Network Deployment (Distributed operating systems), v8.0 > Secure applications and their environment > Secure web services > Secure web services > Administer Web Services Security > Administer message-level security for JAX-WS web services > Secure messages using SAML


Configure policy sets and bindings to communicate with STS

Configure policy sets and binding documents to enable a web services client to request SAML assertions from an external Security Token Service (STS). This function is enabled in WAS Version 7.0.0.7 and later releases. After installing, create a new server profile, or add SAML configuration settings to an existing profile. Read about setting up the SAML configuration for more information. WAS with SAML supports web services clients using the Web Services Security policy set and bindings when communicating with an external security token service (STS). In WAS Version 6.1 and later, web services clients use policy set and bindings to communicate with the target web services provider. A web services client uses two sets of policy set attachments: one set of policy set attachments for communicating to the target web services provider; and the other set of policy set attachments for communicating to the STS. Policy sets and bindings that are used when communicating with the target web services provider are attached to the web services client. In contrast, policy sets and bindings that enable STS communication are not directly attached to the web services clients. Instead, policy sets and bindings that enable STS communication are specified as custom properties in the web services client binding document. We can use general bindings or application-specific bindings to communicate with an STS. Using a general binding to access an STS is straightforward; simply specify the general binding name in the custom properties.

The procedure to configure application-specific bindings to access an STS is more involved. The admin console is designed to manage policy set attachments to communicate with a web service provider. The console is not designed to manage a second set of policy set attachments to communicate to an STS. However, you can use the administrative console to manage a policy set attachment to access an STS, as described in the procedure.

Use the admin console to attach the policy set used to access an STS to a web services client, and then create and modify an application-specific binding. Once the binding configuration is complete, detach the policy set and binding from the web services client. This procedure is necessary because the next step is to attach the policy set and bindings to communicate to the target web services provider. Detached application-specific bindings are not deleted from the file system, so the web services client bindings custom properties can successfully refer to the detached application-specific bindings.

The procedure uses a default application policy set, Username WSHTTPS default, as an example to describe the configuration steps to access the STS. The steps can also be applied to other policy sets. The web services application, JaxWSServicesSamples, is used in the example. JaxWSServicesSamples is not installed by default.


Procedure

  1. Import the Username WSHTTPS default policy set. In this example, the Username WSHTTPS default policy is used to demonstrate the procedure, but you can use a different policy set to configure the bindings, if the policy set meets the policy requirements of the external STS.

    1. Click Services > Policy sets > Application policy sets.

    2. Click Import.

    3. Select From Default Repository.

    4. Select the WSHTTPS default policy set.

    5. Click OK to import the policy set.

  2. Attach a policy set for the trust client. Click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples > Service client policy sets and bindings. The steps which pertain to attaching and detaching the policy set, and configuring the trust client binding, are required only if an application-specific binding is used to access the external STS. We can skip these steps, and go to the step that discusses configuring communication with the STS, if you use a general binding to access the external STS.

    1. Select the check box for the web services client resource.

    2. Click Attach Client Policy Set.

    3. Select the policy set, Username WSHTTPS default.

    This step attaches the policy set to the web services trust client, as you would do to use this policy set for the application client to access the target web services. However, since you plan to use the Username WSHTTPS default policy set to access an external STS instead, the policy set is only temporarily attached to the Web services client. The purpose of this step is to allow you to use the admin console to create or to modify the client binding document.

  3. Configure the trust client binding.

    1. Select the web services client resource again.

    2. In the Service client policy sets and bindings panel, click Assign Binding.

    3. Click New Application Specific Binding to create an application-specific binding.

    4. Specify a binding configuration name for the new application-specific binding. In this example, the binding name is SamlTCSample.

    5. Add the SSL transport policy type to the binding. Optionally, you can modify the NodeDefaultSSLSettings settings. Click Security > SSL certificate and key management > SSL configurations > NodeDefaultSSLSettings.
    Optional. We can create an HTTP transport binding using the previous steps to configure a user name and password to add to the HTTP header, or to configure a proxy. If you elect not to create an HTTP transport binding, the web services runtime environment uses the default HTTP transport settings.

  4. Add the WS-Security policy type to the binding, then modify the authentication settings.

    1. Click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples > Service client policy sets and bindings > SamlTCSample > Add > WS-Security > Authentication and protection > request:uname_token.

    2. Click Apply.

    3. Select Callback handler.

    4. Specify a user name and password (and confirm the password) to authenticate the web services client to the external STS.

    5. Click OK and Save.

  5. After the binding settings are saved, return to the Service client policy sets and bindings panel to detach the policy set and bindings.

    1. Click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples > Service client policy sets and bindings.

    2. Click the check box for the web services client resource.

    3. Click Detach client.policy set.

    The application-specific binding configuration you created in the previous steps is not deleted from the file system when the policy set is detached. This means that you can still use the application-specific binding you created to access the STS.

  6. Import the SSL certificate from the external STS.

    1. Click Security > SSL certificate and key management > Manage endpoint security configurations > server_or_node_endpoint > Keystores and certificates > NodeDefaultTrustStore > Signer certificates.

    2. Click Retrieve from port.

    3. Specify the host name and port number of the external STS server, and assign an alias to the certificate. Use the SSL STS port.

    4. Click Retrieve signer information.

    5. Click Apply and Save to copy the retrieved certificate to the NodeDefaultTrustStore object.
    Optional. If further modifications to the wstrustClientBinding configuration are needed, and the wstrustClientBinding property is pointing to an application-specific binding, attach the application-specific binding to the web services client before you can complete the modifications. The attachment is temporary. As detailed in the previous steps, you can detach the modified application-specific binding from the web service client after the modification is completed.


Results

After successfully completing the steps, the web services client is ready to send requests to the external STS.

To enable this function, the following conditions and settings were activated when you completed the procedure:


What to do next

Complete the web service client and web service provider configuration. Read about configuring client and provider bindings for the SAML bearer token for more information.
Configure client and provider bindings for the SAML bearer token
Configure client and provider bindings for the SAML holder-of-key symmetric key token

+

Search Tips   |   Advanced Search