Configure the key locator using JAX-RPC for the generator binding on the application level

The key locator information for the default generator specifies which key locator implementation is used to locate the key to be used for signature and encryption information. The key locator information for the generator specifies which key locator implementation is used to locate the key to be used for signature validation or encryption.

WebSphere Application Server provides default values for the bindings. However, modify the defaults for a production environment.

Complete the following steps to configure the key locator for the generator binding on the application level:

1. Locate the encryption information configuration panel in the console.

   1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

   2. Under Manage modules, click URI_name.

   3. Under Web Services Security Properties we can access the key information for the request generator and response generator bindings.

      • For the request generator (sender) binding, click Web services: Client security bindings. Under Request generator (sender) binding, click Edit custom.

      • For the response generator (sender) binding, click Web services: Server security bindings. Under Response generator (sender) binding, click Edit custom.

   4. Under Additional properties, click Key locators.

   5. Click New to create a key locator configuration, select the box next to the configuration and click Delete to delete an existing configuration, or click the name of an existing key locator configuration to edit its settings. For a new configuration, enter a unique name in the Key locator name field. For example, you might specify gen_keyloc.

2. Specify a class name for the key locator class implementation in the Key locator class name field. The Java Authentication and Authorization Service (JAAS) Login Module implementation is used to create the security token on the generator side. Specify a class name according to the requirements of the application. For example, if the application requires that the key is read from a keystore file, specify the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation. WebSphere Application Server supports the following default key locator class implementations for Versions 6.0.x and later applications that are available to use with the request generator or response generator:

   com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator

   This implementation locates and obtains the key from the specified keystore file.

   com.ibm.wsspi.wssecurity.keyinfo.SignerCertKeyLocator

   This implementation uses the public key from the signer certificate and is used by the response generator.

3. Specify the keystore password, the keystore location, and the keystore type. Keystore files contain public and private keys, root certificate authority (CA) certificates, the intermediate CA certificate, and so on. Keys retrieved from the keystore are used to sign and validate or encrypt and decrypt messages or message parts. If we specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation for the key locator class implementation, specify a keystore password, location, and type.

   1. Specify a password in the keystore Password field. This password is used to access the keystore file.

   2. Specify the location of the keystore file in the keystore Path field.

   3. Select a keystore type from the Type field. The Java Cryptography Extension (JCE) used by IBM supports the following keystore types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if the keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      JCERACFKS

      Use JCERACFKS if the certificates are stored in a SAF key ring (z/OS only).

      PKCS11KS (PKCS11)

      Use this format if the keystore uses the PKCS#11 file format. Keystores using this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if the keystore uses the PKCS#12 file format.

      WebSphere Application Server provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is Storepass and the type is JCEKS.

      Restriction: Do not use the sample keystore files in a production environment. These samples are provided for testing purposes only.

4. Click OK and then click Save to save the configuration.

5. Under Additional properties, click Keys.

6. Click New to create a key configuration, select the box next to the configuration and click Delete to delete an existing configuration, or click the name of an existing key configuration to edit its settings. This entry specifies the name of the key object within the keystore file. For a new configuration, enter a unique name in the Key name field. For digital signatures, the key name is used by the request generator or the response generator signing information to determine which key is used to digitally sign the message.

   We must use a fully qualified distinguished name for the key name. For example, you might use CN=Bob,O=IBM,C=US.

   Important: Do not use the sample key files in a production environment. These samples are provided for testing purposes only.

7. Specify an alias in the Key alias field. The key alias is used by the key locator to search for key objects in the keystore.

8. Specify a password in the Key password field. The password is used to access the key object within the keystore file.

9. Click OK and Save to save the configuration.

Results

You have configured the key locator for the generator binding at the application level.

What to do next

Specify a similar key information configuration for the consumer.

Subtopics

• Key locator collection
  Use this page to view a list of key locator configurations that retrieve keys from the keystore for digital signature and encryption. A key locator must implement the com.ibm.wsspi.wssecurity.config.KeyLocator interface.

• Key locator configuration settings
  Use this page to specify the settings for a key locator configuration. The key locators retrieve keys from the keystore file for digital signature and encryption. This product enables you to plug in a custom key locator configuration.

• Web Services Security property collection
  Use this page to a view a list of additional properties for the configuration.

• Web Services Security property configuration settings
  Use this page to configure additional security properties.

Related tasks

Configure the key locator using JAX-RPC for the consumer binding on the application level