+

Search Tips   |   Advanced Search

Configure token consumers using JAX-RPC to protect message authenticity at the application level

We can specify the token consumer on the application level. The token consumer information is used on the consumer side to incorporate the security token.

We need to understand that the keystore/alias information that we provide for the generator, and the keystore/alias information that we provide for the consumer are used for different purposes. The main difference applies to the Alias for an X.509 callback handler.

When used in association with an encryption consumer, the alias supplied for the consumer is used to retrieve the private key to decrypt the message. A password is required. When associated with a signature consumer, the alias supplied for the consumer is used strictly to retrieve the public key used to resolve an X.509 certificate that is not passed in the SOAP security header as a BinarySecurityToken. A password is not required.

Configure the token consumer on the application level.


Tasks

  1. Locate the token consumer panel in the administrative console.

    1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

    2. Under Modules, click Manage modules > URI_name.

    3. Under Web Services Security Properties we can access the token consumer for the following bindings:

    4. Under Required properties, click Token consumer.

    5. Click New to create a token consumer configuration, click Delete to delete an existing configuration, or click the name of an existing token consumer configuration to edit its settings. For a new configuration, enter a unique name in the Token consumer name field. For example, we might specify con_signtcon.

  2. Specify a class name in the Token consumer class name field. The JAAS Login Module implementation is used to validate (authenticate) the security token on the consumer side.

    The token consumer class name for the request consumer and the response consumer must be similar to the token generator class name for the request generator and the response generator. For example, if the application requires a user name token consumer, we can specify the com.ibm.wsspi.wssecurity.token.UsernameTokenGenerator class name on the Token generator panel for application level and the com.ibm.wsspi.wssecurity.token.UsernameTokenConsumer class name in this field.

  3. Optional: Select a part reference in the Part reference field. The part reference indicates the name of the security token defined in the deployment descriptor. For example, if we receive a username token in your request message, we might want to reference the token in the username token consumer.

    Important: On the application level, if we do not specify a security token in the deployment descriptor, the Part reference field is not displayed. If we define a security token called user_tcon in the deployment descriptor, user_tcon is displayed as an option in the Part reference field.

  4. Optional: In the certificate path section of the panel, select a certificate store type and indicate the trust anchor and certificate store name, if necessary. These options and fields are necessary when we specify com.ibm.wsspi.wssecurity.token.X509TokenConsumer as the token consumer class name. The names of the trust anchor and the collection certificate store are created in the certificate path under your token consumer.

    Restriction: The com.ibm.wsspi.wssecurity.token.TokenConsumingComponent interface is not used with JAX-WS web services. If we are using JAX-RPC web services, this interface is still valid.

    We can select one of the following options:

    None

    If we select this option, the certificate path is not specified.

    Trust any

    If we select this option, any certificate is trusted. When the received token is consumed, the Application Server does not validate the certificate path.

    Dedicated signing information

    If we select this option, we can select a trust anchor and a certificate store configuration. When we select the trust anchor or the certificate store of a trusted certificate, configure the trust anchor and the certificate store before setting the certificate path.

    Trust anchor

    A trust anchor specifies a list of key store configurations that contain trusted root certificates. These configurations are used to validate the certificate path of incoming X.509-formatted security tokens. Keystore objects within trust anchors contain trusted root certificates used by the CertPath API to validate the trustworthiness of a certificate chain. (Dist) (ZOS) We must create the keystore file using the key tool utility, located in the install_dir/java/jre/bin/keytool file.(iSeries) We must create the keystore file using the keytool utility. The keytool utility is available using the QShell Interpreter.

    We can configure trust anchors for the application level by completing the following steps:

    1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

    2. Under Related Items, click EJB Modules or Web Modules > URI_name.
    3. Access the token consumer from the following bindings:

    4. Under Additional properties, click Trust anchors.

    Collection certificate store

    A collection certificate store includes a list of untrusted, intermediary certificates and certificate revocation lists (CRLs). The collection certificate store is used to validate the certificate path of the incoming X.509-formatted security tokens. We can configure the collection certificate store for the application level by completing the following steps:

    1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

    2. Under Related Items, click EJB Modules or Web Modules > URI_name.
    3. Access the token consumer from the following bindings:

    4. Under Additional properties, click Collection certificate store.

  5. Optional: Specify a trusted ID evaluator. The trusted ID evaluator is used to determine whether to trust the received ID. We can select one of the following options:

    None

    If we select this option, the trusted ID evaluator is not specified.

