+

Search Tips   |   Advanced Search

Secure conversation client cache and trust service configuration

For both distributed and local clients, the WAS secure conversation client cache stores tokens on the client.

WebSphere Application Server supports caching of the security context token for both the distributed client and local client. If the security context token is distributed, a client in the same replication domain uses the same security context token. Distributed caching also supports disk offload to save the security context token to disk for recovery. When the client runs applications using secure conversation, and is part of a cluster setup, then the client can use the distributed cache mechanism to replicate the token data among the cluster members.

To use the console to modify the cache settings, click Services > Security Cache.

We can configure the cache settings, such as the following.

The WS-SecureConversation client rejects a security context token that is issued at a future time. If we cannot synchronize the clock between the client machine and service machine, the clock skew could be configured to prevent the rejection of a valid token. The default clock skew is 3 minutes. To modify the default clock skew setting, add the following custom property to the desired minutes:

Alternatively, use wsadmins to manage secure conversation client cache configurations.


Thin client

For a web service application client running outside WebSphere Application Server, the security context token is cached only in the local Java process. The following system properties can be used to override the default cache setting on the thin client:

com.ibm.wsspi.wssecurity.SC.cache.cushion

Time in minutes to renew a security context token to be used with WS-SecureConversation on the client side so that the security context token has enough time to complete the downstream call. The default value is 10 minutes, and the minimum value is 3 minutes.

com.ibm.wsspi.wssecurity.SC.token.clockSkewTolerance

Tolerant clock skew time for a token between two machines. The default value is 3 minutes.


WS-Reliable Messaging settings

When WebSphere Application Server applications use policies such as WS-I RSP with managed persistent WS-Reliable Messaging, modify the cache and trust configuration values.

Set the cache configuration time value to 120 minutes.

  1. In the WAS console, click Services > Security Cache.

  2. Modify the value of the Time token is in cache after timeout field from 10 to 120.

  3. Click Apply, and then click Save.
Increasing the cache time value means that the token remains in the cache for a longer period after token expiration, so that the token is available for renewal. The WS-Reliable Messaging runtime scopes the CreateSequence message to the security context token. Therefore, it is important to maintain the same security context for the life time of the Reliable Messaging sequence.

Enable distributed caching using the default option, Synchronous update of cluster members, to support distributed clients. For more information, refer to the topic Enable the distributed cache using synchronous update and token recovery.


Additional recommended changes

Other important configuration changes are also recommended.


Related tasks

  • Manage WS-Security distributed cache configurations
  • Enable the distributed cache using synchronous update and token recovery
  • Configure the Web Services Security distributed cache using the administrative console
  • Enable distributed cache and session affinity when using Secure Conversation

  • Security cache settings