WAS v8.5 > Develop applications > Develop web services - Security (WS-Security) > Develop applications that use Web Services Security > Develop message-level security for JAX-WS web services > Secure web services applications using the WSS APIs at the message level > Secure messages at the request generator using WSS APIs > Secure messages at the request generator using WSS APIs

Configure encryption to protect message confidentiality using the WSS APIs

We can configure encryption information for the client-side request generator (sender) bindings. Encryption information is used to specify how the generators (senders) encrypt outgoing SOAP messages. To configure encryption, specify which message parts to encrypt and specify which algorithm methods and security tokens are to be used for encryption.

Confidentiality refers to encryption while integrity refers to digital signing. Confidentiality reduces the risk of someone understanding the message flowing across the Internet. With confidentiality specifications, the message is encrypted before it is sent and decrypted when it is received at the correct target. Prior to configuring encryption, familiarize yourself with XML encryption. For encryption, specify the following:

To configure encryption and encrypted parts on the client side, use the WSSEncryption and WSSEncryptPart APIs, or configure policy sets using the dmgr console.

WebSphere Application Server provides default values for bindings. However, an administrator must modify the defaults for a production environment.

WAS uses encryption information for the default generator to encrypt parts of the SOAP message. The WSSEncryption API configures the following required parts as encrypted parts.

Required encrypted parts. Use encrypted parts to increase the confidentiality of SOAP messages.

Encryption parts Description
Keywords Keywords are used to add the encrypted parts to the SOAP message.
XPath expression An XPath expression is used to add the encrypted parts to the SOAP message.
WSSEncryptPart object This object adds the encrypted parts to the SOAP message.
WSSSignature object This object adds the signature component as an encrypted part.
Header This part adds the header in the SOAP header, specified by QName, as an encryption part.
Security token object This object adds the security token as an encryption part.

Web Services Security API (WSS API) supports symmetric encryption, using a shared key, only when Web Services Secure Conversation (WS-SecureConversation) is used.

The WSS APIs allow the use of either keywords or an XPath expression to specify the parts of the message that are to be encrypted. WAS supports the use of the following keywords:

Supported encryption keywords. Use keywords to specify encrypted parts.

Keyword References
BODY_CONTENT The keyword for the contents of the SOAP message body as an encryption target.
SIGNATURE The keyword for the signature component as an encryption target.

If configuring using the WSS APIs, the WSSEncryption and WSSEncryptPart APIs complete these high-level steps:

  1. Use the WSSEncryption API to configure encryption. The WSSEncryption API performs these tasks by default:

    1. Generates the callback handler.
    2. Generates the generator security token object.

    3. Adds the security token reference type.

    4. Adds the signature component.

    5. Adds the WSSEncryptPart object.

    6. Adds the parts to be encrypted. Adds the default parts as targets of encryption using keywords and XPath expressions.

    7. Adds the header in the SOAP message, specified by QName.

    8. Sets the default data encryption method.
    9. Whether the key is to be encrypted using a Boolean value.

    10. Sets the default key encryption method.

    11. Selects a part reference.

    12. Sets the MTOM optimization Boolean value.

  2. Use the WSSEncryptPart API to configure encrypted parts or add a transform method. The WSSEncryptPart API performs these tasks by default:

    1. Sets the encrypted parts specified using keywords or an XPath expression.

    2. Sets the encrypted parts specified by an XPath expression.

    3. Sets the signature component object, WSSSignature.

    4. Sets the header in the SOAP message, specified by QName.

    5. Sets the generator security token.

    6. Adds the transform method, if needed.

  3. Change from the default values for algorithm or message parts, as needed. For example: you could change one or more of the following items:

    • Change the data encryption algorithm from the default value of AES 128.

    • Change the key encryption algorithm from the default value of KW_RSA_OAEP.

    • Specify to not encrypt the key (false).

    • Change the security token type from default of X.509 token.

    • Change the security token reference type from the default value of SecurityToken.REF_STR.

    • Only use BODY_CONTENT as an encryption part and not use SIGNATURE also.
    • Turn MTOM optimization on (true).


Results

The encryption information is configured for the generator binding.


Example

The following is an example of the WSSEncryption API: 

    WSSFactory factory = WSSFactory.getInstance();
    WSSGenerationContext gencont = factory.newWSSGenerationContext();
   
    X509GenerateCallbackHandler callbackhandler = generateCallbackHandler();
    SecurityToken token = factory.newSecurityToken(X509Token.class, callbackHandler);
    WSSEncryption enc = factory.newWSSEncryption(token);
    
    gencont.add(enc);

You must configure similar decryption information for the client-side response consumer (receiver) bindings, if we have not already configured the information.

Next, review the WSSEncryption API process.


Subtopics


Related concepts:

XML encryption


Related


Signing and encrypting message parts using policy sets
Configure decryption methods to protect message confidentiality using the WSS APIs


+

Search Tips   |   Advanced Search