    Existing evaluator definition

    If we select this option, we can select one of the configured trusted ID evaluators. For example, we can select the SampleTrustedIDEvaluator, which is provided by WebSphere Application Server as an example.

    Binding evaluator definition

    If we select this option, we can configure a new trusted ID evaluator by specifying a trusted ID evaluator name and class name.

    Trusted ID evaluator name

    Name used by the application binding to refer to a trusted identity (ID) evaluator defined in the default bindings.

    Trusted ID evaluator class name

    Species the class name of the trusted ID evaluator. The specified trusted ID evaluator class name must implement the com.ibm.wsspi.wssecurity.id.TrustedIDEvaluator interface. The default TrustedIDEvaluator class is com.ibm.wsspi.wssecurity.id.TrustedIDEvaluatorImpl. When we use this default TrustedIDEvaluator class, specify the name and value properties for the default trusted ID evaluator to create the trusted ID list for evaluation. To specify the name and value properties:

    1. Under Additional properties, click Properties > New.

    2. Trusted ID evaluator name in the Property field. Specify the name in the form, trustedId_n where _n is an integer from 0 to n.

    3. Trusted ID in the Value field.

    For example: 

    property name="trustedId_0", value="CN=Bob,O=ACME,C=US"
property name="trustedId_1, value="user1"

    If the distinguished name (DN) is used, the space is removed for comparison. See the programming model information in the documentation for an explanation of how to implement the com.ibm.wsspi.wssecurity.id.TrustedIDEvaluator interface. See Default implementations of the Web Services Security service provider programming interfaces.

    Define the trusted ID evaluator on the server level instead of the application level. To define the trusted ID evaluator on the server level, complete the following steps:

    1. Click Servers > Server Types > WebSphere application servers > server.

    2. Under Security, click security runtime.

      Mixed-version environment: In a mixed node cell with a server using WAS version 6.1 or earlier, click Web services: Default bindings for Web Services Security.mixv

    3. Under Additional properties, click Trusted ID evaluators.

    4. Click New to define a new trusted ID evaluator.

    The trusted ID evaluator configuration is available only for the token consumer on the server-side application level.

  6. Optional: Select the Verify nonce option. This option indicates whether to verify a nonce in the user name token if it is specified for the token consumer. Nonce is a unique, cryptographic number that is embedded in a message to help stop repeat, unauthorized attacks of user name tokens. The Verify nonce option is valid only when the incorporated token type is a user name token.

  7. Optional: Select the Verify timestamp option. This option indicates whether to verify a time stamp in the user name token. The Verify nonce option is valid only when the incorporated token type is a user name token.

  8. Specify the value type local name in the Local name field. This field specifies the local name of the value type for the consumed token. For a user name token and an X.509 certificate security token, WAS provides predefined local names for the value type.

    URI Local name Description
    A namespace URI is not applicable. Specify http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3 as the local name value. Name of an X.509 certificate token
    A namespace URI is not applicable. Specify http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1 as the local name value. Name of the X.509 certificates in a PKI path
    A namespace URI is not applicable. Specify http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#PKCS7 as the local name value. List of X509 certificates and certificate revocation lists (CRL) in a PKCS#7
    Specify http://www.ibm.com/websphere/appserver/tokentype/5.0.2 as the URI value. Specify LTPA as the local name value. Specifies a binary security token containing an embedded LTPA token.

  9. Optional: Specify the value type URI in the URI field. This entry specifies the namespace URI of the value type for the consumed token.

    Remember: If we specify the token consumer for a username token or an X.509 certificate security token, we do not need to specify a value type URI.

