+

Search Tips   |   Advanced Search

Secure JAX-WS web services using message-level security

Web Services Security standards and profiles address how to provide message-level protection for messages that are exchanged in a web service environment.

Before beginning this task, we must develop and deploy a JAX-WS application. See the topic "JAX-WS" for more information.

JAX-WS is the next generation web services programming model complementing the foundation provided by JAX-RPC. Using JAX-WS, development of web services and clients is simplified with greater platform independence for Java applications through the use of dynamic proxies and Java annotations. JAX-WS simplifies application development through support of a standard, annotation-based model to develop web service applications and clients. A required part of the Java Platform, Enterprise Edition 5 (Java EE 5), JAX-WS is also known as JSR 224.

JAX-WS applications can be secured with Web Services Security in one of two ways. The application can be secured using policy sets, or through the use of the Web Services Security API (WSS API). The WSS API can only be used to secure a JAX-WS client application. The following sections describe both methods.


Tasks

  1. Learn about Web Services Security.

    1. See Web Services Security concepts.

  2. Decide which programming model, JAX-WS or JAX-RPC, works best for securing the web services applications.

    1. This procedure uses JAX-WS.

  3. Configure the security bindings, or migrate an application and associated bindings.

    1. For more information about bindings, read about defining and managing policy set bindings.

  4. Develop and assemble a JAX-WS application.

    1. See Develop message-level security for JAX-WS web services

  5. Deploy the JAX-WS application.

  6. Configure and administer the Web Services Security runtime environment.

    1. Read about signing and encrypting message parts using policy sets to find out how to specify the required message-level protection. The policy specifies what protection will be applied, including which message parts to sign or encrypt, and the token types and algorithms to use. For complete information about policy sets, read about managing policy sets using the administrative console.

  7. Configure policy sets through metadata exchange (WS-MetadataExchange).

    1. In WebSphere Application Server v7.0 and later, using JAX-WS, we can enable the Web Services Metadata Exchange (WS-MetadataExchange) protocol so that the policy configuration of the service provider is included in the WSDL and is available to a WS-MetadataExchange GetMetadata request. One advantage of using the WS-MetadataExhange protocol is that we can apply message-level security to WS-MetadataExchange GetMetadata requests using a suitable system policy set. Another advantage is that the client does not have to match the provider configuration, or have a policy set attached. The client only needs the binding information, and then the client can operate based on the provider policy, or based on the intersection of the client and provider policies. We can configure a service provider to share its policy configuration using the administrative console. For more information, read the following topics:


Related:

  • Overview of standards and programming models for web services message-level security
  • Migration of JAX-WS Web Services Security bindings from v6.1
  • Auditing the Web Services Security runtime
  • General JAX-WS default bindings for Web Services Security
  • Web Services Security API programming model
  • Service Programming Interfaces (SPI)
  • Transformation of policy and binding assertions for WSDL
  • JAX-WS
  • Web services policy sets
  • Secure web services using policy sets
  • Configure the username and password for WS-Security Username or LTPA token authentication
  • Configure default Web Services Security bindings
  • Secure web services applications using the WSS APIs at the message level
  • Secure requests to the trust service using system policy sets
  • Configure the Kerberos token for Web Services Security
  • Manage policy sets
  • Attaching a policy set to a service artifact
  • Define and manage policy set bindings
  • Signing and encrypting message parts using policy sets
  • Configure security for a WS-MetadataExchange request
  • Configure a service provider to share its policy configuration
  • Troubleshoot web services
  • Tune Web Services Security for v9.0 applications