Configure a policy set and bindings for XML Digital Signature with client and provider application specific bindings

We can create a custom policy set and application specific bindings for using XML Digital Signature to sign the body of the request and response SOAP messages.

This task assumes that the service provider and client that we are configuring are in the JaxWSServicesSamples application. Refer to the topic Access Samples for more information on how to obtain and install this application.

Use the following trace specification on the server. These specifications allow us to debug any future configuration problems that might occur.

*=info:com.ibm.wsspi.wssecurity.*=all:com.ibm.ws.webservices.wssecurity.*=all: com.ibm.ws.wssecurity.*=all: com.ibm.xml.soapsec.*=all: com.ibm.ws.webservices.trace.*=all: com.ibm.ws.websvcs.trace.*=all:com.ibm.ws.wssecurity.platform.audit.*=off:

This procedure explains the actions we need to complete to configure WS-Security policy set to use only the XML-Digital Signature WS-Security constraint. This procedure also explains the actions we need to complete to configure XML Digital Signature application specific custom bindings for a client and provider.

The keystores used in this procedure are provided with WebSphere Application Server and are installed in every profile created. We can use the ${USER_INSTALL_ROOT} variable directly in the configuration to conveniently point to the keystore locations without using a fully-qualified path. ${USER_INSTALL_ROOT} resolves to a path such as c:/WebSphere/AppServer/profiles/AppSrv01.

${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-sender.ks
${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-receiver.ks

Because of the nature of JaxWSServicesSamples, to apply the policy set and bindings to this application, in the console click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples. When using our own applications, we can use the following paths as an alternative way to access the provider and client for attachment of the policy set and bindings:

* Services > Service Providers > (AppName)
* Services > Service clients > (AppName)

Avoid trouble: Pay close attention to the names of the token consumers and generators in the console. The Initiator and recipient might not be what you think they should be for the tokens. The usage column in the table specifies whether a token is a consumer token or a generator token.gotcha

1. Create the custom policy set.

   1. In the console, click Services > Policy sets > Application Policy sets.

   2. Click New.

   3. Specify Name=AsignPolicy.

   4. Click Apply.

   5. Under Policies, click Add > WS-Security.

2. Edit the custom policy set to remove encryption and timestamp.

   1. In the console, click WS-Security > Main Policy.

   2. Under Message level protection, click Request message part protection.

   3. Click app_encparts.

   4. Click Delete.

   5. Click Done.

   6. Click Response message part protection.

   7. Click app_encparts.

   8. Click Delete.

   9. Click Done.

   10. Unselect Include timestamp in security header.

   11. Click Apply.

   12. Save the configuration.

3. Configure the client to use the AsignPolicy policy set.

   1. In the console, click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples > Service client policy sets and bindings.

   2. Select the web services client resource (JaxWSServicesSamples).

   3. Click Attach Policy Set.

   4. Select AsignPolicy.

4. Create a custom binding for the client.

   1. Select the web services resource again.

   2. Click Assign Binding.

   3. Click New Application Specific Binding to create an application-specific binding.

   4. Specify the bindings configuration name.

      name: clientBinding

   5. Click Add > WS-Security.

   6. If the Main Message Security Policy Bindings' panel does not display, select WS-Security.

5. Configure the client's custom bindings.

   1. Configure a Certificate Store.

      1. Click Keys and Certificates.

      2. Under Certificate store, click New Inbound... .

      3. Specify name=clientCertStore.

      4. Specify Intermediate X.509 certificate=${USER_INSTALL_ROOT}/etc/ws-security/samples/intca2.cer.

      5. Click OK.

   2. Configure a Trust Anchor.

      1. Under Trust anchor, click New...

      2. Specify name=clientTrustAnchor.

      3. Click External Keystore .

      4. Specify Full path=${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-sender.ks.

      5. Specify Password=client.

      6. Click OK.

      7. Click WS-Security in the navigation for this page.

   3. Configure the Signature Generator.

      1. Click Authentication and protection > AsymmetricBindingInitiatorSignatureToken0 (signature generator), and then click Apply.

