WAS v8.5 > Secure applications > Secure web services > Secure web services > Web Services Security concepts > Web Services Security concepts for v5.x applicationsPluggable token support
Pluggable security token support provides plug-in points to support customer security token types, including token generation, token validation, and client identity mapping to a WebSphere Application Server identity used by the Java EE authorization engine. Moreover, the pluggable token generation and validation framework supports XML-based tokens to be inserted into the web service message header and validated on the receiver-side validation.
There is an important distinction between v5.x and v6.0.x applications. The information in this article supports v5.x applications only used with WAS v6.0.x and later. The information does not apply to v6.0.x applications.
We can extend the login mapping mechanism to handle new types of authentication tokens. WAS provides a pluggable framework to generate security tokens on the sender-side of the message and to validate the security token on the receiver-side of the message. The framework is based on the JAAS Application Programming Interfaces (APIs).
Use the javax.security.auth.callback.CallbackHandler implementation to create a new type of security token following these guidelines:
- Use a constructor that takes a user name (a string or null, if not defined), a password (a char[] or null, if not defined) and java.util.Map (empty, if properties are not defined).
- Use handle() methods that can process the following implementations:
- javax.security.auth.callback.NameCallback
- javax.security.auth.callback.PasswordCallback
- com.ibm.wsspi.wssecurity.auth.callback.XMLTokenCallback
- com.ibm.websphere.security.auth.callback.WSCredTokenCallbackImpl
If:
- Either the javax.security.auth.callback.NameCallback or the javax.security.auth.callback.PasswordCallback implementation is populated with data, then a <wsse:UsernameToken> element is created.
- com.ibm.websphere.security.auth.callback.WSCredTokenCallbackImpl is populated, the <wsse:BinarySecurityToken> element is created from the com.ibm.websphere.security.auth.callback.WSCredTokenCallbackImpl implementation.
- com.ibm.wsspi.wssecurity.auth.callback.XMLTokenCallback is populated, a XML-based token is created based on the Document Object Model (DOM) element that is returned from the XMLTokenCallback.
Encode the token byte using the security handler and not using the javax.security.auth.callback.CallbackHandler implementation.
We can implement the com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory interface, which is a factory for instantiating the javax.security.auth.callback.CallbackHandler implementation. For our own implementation, you must provide the javax.security.auth.callback.CallbackHandler interface. The Web Service Security run time instantiates the factory implementation class and passes the authentication information from the web services message header to the factory class through the setter methods. The Web Services Security run time then invokes the newCallbackHandler() method of the factory implementation class to obtain an instance of the javax.security.auth.CallbackHandler object. The object is passed to the JAAS login configuration.
The following is an example the definition of the CallbackHandlerFactory interface:
public interface com.ibm.wsspi.wssecurity.auth.callback.CallbackHandlerFactory { public void setUsername(String username); public void setRealm(String realm); public void setPassword(String password); public void setHashMap(Map properties); public void setTokenByte(byte[] token); public void setXMLToken(Element xmlToken); public CallbackHandler newCallbackHandler();
Related concepts:
XML token