing information.

  6. Specify the keystore password, the keystore location, and the keystore type. Keystore files contain public and private keys, root certificate authority (CA) certificates, the intermediate CA certificate, and so on. Keys that are retrieved from the keystore file are used to sign and validate or encrypt and decrypt messages or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation for the key locator class implementation, specify a key store password, location, and type.

    1. Specify a password in the Key store password field. This password is used to access the keystore file.

    2. Specify the location of the keystore file in the Key store path field.

    3. Select a keystore type from the Key store type field. The Java Cryptography Extension (JCE) used supports the following key store types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if your keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      PKCS11

      Use this format if your keystore file uses the PKCS#11 file format. Keystore files that use this format might contain Rivest Shamir Adleman (RSA) keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12

      Use this option if your keystore file uses the PKCS#12 file format.

      WAS provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is storepass and the type is JCEKS.

      Restriction: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

  7. Click OK and Save to save the configuration.

  8. Under Additional properties, click Keys.

  9. Click one of the following to work with the key configurations:

    New

    To create a key configuration. Enter a unique name in the Key name field. We must use a fully qualified distinguished name for the key name. For example, you might use CN=Bob,O=IBM,C=US.

    Delete

    To delete an existing configuration.

    an existing key configuration

    To edit the settings of the existing configuration.
    This entry specifies the name of the key object within the keystore file.

  10. Specify an alias in the Key alias field. The key alias is used by the key locator to search for key objects in the keystore file.

  11. Specify a password in the Key password field. The password is used to access the key object within the keystore file.

  12. Click OK and then click Save to save the configuration.


Results

You have configured the key locator for the server or cell level.


What to do next

Configure the key information for the default generator and the default consumer bindings that reference this key locator.
Configure the key information using JAX-RPC for the generator binding on the application level
Configure the key information for the generator binding using JAX-RPC on the server or cell level
Configure Web Services Security using JAX-RPC at the platform level

+

Search Tips   |   Advanced Search