      2. Click Callback handler

      3. Specify Keystore=custom.

      4. Click Custom keystore configuration, and then specify

         • Full path==${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-sender.ks

         • Keystore password=client

         • Name=client

         • Alias=soaprequester

         • Password=client

      5. Click OK, OK, and OK.

   4. Configure the Signature Consumer.

      1. Click AsymmetricBindingRecipientSignatureToken0 (signature consumer), and then click Apply.

      2. Click Callback handler.

      3. Under Certificates, click the Certificate store radial button, and specify:

         • Certificate store=clientCertStore

         • Trusted anchor store=clientTrustAnchor

      4. Click OK, and OK.

   5. Configure the request Signing Information.

      1. Click request:app_signparts, and specify Name=clientReqSignInfo.

      2. Under Signing key information, click New, and then specify:

         • Name=clientReqSignKeyInfo

         • Type=Security Token reference

         • Token generator or consumer name=AsymmetricBindingInitiatorSignatureToken0

      3. Click Ok, and then click Apply.

      4. Under Message part reference, select request:app_signparts .

      5. Click Edit.

      6. Under Transform algorithms, click New

      7. Specify URL=http://www.w3.org/2001/10/xml-exc-c14n#.

      8. Click OK, OK, and OK.

   6. Configure the response Signing Information.

      1. Click response:app_signparts, and specify Name=clientRespSignInfo.

      2. Click Apply.

      3. Under Signing key information, click New, and then specify:

         • Name=clientRspSignKeyInfo

         • Token generator or consumer name=AsymmetricBindingRecipientSignatureToken0

      4. Click Ok.

      5. Under Signing key information, click clientRspSignKeyinfo, and then click Add.

      6. Under Message part reference, select response:app_signparts .

      7. Click Edit.

      8. Under Transform algorithms, click New

      9. Specify URL=http://www.w3.org/2001/10/xml-exc-c14n#.

      10. Click OK, OK, and OK.

6. Configure the provider to use the AsignPolicy policy set.

   1. In the console, click Applications > Application types > WebSphere enterprise applications > JaxWSServicesSamples > Service provider policy sets and bindings.

   2. Select the web services provider resource (JaxWSServicesSamples).

   3. Click Attach Policy Set.

   4. Select AsignPolicy.

7. Create a custom binding for the provider.

   1. Select the web services provider resource again.

   2. Click Assign Binding.

   3. Click New Application Specific Binding to create an application-specific binding.

   4. Specify Bindings configuration name:providerBinding.

   5. Click Add > WS-Security.

   6. If the Main Message Security Policy Bindings' panel does not display, select WS-Security.

8. Configure the custom bindings for the provider.

   1. Configure a Certificate Store.

      1. Click Keys and Certificates.

      2. Under Certificate store, click New Inbound....

      3. Specify:

         • Name=providerCertStore

         • Intermediate X.509 certificate=${USER_INSTALL_ROOT}/etc/ws-security/samples/intca2.cer

      4. Click OK.

   2. Configure a Trust Anchor.

      1. Under Trust anchor, click New...

      2. Specify, Name=providerTrustAnchor.

      3. Click External Keystore, and specify:

         • Full path=${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-receiver.ks

         • Password=server

      4. Click OK, and then click WS-Security in the navigation for this page.

   3. Configure the Signature Generator.

      1. Click Authentication and protection > AsymmetricBindingRecipientSignatureToken0 (signature generator), and then clickApply.

      2. Click Callback handler

      3. Specify Keystore=custom.

      4. Click Custom keystore configuration, and then specify

         • Full path=${USER_INSTALL_ROOT}/etc/ws-security/samples/dsig-receiver.ks

         • Keystore password=server

         • Name=server

         • Alias=soapprovider

         • Password=server

      5. Click OK, OK, and OK.

   4. Configure the Signature Consumer.

      1. Click AsymmetricBindingInitiatorSignatureToken0 (signature consumer), and then click Apply.

      2. Click Callback handler.

      3. Under Certificates, click the Certificate store radial button, and specify:

         • Certificate store=providerCertStore

         • Trusted anchor store=providerTrustAnchor

      4. Click OK.

      5. Click Authentication and protection in the navigation for this page.

   5. Configure the request Signing Information.

      1. Click request:app_signparts, and specify Name=reqSignInf.

      2. Click Apply.

      3. Under Signing key information, click New, and then specify:

         • Name=reqSignKeyInfo

         • Token generator or consumer name=AsymmetricBindingInitiatorSignatureToken0

      4. Click Ok.

      5. Under Signing key information, click reqSignKeyinfo, and then click Add.

      6. Under Message part reference, click request:app_signparts.

      7. Click Edit.

      8. Under Transform algorithms, click New, and then specify URL=http://www.w3.org/2001/10/xml-exc-c14n#.

      9. Click OK, OK, and OK.

   6. Configure the response Signing Information.

      1. Click response:app_signparts, and specify Name=rspSignInfo.

      2. Click Apply.

      3. Under Signing key information, click New, and then specify:

         • Name=rspSignKeyInfo

         • Type=Security Token reference

         • Token generator or consumer name=AsymmetricBindingRecipientSignatureToken0

      4. Click Ok, and then click Apply.

      5. Under Message part reference, select response:app_signparts .

      6. Click Edit.

      7. Under Transform algorithms, click New.

      8. Specify URL=http://www.w3.org/2001/10/xml-exc-c14n#.

      9. Click OK, OK, and OK.

9. Click Save to save the configuration changes.

10. Restart the client and provider.

    1. Stop the client and the provider.

    2. Restart the client and the provider.

11. Test the Service.

    1. Point the web browser at the JaxWSServicesSamples:
       http://localhost:9080/wssamplesei/demo

       Avoid trouble: Make sure we provide the correct hostname and port if the profile is not on the same machine, or the port is not 9080.gotcha

    2. Select Message Type Synchronous Echo.

    3. Make sure Use SOAP 1.2 is not selected.

    4. Enter a message and click Send Message.
    The sample application should reply with JAXWS==>Message.

Results

The JaxWSServicesSamples web services application is configured to use XML Digital Signature to sign the body for both the SOAP request and response.

Related concepts

Access the samples

Related tasks

Secure web services using policy sets