    To specify another token, specify both the local name and the URI. For example, if we have an implementation of our own custom token, we can specify CustomToken in the Local name field and http://www.ibm.com/custom

  10. Click OK and Save to save the configuration.

  11. Click the name of our token consumer configuration.

  12. Under Additional properties, click JAAS configuration. The JAAS configuration specifies the name of the JAAS configuration defined in the JAAS login panel. The JAAS configuration specifies how the token logs in on the consumer side.

  13. Select a JAAS configuration from the JAAS configuration name field. The field specifies the name of the JAAS system of application login configuration. We can specify additional JAAS system and application configurations by clicking Global security. Under Authentication, click JAAS and click either Application logins > New or System logins > New. (Dist) (ZOS) For more information on the JAAS configurations, see JAAS configuration settings. Do not remove the predefined system or application login configurations. However, within these configurations, we can add module class names and specify the order in which WAS loads each module. WAS provides the following predefined JAAS configurations:

    ClientContainer

    This selection specifies the login configuration used by the client container applications. The configuration uses the CallbackHandler API defined in the deployment descriptor for the client container. To modify this configuration, see the JAAS configuration panel for application logins.

    WSLogin

    This selection specifies whether all of the applications can use the WSLogin configuration to perform authentication for the security run time. To modify this configuration, see the JAAS configuration panel for application logins.

    DefaultPrincipalMapping

    This selection specifies the login configuration used by Java 2 Connectors (J2C) to map users to principals defined in the J2C authentication data entries. To modify this configuration, see the JAAS configuration panel for application logins.

    system.LTPA_WEB

    This selection processes login requests used by the web container such as servlets and JavaServer Pages (JSPs) files. To modify this configuration, see the JAAS configuration panel for system logins.

    system.RMI_OUTBOUND

    This selection processes RMI requests sent outbound to another server when the com.ibm.CSIOutboundPropagationEnabled property is true. Set in the CSIv2 authentication panel.

    To access the panel, click Security > Global security. Under Authentication, click RMI/IIOP security > CSIv2 Outbound authentication. To set the com.ibm.CSIOutboundPropagationEnabled property, select Security attribute propagation. To modify this JAAS login configuration, see the JAAS - System logins panel.

    system.wssecurity.X509BST

    This selection verifies an X.509 binary security token (BST) by checking the validity of the certificate and the certificate path. To modify this configuration, see the JAAS configuration panel for system logins.

    system.wssecurity.PKCS7

    This selection verifies an X.509 certificate within a PKCS7 object that might include a certificate chain, a certificate revocation list, or both. To modify this configuration, see the JAAS configuration panel for system logins.

    system.wssecurity.PkiPath

    This section verifies an X.509 certificate with a public key infrastructure (PKI) path. To modify this configuration, see the JAAS configuration panel for system logins.

    system.wssecurity.UsernameToken

    This selection verifies the basic authentication (user name and password) data. To modify this configuration, see the JAAS configuration panel for system logins.

    system.wssecurity.IDAssertionUsernameToken

    This selection supports the use of identity assertion in Versions 6 and later applications to map a user name to a WAS credential principal. To modify this configuration, see the JAAS configuration panel for system logins.

    system.WSS_INBOUND

    This selection specifies the login configuration for inbound or consumer requests for security token propagation using Web Services Security. To modify this configuration, see the JAAS configuration panel for system logins.

    system.WSS_OUTBOUND

    This selection specifies the login configuration for outbound or generator requests for security token propagation using Web Services Security. To modify this configuration, see the JAAS configuration panel for system logins.

    None

    With this selection, we do not specify a JAAS login configuration.

  14. Click OK and then click Save to save the configuration.

We have configured the token consumer for the application level.


What to do next

Specify a similar token generator configuration for the application level.


Subtopics


Related:

  • Default implementations of the Web Services Security service provider programming interfaces
  • Configure the collection certificate store for the consumer binding on the application level
  • Configure token consumers using JAX-RPC to protect message authenticity at the application level
  • Configure programmatic logins for JAAS