WAS v8.5 > Develop applications > Develop web services - Security (WS-Security) > Configure Web Services Security during application assembly > Configure signature authentication for v5.x web services with an assembly tool

Configure the client for signature authentication: collecting the authentication information


Signature authentication refers to an X.509 certificate sent by the client to the server. The certificate is used to authenticate to the user registry that is configured at the server. The client collects the authentication information for signature authentication. There is an important distinction between v5.x and v6.0.x and later applications. The information in this article supports v5.x applications only used with WebSphere Application Server v6.0.x and later. The information does not apply to v6.0.x and later applications.

We can configure signature authentication. A signature refers to the use of an X.509 certificate to login on the target server.

To specify how the client collects the authentication information for signature authentication:

  1. Launch an assembly tool. For more information, see the related information on Assembly Tools.
  2. Switch to the Java EE perspective. Click Window > Open Perspective > J2EE.

  3. Click Application Client Projects > application_name > appClientModule > META-INF.
  4. Right-click the application-client.xml file, select Open with > Deployment descriptor editor.

  5. Click the WS Binding tab, located at the bottom of the deployment descriptor editor within the assembly tool.

  6. Expand the Security request sender binding configuration > Signing information and click Edit to modify the signing key name and signing key locator. To create new signing information, click Enable. The certificate sent to log in at the server is the one configured in the Signing Information section. Review the key locator information to understand how the signing key name maps to a key within the key locator entry.

    The following list describes the purpose of this information. Some of these definitions are based on the XML-Signature specification, located at the following web address: http://www.w3.org/TR/xmldsig-core

    Canonicalization method algorithm

    Canonicalizes the <SignedInfo> element before it is digested as part of the signature operation.

    Digest mehod algorithm

    Represents the algorithm that is applied to the data after transforms are applied, if specified, to yield the <DigestValue> element. The signing of the <DigestValue> element binds the resource content to the signer key. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.

    Signature method algorithm

    Represents the algorithm used to convert the canonicalized <SignedInfo> element value into the <SignatureValue> value. The algorithm selected for the client request sender configuration must match the algorithm selected in the server request receiver configuration.

    Signing key name

    Represents the key entry associated with the signing key locator. The key entry refers to an alias of the key, which is used to sign the request.

    Signing key locator

    Represents a reference to a key locator implementation.

  7. Expand the Security request sender binding configuration > Login binding section.

  8. Click Edit to view the login binding information. Select or enter the following information:

    Authentication method

    Type of authentication that occurs. Select Signature to use signature authentication.

    Token value type URI and Token value type URI local name

    When you select Signature, we cannot edit token value type Uniform Resource Identifier (URI) and local name values. Specifies custom authentication types. For signature authentication, leave these fields blank.

    Callback handler

    Specifies the Java Authentication and Authorization Server (JAAS) callback handler implementation for collecting signature information. Enter the following callback handler for signature authentication: com.ibm.wsspi.wssecurity.auth.callback.NonPromptCallbackHandler

    This callback handler is used because the signature method does not require user interaction.

    Basic authentication user ID and Basic authentication password

    Leave the BasicAuth fields blank when signature authentication is used.

    Property name and property value

    This field enables you to enter properties and name and value pairs for use by custom callback handlers. For signature authentication, do not enter any information.


Other customization entries: There is a basic authentication entry in the Port Qualified Name Binding Details section. This entry is used for HTTP transport authentication, which might be required if the router servlet is protected.

Information specified in the Web Services Security signature authentication section overrides the basic authentication information specified in the Port Qualified Name Binding Details section for authorizing the Web service.

To use the signature authentication method, specify the authentication method in the Login configuration section of an assembly tool.


Related concepts:

Key locator
Development and assembly tools
Signature authentication method


Related


Configure the client for signature authentication: specifying the method
Configure the client security bindings using an assembly tool


Related information:

XML-Signature Syntax and Processing W3C Recommendation 12 February 2002


+

Search Tips   |   Advanced Search